Analysis

  • max time kernel
    138s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26-02-2024 23:57

General

  • Target

    a7b122b234de26887fae66072351a137.exe

  • Size

    230KB

  • MD5

    a7b122b234de26887fae66072351a137

  • SHA1

    26cd1b664332037f040183cfc6275da0ef24848f

  • SHA256

    4588cf14ad219264d9a1e100ab9590f64d48bb16a29bdb59d292d1af25ee2f64

  • SHA512

    dd2a3c73812ce6e405edd6d7262d517d799105693d2504aff40a8b85a46a4cd786e30ea526eac58586bfd54b97154c35785709e1f622ae897357c4f07313f10b

  • SSDEEP

    6144:azquP7bLg28emgyv/3K6436viwONzcuJhoG2:azq87bLg21mnfCzNGG2

Score
10/10

Malware Config

Signatures

  • Detect Lumma Stealer payload V4 1 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Modifies security service 2 TTPs 22 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 20 IoCs
  • Drops file in System32 directory 22 IoCs
  • Runs .reg file with regedit 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a7b122b234de26887fae66072351a137.exe
    "C:\Users\Admin\AppData\Local\Temp\a7b122b234de26887fae66072351a137.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\SysWOW64\regedit.exe
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        3⤵
        • Modifies security service
        • Runs .reg file with regedit
        PID:2684
    • C:\Windows\SysWOW64\Windows-Time.exe
      C:\Windows\system32\Windows-Time.exe 512 "C:\Users\Admin\AppData\Local\Temp\a7b122b234de26887fae66072351a137.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c c:\a.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Windows\SysWOW64\regedit.exe
          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
          4⤵
          • Modifies security service
          • Runs .reg file with regedit
          PID:2628
      • C:\Windows\SysWOW64\Windows-Time.exe
        C:\Windows\system32\Windows-Time.exe 528 "C:\Windows\SysWOW64\Windows-Time.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c c:\a.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:956
          • C:\Windows\SysWOW64\regedit.exe
            REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
            5⤵
            • Modifies security service
            • Runs .reg file with regedit
            PID:1772
        • C:\Windows\SysWOW64\Windows-Time.exe
          C:\Windows\system32\Windows-Time.exe 540 "C:\Windows\SysWOW64\Windows-Time.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of WriteProcessMemory
          PID:2560
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c c:\a.bat
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2656
            • C:\Windows\SysWOW64\regedit.exe
              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
              6⤵
              • Modifies security service
              • Runs .reg file with regedit
              PID:1960
          • C:\Windows\SysWOW64\Windows-Time.exe
            C:\Windows\system32\Windows-Time.exe 532 "C:\Windows\SysWOW64\Windows-Time.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:584
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c c:\a.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2188
              • C:\Windows\SysWOW64\regedit.exe
                REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                7⤵
                • Modifies security service
                • Runs .reg file with regedit
                PID:2324
            • C:\Windows\SysWOW64\Windows-Time.exe
              C:\Windows\system32\Windows-Time.exe 556 "C:\Windows\SysWOW64\Windows-Time.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:3016
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c c:\a.bat
                7⤵
                  PID:900
                  • C:\Windows\SysWOW64\regedit.exe
                    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                    8⤵
                    • Modifies security service
                    • Runs .reg file with regedit
                    PID:2644
                • C:\Windows\SysWOW64\Windows-Time.exe
                  C:\Windows\system32\Windows-Time.exe 548 "C:\Windows\SysWOW64\Windows-Time.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  PID:2600
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c c:\a.bat
                    8⤵
                      PID:2496
                      • C:\Windows\SysWOW64\regedit.exe
                        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                        9⤵
                        • Modifies security service
                        • Runs .reg file with regedit
                        PID:2920
                    • C:\Windows\SysWOW64\Windows-Time.exe
                      C:\Windows\system32\Windows-Time.exe 552 "C:\Windows\SysWOW64\Windows-Time.exe"
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      PID:3048
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c c:\a.bat
                        9⤵
                          PID:2380
                          • C:\Windows\SysWOW64\regedit.exe
                            REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                            10⤵
                            • Modifies security service
                            • Runs .reg file with regedit
                            PID:784
                        • C:\Windows\SysWOW64\Windows-Time.exe
                          C:\Windows\system32\Windows-Time.exe 560 "C:\Windows\SysWOW64\Windows-Time.exe"
                          9⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in System32 directory
                          PID:2008
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c c:\a.bat
                            10⤵
                              PID:1848
                              • C:\Windows\SysWOW64\regedit.exe
                                REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                11⤵
                                • Modifies security service
                                • Runs .reg file with regedit
                                PID:2412
                            • C:\Windows\SysWOW64\Windows-Time.exe
                              C:\Windows\system32\Windows-Time.exe 564 "C:\Windows\SysWOW64\Windows-Time.exe"
                              10⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops file in System32 directory
                              PID:2776
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c c:\a.bat
                                11⤵
                                  PID:848
                                  • C:\Windows\SysWOW64\regedit.exe
                                    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                    12⤵
                                    • Modifies security service
                                    • Runs .reg file with regedit
                                    PID:2248
                                • C:\Windows\SysWOW64\Windows-Time.exe
                                  C:\Windows\system32\Windows-Time.exe 568 "C:\Windows\SysWOW64\Windows-Time.exe"
                                  11⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  PID:2740
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c c:\a.bat
                                    12⤵
                                      PID:1904
                                      • C:\Windows\SysWOW64\regedit.exe
                                        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                        13⤵
                                        • Modifies security service
                                        • Runs .reg file with regedit
                                        PID:2412

