Analysis

  • max time kernel
    294s
  • max time network
    274s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-02-2024 20:12

General

  • Target

    PALWORLD_TRAINER.zip

  • Size

    790KB

  • MD5

    b90e4f81025d6e293646bd9a83f7b7da

  • SHA1

    f11f714c560359fce39dd601e3937190595a0c7a

  • SHA256

    61112986a4aa1f2db3e9de8600d239864fcb9987376f7109f45ae1330db3dc8e

  • SHA512

    459e9b7f2777ed24654336980ade70c328ca2daaad3d40445926413e0d509943684c40c533066d443f9e49e0ea248d517ce2d5e14d03a90e7ce1610b544311f2

  • SSDEEP

    24576:XAjoq5M7qtwDyeg2MWZifOQxl9X7eTSYiZil:XSob1HbiB9XvYiZu

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\PALWORLD_TRAINER.zip
    1⤵
      PID:1544
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2440
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\PALWORLD_TRAINER\" -spe -an -ai#7zMap7206:90:7zEvent1499
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3428
      • C:\Users\Admin\Desktop\PALWORLD_TRAINER\PALWORLD TRAINER\spoofer.exe
        "C:\Users\Admin\Desktop\PALWORLD_TRAINER\PALWORLD TRAINER\spoofer.exe"
        1⤵
        • Executes dropped EXE
        PID:3600
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4476

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Desktop\PALWORLD_TRAINER\PALWORLD TRAINER\spoofer.exe

        Filesize

        425KB

        MD5

        168d7b4ca5c63b61d5f48f0911868b2c

        SHA1

        daf966bd0ac55c862ce5574ee7d5420123ac94e4

        SHA256

        601c05bd2d1c908d123dac33d1c15552c138acb294124cbdd86b12c9f35e2655

        SHA512

        da5ebb40849fedafc5a3ac7c48a0142c6eb5ccefe788b6c07491a757aa9e9b4f3d8b76e1dacf0600a833aade05c309b9661e8fd40080d4ba8f4cf4ea3d59900f

      • memory/3600-7-0x0000000002D00000-0x0000000002D49000-memory.dmp

        Filesize

        292KB

      • memory/3600-14-0x00000000011E0000-0x00000000011E1000-memory.dmp

        Filesize

        4KB

      • memory/3600-13-0x00000000011E0000-0x00000000011E1000-memory.dmp

        Filesize

        4KB

      • memory/3600-12-0x00000000011E0000-0x00000000011E1000-memory.dmp

        Filesize

        4KB

      • memory/3600-15-0x0000000002D00000-0x0000000002D49000-memory.dmp

        Filesize

        292KB

      • memory/4476-16-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB

      • memory/4476-17-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB

      • memory/4476-18-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB

      • memory/4476-22-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB

      • memory/4476-25-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB

      • memory/4476-24-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB

      • memory/4476-23-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB

      • memory/4476-26-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB

      • memory/4476-27-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB

      • memory/4476-28-0x00000294E0800000-0x00000294E0801000-memory.dmp

        Filesize

        4KB