Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-02-2024 23:58

General

  • Target

    636c32103ef487d1c30df530296f014b.exe

  • Size

    163KB

  • MD5

    636c32103ef487d1c30df530296f014b

  • SHA1

    f280007f3c78b0823d8978bec1c1cdf792bf5fc6

  • SHA256

    c79f0b410c62adbad0d697c85f0f6cf786c61e1a1244090650440d8a09b90bbd

  • SHA512

    2a01b0fb459a710c4d8ffb20fe2907bbb5ca091769cb8b3216d909208ee662f9c2f6f035fa1c8aeb9222ee7018c6da15615414b2556e02f0bbcc3bd05337f604

  • SSDEEP

    3072:eQ37N6u0D0i+zGJKHZj+4M48iIp2WZnFzw0I:eK8u0Qi+yQHZEiIttw

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32
rc4.i32

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\636c32103ef487d1c30df530296f014b.exe
    "C:\Users\Admin\AppData\Local\Temp\636c32103ef487d1c30df530296f014b.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1692
  • C:\Users\Admin\AppData\Roaming\cusribh
    C:\Users\Admin\AppData\Roaming\cusribh
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:1164
  • C:\Users\Admin\AppData\Local\Temp\A4A7.exe
    C:\Users\Admin\AppData\Local\Temp\A4A7.exe
    1⤵
    • Executes dropped EXE
    PID:400
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\D667.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\D667.dll
      2⤵
      • Loads dropped DLL
      PID:3688
  • C:\Users\Admin\AppData\Local\Temp\28ED.exe
    C:\Users\Admin\AppData\Local\Temp\28ED.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5108
    • C:\Users\Admin\AppData\Local\Temp\28ED.exe
      C:\Users\Admin\AppData\Local\Temp\28ED.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      PID:1956
  • C:\Users\Admin\AppData\Local\Temp\6589.exe
    C:\Users\Admin\AppData\Local\Temp\6589.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    PID:4328
  • C:\Users\Admin\AppData\Local\Temp\992D.exe
    C:\Users\Admin\AppData\Local\Temp\992D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Users\Admin\AppData\Local\Temp\is-AKFG7.tmp\992D.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-AKFG7.tmp\992D.tmp" /SL5="$B0218,2424585,54272,C:\Users\Admin\AppData\Local\Temp\992D.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe
        "C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe" -i
        3⤵
        • Executes dropped EXE
        PID:2752
      • C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe
        "C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe" -s
        3⤵
        • Executes dropped EXE
        PID:3220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe

    Filesize

    3.1MB

    MD5

    98590314e78d26036e8341291de3fbfa

    SHA1

    2427e2f5da4d0f619336425f13aafc35f420164c

    SHA256

    a149f27599f37290d503d9b27e77deb968fafaa6f29e6e1db0440cbd34482a79

    SHA512

    51c2351befd13a7ff2dc23a54ffb6732de8bed3c7800871bf09ec0949ac8b963ae5e9fc9e65c750074afabd040d9c373a5c0d5c4749a9ca94e5680a1f385c680

  • C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe

    Filesize

    512KB

    MD5

    5d62d9346de4243e2a1520805b8bdb98

    SHA1

    a1d0a5733124b32ea742d11cf5f8a456962aa529

    SHA256

    30bca3149a8b92bfb3d23aa3afd7420fbd5e77fdd7fd444a7c84c7c6aec0898e

    SHA512

    23b6952afa9bc66299192f1ac8a70fa07d84b1d2cee8d0673cd19692fd747074e7937c1d32334f190ee3bbf5971b5d2b406ab96a1c05e1b13ad5b55d47e2a2bf

  • C:\Users\Admin\AppData\Local\Temp\28ED.exe

    Filesize

    1.9MB

    MD5

    398ab69b1cdc624298fbc00526ea8aca

    SHA1

    b2c76463ae08bb3a08accfcbf609ec4c2a9c0821

    SHA256

    ca827a18753cf8281d57b7dff32488c0701fe85af56b59eab5a619ae45b5f0be

    SHA512

    3b222a46a8260b7810e2e6686b7c67b690452db02ed1b1e75990f4ac1421ead9ddc21438a419010169258b1ae4b206fbfa22bb716b83788490b7737234e42739

  • C:\Users\Admin\AppData\Local\Temp\6589.exe

    Filesize

    560KB

    MD5

    e6dd149f484e5dd78f545b026f4a1691

    SHA1

    3ea5d0fb2de5bfad3dc6dc1744708ccd31102df6

    SHA256

    11243641663323721ba21494a394de70ae70d4ea23c23f2e2a397fcc3cfea1a7

    SHA512

    0defb358d59221c56731745a25250dfea49ecbb411f11f31a92ec20fa2123646f4aaf9fd4999898c39e4674f616bc1bed7ef2368b61a29d595dc7b9340dd058b