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\1.reg

                Filesize

                3KB

                MD5

                cd085b8c40e69c2bf1eb3d59f8155b99

                SHA1

                3499260f24020fe6d54d9d632d34ba2770bb06e0

                SHA256

                10546433db0c1ab764cd632eb0d08d93a530c6e52d1ec7fcb9c1fd32193f2a9c

                SHA512

                3813b8a7f742f6a64da36492447f3f2fee6ea505d7d0dccebede84117ec06101321dfacc7901403ea557171085982ae1a4dc39dd666da9e67d61ea71dfbb8edb

              • C:\Users\Admin\AppData\Local\Temp\1.reg

                Filesize

                978B

                MD5

                2e2266221550edce9a27c9060d5c2361

                SHA1

                f39f2d8f02f8b3a877d5969a81c4cb12679609f3

                SHA256

                e19af90814641d2c6cd15a7a53d676a4a7f63b4a80a14126824d1e63fdccdcdb

                SHA512

                e962cc55d1f9537159c34349a2fa5ffffc910de3e52cafa8347c43eded78b8e986ecb8e2e9ada5e2381b034151f17e6b984c279460e8e114e50ea58a64648864

              • C:\Users\Admin\AppData\Local\Temp\1.reg

                Filesize

                2KB

                MD5

                d5e129352c8dd0032b51f34a2bbecad3

                SHA1

                a50f8887ad4f6a1eb2dd3c5b807c95a923964a6a

                SHA256

                ebdaad14508e5ba8d9e794963cf35bd51b7a92b949ebf32deef254ab9cdd6267

                SHA512

                9a3aa2796657c964f3c3ff07c8891533a740c86e8b0bebb449b5a3e07e1248d0f6608e03d9847caf1c8bff70392d15474f2954349869d92658108515df6831c2

              • C:\Users\Admin\AppData\Local\Temp\1.reg

                Filesize

                2KB

                MD5

                8a36f3bf3750851d8732b132fa330bb4

                SHA1

                1cb36be31f3d7d9439aac14af3d7a27f05a980eb

                SHA256

                5d88aebc1d13a61609ef057cb38dc9d7b0a04a47a7670a7591f40d1ea05b6ad9

                SHA512

                a822885389f3b12baed60b565646bed97aea1740e163e236ca3647fb63a9c15f6e21bc5ff92eb2d47bb6b1268c71ffb8e5e84006f3c04377d9d3a7c16434e646

              • C:\Users\Admin\AppData\Local\Temp\1.reg

                Filesize

                3KB

                MD5

                9e5db93bd3302c217b15561d8f1e299d

                SHA1

                95a5579b336d16213909beda75589fd0a2091f30

                SHA256

                f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

                SHA512

                b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

              • C:\Users\Admin\AppData\Local\Temp\1.reg

                Filesize

                1KB

                MD5

                e2d37af73d5fe4a504db3f8c0d560e3d

                SHA1

                88c6bf5b485dd9c79283ccb5d2546ffbb95e563d

                SHA256

                e615959931f345e611ac44be7534d697c1495c641d13e50ae919a7807c8ff008

                SHA512

                8cb17131326361071a3ae2997cdfaa316ce10c481f48af23fa526380daffa39b2538251cbaa4cf3bd9a9c0014a9184be5a13a44cf45fb93591ba3180670ddb89

              • C:\Users\Admin\AppData\Local\Temp\1.reg

                Filesize

                1KB

                MD5

                8a84d46ef81c793a90a80bc806cffdcf

                SHA1

                02fac9db9330040ffc613a325686ddca2678a7c5

                SHA256

                201891985252489d470c08e66c42a4cf5f9220be3051b9a167936c8f80a606c4

                SHA512

                b198b32fd9be872968644641248d4e3794aa095f446bab4e1c5a54b2c109df166bbdfb54d4fd8912d202f92ac69b1685ed0c30256e40f30d72e433ee987cc374

              • C:\a.bat

                Filesize

                5KB

                MD5

                0019a0451cc6b9659762c3e274bc04fb

                SHA1

                5259e256cc0908f2846e532161b989f1295f479b

                SHA256

                ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

                SHA512

                314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

              • \Windows\SysWOW64\Windows-Time.exe

                Filesize

                230KB

                MD5

                a7b122b234de26887fae66072351a137

                SHA1

                26cd1b664332037f040183cfc6275da0ef24848f

                SHA256

                4588cf14ad219264d9a1e100ab9590f64d48bb16a29bdb59d292d1af25ee2f64

                SHA512

                dd2a3c73812ce6e405edd6d7262d517d799105693d2504aff40a8b85a46a4cd786e30ea526eac58586bfd54b97154c35785709e1f622ae897357c4f07313f10b