Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/02/2024, 23:58
General
- Target 636c32103ef487d1c30df530296f014b.exe
- Size 163KB
- Sample240226-31jwmaca6w
- SHA256 c79f0b410c62adbad0d697c85f0f6cf786c61e1a1244090650440d8a09b90bbd
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
Extracted
-
lumma
-
https://resergvearyinitiani.shop/api
-
https://technologyenterdo.shop/api
-
https://detectordiscusser.shop/api
-
https://turkeyunlikelyofw.shop/api
-
https://associationokeo.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Deletes itself 1 IoCs
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 3 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 34 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\636c32103ef487d1c30df530296f014b.exe"C:\Users\Admin\AppData\Local\Temp\636c32103ef487d1c30df530296f014b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\cusribhC:\Users\Admin\AppData\Roaming\cusribh1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\A4A7.exeC:\Users\Admin\AppData\Local\Temp\A4A7.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\D667.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\D667.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\28ED.exeC:\Users\Admin\AppData\Local\Temp\28ED.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\28ED.exeC:\Users\Admin\AppData\Local\Temp\28ED.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\6589.exeC:\Users\Admin\AppData\Local\Temp\6589.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\992D.exeC:\Users\Admin\AppData\Local\Temp\992D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AKFG7.tmp\992D.tmp"C:\Users\Admin\AppData\Local\Temp\is-AKFG7.tmp\992D.tmp" /SL5="$B0218,2424585,54272,C:\Users\Admin\AppData\Local\Temp\992D.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe"C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe"C:\Users\Admin\AppData\Local\Media Builder\mmediabuilder.exe" -s3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
mmediabuilder.exe
mmediabuilder.exe
28ED.exe
6589.exe
992D.exe
A4A7.exe
A4A7.exe
D667.dll
D667.dll
992D.tmp
_iscrypt.dll
cusribh
memory/400-27-0x0000000000860000-0x000000000110F000-memory.dmp
memory/400-29-0x0000000001680000-0x0000000001681000-memory.dmp
memory/400-30-0x0000000001680000-0x0000000001681000-memory.dmp
memory/400-31-0x0000000001680000-0x0000000001681000-memory.dmp
memory/400-32-0x0000000000860000-0x000000000110F000-memory.dmp
memory/400-25-0x0000000001670000-0x0000000001671000-memory.dmp
memory/1164-24-0x0000000000400000-0x00000000022D1000-memory.dmp
memory/1164-16-0x0000000000400000-0x00000000022D1000-memory.dmp
memory/1164-15-0x0000000002310000-0x0000000002410000-memory.dmp
memory/1692-5-0x0000000000400000-0x00000000022D1000-memory.dmp
memory/1692-3-0x0000000000400000-0x00000000022D1000-memory.dmp
memory/1692-2-0x0000000004020000-0x000000000402B000-memory.dmp
memory/1692-1-0x0000000002360000-0x0000000002460000-memory.dmp
memory/1956-56-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1956-62-0x0000000000D60000-0x0000000000D66000-memory.dmp
memory/1956-84-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1956-81-0x0000000002E70000-0x0000000002F7E000-memory.dmp
memory/1956-54-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1956-80-0x0000000002E70000-0x0000000002F7E000-memory.dmp
memory/1956-57-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1956-58-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1956-59-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1956-60-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1956-78-0x0000000002E70000-0x0000000002F7E000-memory.dmp
memory/1956-87-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1956-65-0x0000000000400000-0x0000000000848000-memory.dmp
memory/1956-76-0x0000000002D40000-0x0000000002E69000-memory.dmp
memory/1956-100-0x0000000000400000-0x0000000000848000-memory.dmp
memory/2752-139-0x0000000000400000-0x0000000000720000-memory.dmp
memory/2752-140-0x0000000000400000-0x0000000000720000-memory.dmp
memory/2752-143-0x0000000000400000-0x0000000000720000-memory.dmp
memory/2752-144-0x0000000000400000-0x0000000000720000-memory.dmp
memory/3220-148-0x0000000000400000-0x0000000000720000-memory.dmp
memory/3232-21-0x00000000023D0000-0x00000000023E6000-memory.dmp
memory/3232-4-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3688-43-0x0000000002E80000-0x0000000002F8E000-memory.dmp
memory/3688-42-0x0000000002E80000-0x0000000002F8E000-memory.dmp
memory/3688-41-0x0000000002D50000-0x0000000002E79000-memory.dmp
memory/3688-45-0x0000000002E80000-0x0000000002F8E000-memory.dmp
memory/3688-37-0x0000000010000000-0x000000001020A000-memory.dmp
memory/3688-46-0x0000000002E80000-0x0000000002F8E000-memory.dmp
memory/3688-36-0x0000000001000000-0x0000000001006000-memory.dmp
memory/3920-93-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4124-109-0x0000000002100000-0x0000000002101000-memory.dmp
memory/4328-73-0x00000000049C0000-0x0000000004A2B000-memory.dmp
memory/4328-72-0x0000000002F20000-0x0000000003020000-memory.dmp
memory/4328-88-0x0000000000400000-0x0000000002D8C000-memory.dmp
memory/4328-75-0x0000000000400000-0x0000000002D8C000-memory.dmp
memory/4328-146-0x0000000002F20000-0x0000000003020000-memory.dmp
memory/5108-53-0x0000000003B10000-0x0000000003CC7000-memory.dmp
memory/5108-52-0x0000000003950000-0x0000000003B0E000-memory.dmp