  • C:\Users\Admin\AppData\Local\Temp\992D.exe

    Filesize

    2.5MB

    MD5

    7b96170ca36e7650b9d3a075126b8622

    SHA1

    311068f2f6282577513123b9181283ffb01d55ce

    SHA256

    e85d92a87e4bc4fd5062e9b1ff763ad228da2bb750e98fc9e29e20075f3d26f6

    SHA512

    e5ad08aebfcd41ac76de3544bf3f7b720c36ab2a0c8d2ad26e2c5e672d24dab22ba49aa94e47f90c6014f42b4a23d0f644b0b91a02242b8dd3b7368940d56bfd

  • C:\Users\Admin\AppData\Local\Temp\A4A7.exe

    Filesize

    2.9MB

    MD5

    33310448df23034a9132bb8d15c52743

    SHA1

    4864ae2d2fbce448b192f71df7c27e9857eab2be

    SHA256

    c92f6252d6f75b2369432f2d9aea26bf0f11f2c6f7e1642530dea21e9d502bf9

    SHA512

    6cd8db44bf20303bdf4f4f47849eda852639c2984930f3b5a595715ce0b9f4ae492e4957c08bda5922d42871dc237cc2476f7e33757a0d5d65ea21ea5234d38d

  • C:\Users\Admin\AppData\Local\Temp\A4A7.exe

    Filesize

    4.4MB

    MD5

    77d6b6264a2bbc1764c3c6bb45cc4c82

    SHA1

    d4861fb655582a9bd96e9c83a6ce4b5c14bb290c

    SHA256

    e297384a9e41adeb15aa416eded4aa2401318895aa23f33b1ec42000b119c503

    SHA512

    ef414be344417cd7a4853b599cdbc6172b9b59b5dbbfe4da1b04640a39df76c3c9bfdcfa4e9cc7c366761b5c4acea7d083089009a7026d23a34754251e2823e0

  • C:\Users\Admin\AppData\Local\Temp\D667.dll

    Filesize

    2.0MB

    MD5

    7aecbe510817ee9636a5bcbff0ee5fdd

    SHA1

    6a3f27f7789ccf1b19c948774d84c865a9ac6825

    SHA256

    b4ee4aa0b664fe673986399de8105c600330339971bd8583177fa38dddd13aac

    SHA512

    a681efb97745aed5f73d197730049ff80798d133245d8e8bcb0faf3532a9ef440d1687016c9f666c1f56479c7db003b0388e0a69bb2626f34c86046bc477edae

  • C:\Users\Admin\AppData\Local\Temp\D667.dll

    Filesize

    239KB

    MD5

    b281b2ff6c24a4d052ebb8c8bbb22ea6

    SHA1

    2860c3d79cd4f4d47152308efbee9ade924b699f

    SHA256

    e8a9c3be47df78b631e677041eecad534f8e0a61360d45edcbd9df811aaea92d

    SHA512

    ea4d3c3f4df8cf29e0c0fa483d5b998f11aae2204cb40db73f8afd523bf360ed1c5aed12dbf23f954d950f04372f6244e237512d194d384a20180a7a8e3cfcf4

  • C:\Users\Admin\AppData\Local\Temp\is-AKFG7.tmp\992D.tmp

    Filesize

    689KB

    MD5

    951ac648539bfaa0f113db5e0406de5b

    SHA1

    1b42de9ef8aaf1740de90871c5fc16963a842f43

    SHA256

    bb02f28cc67276b8d6609f80553c4976b2acbd34459af17167f8c1b001a84dfe

    SHA512

    795e654e82d38905841c3af120fb8288e3f81580a559d97266c739d101b335807b99c2592388b3b4af411f626e8d2f3966316152ca62b87a4361a8da78919b2d

  • C:\Users\Admin\AppData\Local\Temp\is-FP09J.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • C:\Users\Admin\AppData\Roaming\cusribh

    Filesize

    163KB

    MD5

    636c32103ef487d1c30df530296f014b

    SHA1

    f280007f3c78b0823d8978bec1c1cdf792bf5fc6

    SHA256

    c79f0b410c62adbad0d697c85f0f6cf786c61e1a1244090650440d8a09b90bbd

    SHA512

    2a01b0fb459a710c4d8ffb20fe2907bbb5ca091769cb8b3216d909208ee662f9c2f6f035fa1c8aeb9222ee7018c6da15615414b2556e02f0bbcc3bd05337f604

