Analysis

  • max time kernel
    124s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 06:56

General

  • Target

    lSetup.exe

  • Size

    202KB

  • MD5

    64179e64675e822559cac6652298bdfc

  • SHA1

    cceed3b2441146762512918af7bf7f89fb055583

  • SHA256

    c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9

  • SHA512

    ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280

  • SSDEEP

    3072:EMtKztOp6KfOQqoY3ltdNjlcwsSdplkrxf+Uyecgw:ELKfOQLY3l9jlcwnlUf+z7gw

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://qualifiedbehaviorrykej.site/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Blocklisted process makes network request 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\lSetup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4348
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      PID:952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 1188
        3⤵
        • Program crash
        PID:856
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 952 -ip 952
    1⤵
      PID:3800

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\8c17e83d

      Filesize

      1.2MB

      MD5

      b00f8ca79f974c0e92558e637bffcd0d

      SHA1

      e4591697f842b6b6200dcefa6eeaeeedab672236

      SHA256

      b475aa4713df9f63a4f7c8298bec00900ec072865d53760dde9168c0486b3067

      SHA512

      b90df2453e454cc5bae8d40b6fc226b6eae0cddbfb3e3534e4ec368dea7abac7ec48743accccc7222411e13da19a84058f62587c3672ad522ed1179e320a9a7d

    • memory/952-13-0x0000000074A90000-0x0000000074C0B000-memory.dmp

      Filesize

      1.5MB

    • memory/952-15-0x00007FFB1C310000-0x00007FFB1C505000-memory.dmp

      Filesize

      2.0MB

    • memory/952-16-0x0000000073530000-0x0000000074784000-memory.dmp

      Filesize

      18.3MB

    • memory/952-20-0x0000000074A90000-0x0000000074C0B000-memory.dmp

      Filesize

      1.5MB

    • memory/952-21-0x0000000073530000-0x0000000074784000-memory.dmp

      Filesize

      18.3MB

    • memory/4348-0-0x0000000074A90000-0x0000000074C0B000-memory.dmp

      Filesize

      1.5MB

    • memory/4348-1-0x00007FFB1C310000-0x00007FFB1C505000-memory.dmp

      Filesize

      2.0MB

    • memory/4348-10-0x0000000074A90000-0x0000000074C0B000-memory.dmp

      Filesize

      1.5MB

    • memory/4348-11-0x0000000074A90000-0x0000000074C0B000-memory.dmp

      Filesize

      1.5MB