Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 11:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
-
Target
Loader.exe
-
Size
655KB
-
MD5
c86746dcd3ebfe24188016d6e6606cc6
-
SHA1
2167f83e604b4376a58f092f90bb1bed0f2646c4
-
SHA256
dc72f32c48c6c86a90df2951dac21126fb1e04fecc1b889ba1233e15ed9f6bab
-
SHA512
e336fd963c877396b48eb1b06ea9f7eec96a647ea245e0f895191bd702e06d41abdfe1f899638804703fddd7870a000678bd934011d6e10e7d02ce9bc02f0648
-
SSDEEP
12288:ksP49VQbkeWL/+FjGaV2hCv954vStu7fHHqUUA7Se/o:3P4DUOL/+xBV28u2u7fqLA2eA
Malware Config
Extracted
Family
lumma
C2
https://associationokeo.shop/api
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1432 taskmgr.exe Token: SeSystemProfilePrivilege 1432 taskmgr.exe Token: SeCreateGlobalPrivilege 1432 taskmgr.exe Token: 33 1432 taskmgr.exe Token: SeIncBasePriorityPrivilege 1432 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵PID:1192
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1432