  • memory/400-27-0x0000000000860000-0x000000000110F000-memory.dmp

    Filesize

    8.7MB

  • memory/400-29-0x0000000001680000-0x0000000001681000-memory.dmp

    Filesize

    4KB

  • memory/400-30-0x0000000001680000-0x0000000001681000-memory.dmp

    Filesize

    4KB

  • memory/400-31-0x0000000001680000-0x0000000001681000-memory.dmp

    Filesize

    4KB

  • memory/400-32-0x0000000000860000-0x000000000110F000-memory.dmp

    Filesize

    8.7MB

  • memory/400-25-0x0000000001670000-0x0000000001671000-memory.dmp

    Filesize

    4KB

  • memory/1164-24-0x0000000000400000-0x00000000022D1000-memory.dmp

    Filesize

    30.8MB

  • memory/1164-16-0x0000000000400000-0x00000000022D1000-memory.dmp

    Filesize

    30.8MB

  • memory/1164-15-0x0000000002310000-0x0000000002410000-memory.dmp

    Filesize

    1024KB

  • memory/1692-5-0x0000000000400000-0x00000000022D1000-memory.dmp

    Filesize

    30.8MB

  • memory/1692-3-0x0000000000400000-0x00000000022D1000-memory.dmp

    Filesize

    30.8MB

  • memory/1692-2-0x0000000004020000-0x000000000402B000-memory.dmp

    Filesize

    44KB

  • memory/1692-1-0x0000000002360000-0x0000000002460000-memory.dmp

    Filesize

    1024KB

  • memory/1956-56-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/1956-62-0x0000000000D60000-0x0000000000D66000-memory.dmp

    Filesize

    24KB

  • memory/1956-84-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/1956-81-0x0000000002E70000-0x0000000002F7E000-memory.dmp

    Filesize

    1.1MB

  • memory/1956-54-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/1956-80-0x0000000002E70000-0x0000000002F7E000-memory.dmp

    Filesize

    1.1MB

  • memory/1956-57-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/1956-58-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/1956-59-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/1956-60-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/1956-78-0x0000000002E70000-0x0000000002F7E000-memory.dmp

    Filesize

    1.1MB

  • memory/1956-87-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/1956-65-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/1956-76-0x0000000002D40000-0x0000000002E69000-memory.dmp

    Filesize

    1.2MB

  • memory/1956-100-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2752-139-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

  • memory/2752-140-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

  • memory/2752-143-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

  • memory/2752-144-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

  • memory/3220-148-0x0000000000400000-0x0000000000720000-memory.dmp

    Filesize

    3.1MB

  • memory/3232-21-0x00000000023D0000-0x00000000023E6000-memory.dmp

    Filesize

    88KB

  • memory/3232-4-0x0000000002540000-0x0000000002556000-memory.dmp

    Filesize

    88KB

  • memory/3688-43-0x0000000002E80000-0x0000000002F8E000-memory.dmp

    Filesize

    1.1MB

  • memory/3688-42-0x0000000002E80000-0x0000000002F8E000-memory.dmp

    Filesize

    1.1MB

  • memory/3688-41-0x0000000002D50000-0x0000000002E79000-memory.dmp

    Filesize

    1.2MB

  • memory/3688-45-0x0000000002E80000-0x0000000002F8E000-memory.dmp

    Filesize

    1.1MB

  • memory/3688-37-0x0000000010000000-0x000000001020A000-memory.dmp

    Filesize

    2.0MB

  • memory/3688-46-0x0000000002E80000-0x0000000002F8E000-memory.dmp

    Filesize

    1.1MB

  • memory/3688-36-0x0000000001000000-0x0000000001006000-memory.dmp

    Filesize

    24KB

  • memory/3920-93-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4124-109-0x0000000002100000-0x0000000002101000-memory.dmp

    Filesize

    4KB

  • memory/4328-73-0x00000000049C0000-0x0000000004A2B000-memory.dmp

    Filesize

    428KB

  • memory/4328-72-0x0000000002F20000-0x0000000003020000-memory.dmp

    Filesize

    1024KB

  • memory/4328-88-0x0000000000400000-0x0000000002D8C000-memory.dmp

    Filesize

    41.5MB

  • memory/4328-75-0x0000000000400000-0x0000000002D8C000-memory.dmp

    Filesize

    41.5MB

  • memory/4328-146-0x0000000002F20000-0x0000000003020000-memory.dmp

    Filesize

    1024KB

  • memory/5108-53-0x0000000003B10000-0x0000000003CC7000-memory.dmp

    Filesize

    1.7MB

  • memory/5108-52-0x0000000003950000-0x0000000003B0E000-memory.dmp

    Filesize

    1.7MB