Analysis
- max time kernel
114s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
27/02/2024, 16:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BlоxFruit.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
General
- Target BlоxFruit.exe
- Size 60.0MB
- Sample240227-tg1wcsdf4s
- SHA256 dc0ed55c15a3f289fff28c858d613d2a25153eb6a79a0dbeea0f7feb6c1b9a46
- MD5 176ea575f60d1152fd8ca3848e201c60
- SHA1 307cf19bf9b5cd6c4721f339baf7d34b9b9f53d9
- SHA512 fc0177a5c4a40f4e6555ece0f4ed399dce2595bf353622b17ea88b00d596e1c7044a1e2e6da2f9acbb26a7b14f7a223bca35a385eb339cc297a1a8081208a31a
- SSDEEP 393216:LolUwIZZQkvsMjh/kwp022I6sY9P7lfhYa2o:LolUwIrOYdk3+ixJYa
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
lumma
C2
-
https://sermonundressolcow.shop/api
-
https://technologyenterdo.shop/api
-
https://detectordiscusser.shop/api
-
https://turkeyunlikelyofw.shop/api
-
https://associationokeo.shop/api
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4892 set thread context of 728 4892 BlоxFruit.exe 93 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4892 BlоxFruit.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2836 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2836 taskmgr.exe Token: SeSystemProfilePrivilege 2836 taskmgr.exe Token: SeCreateGlobalPrivilege 2836 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe 2836 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2836 taskmgr.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4892 wrote to memory of 728 4892 BlоxFruit.exe 93 PID 4892 wrote to memory of 728 4892 BlоxFruit.exe 93 PID 4892 wrote to memory of 728 4892 BlоxFruit.exe 93 PID 4892 wrote to memory of 728 4892 BlоxFruit.exe 93 PID 4892 wrote to memory of 728 4892 BlоxFruit.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlоxFruit.exe"C:\Users\Admin\AppData\Local\Temp\BlоxFruit.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵PID:728
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2836
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4568