Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/04/2024, 06:32
General
- Target !!@NeW_$etUp_2024_pAsSW0rds$_.exe
- Size 13.7MB
- Sample240403-ha5eesab6y
- SHA256 94ab177cc62af8c0fa1d2a0be6575db5bde69a52d126293e6a7fe5c01607597d
Malware Config
Extracted
-
lumma
-
https://marchsensedjurkey.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 12 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\!!@NeW_$etUp_2024_pAsSW0rds$_.exe"C:\Users\Admin\AppData\Local\Temp\!!@NeW_$etUp_2024_pAsSW0rds$_.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\SysWOW64\netsh.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -exec bypass C:\Users\Admin\AppData\Local\Temp\6BAKS2TLCG6017IN9M1O0X8.ps15⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /flushdns6⤵
- Gathers network information
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -c Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Set-MpPreference -DisableRealtimeMonitoring True; Set-MpPreference -MAPSReporting 0; Set-MpPreference -SubmitSamplesConsent 2; Set-MpPreference -DisableArchiveScanning True; Set-MpPreference -DisableBehaviorMonitoring True; Set-MpPreference -DisableBlockAtFirstSeen True; Set-MpPreference -DisableIntrusionPreventionSystem True; Set-MpPreference -DisableIOAVProtection True; Set-MpPreference -DisablePrivacyMode True; Set-MpPreference -DisableScriptScanning True; Set-MpPreference -DisableScanningNetworkFiles True; Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan True; exit6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 30366⤵
- Program crash
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4324 -ip 43241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
6BAKS2TLCG6017IN9M1O0X8.ps1
97b24d62
MSVCP140.dll
Qt5Core.dll
Qt5Gui.dll
Qt5Multimedia.dll
Qt5Network.dll
Qt5PrintSupport.dll
Qt5Widgets.dll
Qt5WinExtras.dll
Setup.exe
mommy.eps
vcruntime140.dll
vcruntime140_1.dll
__PSScriptPolicyTest_34st04xd.fyd.ps1
memory/1532-56-0x00007FF7C8150000-0x00007FF7C89D4000-memory.dmp
memory/1532-72-0x00007FFEF4BD0000-0x00007FFEF4BE9000-memory.dmp
memory/1532-73-0x00007FFEF4BD0000-0x00007FFEF4BE9000-memory.dmp
memory/1532-59-0x00007FFEF4BD0000-0x00007FFEF4BE9000-memory.dmp
memory/1532-60-0x00007FF7C8150000-0x00007FF7C89D4000-memory.dmp
memory/1532-57-0x00007FFEE5BA0000-0x00007FFEE60EE000-memory.dmp
memory/3688-132-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-119-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-83-0x00007FFF04590000-0x00007FFF04785000-memory.dmp
memory/3688-84-0x0000000000F00000-0x0000000000F4D000-memory.dmp
memory/3688-88-0x0000000000F00000-0x0000000000F4D000-memory.dmp
memory/3688-89-0x0000000000450000-0x0000000000883000-memory.dmp
memory/3688-90-0x00000000014A0000-0x00000000014A1000-memory.dmp
memory/3688-91-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-93-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-92-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-94-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-95-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-97-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-96-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-98-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-99-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-100-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-101-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-102-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-103-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-104-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-105-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-106-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-107-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-108-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-109-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-110-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-111-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-112-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-113-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-114-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-115-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-116-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-117-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-118-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-213-0x0000000000F00000-0x0000000000F4D000-memory.dmp
memory/3688-120-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-121-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-124-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-126-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-130-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-131-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-129-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-134-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-133-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-150-0x0000000003A70000-0x0000000003A72000-memory.dmp
memory/3688-128-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-127-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-125-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-123-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-122-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-135-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-136-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-137-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-138-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-139-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-140-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-141-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-142-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-143-0x0000000003970000-0x0000000003A70000-memory.dmp
memory/3688-144-0x0000000003A70000-0x0000000003A72000-memory.dmp
memory/3688-145-0x0000000003A70000-0x0000000003A72000-memory.dmp
memory/3688-146-0x0000000003A70000-0x0000000003A72000-memory.dmp
memory/3688-148-0x0000000003A70000-0x0000000003A72000-memory.dmp
memory/3688-147-0x0000000003A70000-0x0000000003A72000-memory.dmp
memory/5108-79-0x0000000074AA0000-0x0000000074AB2000-memory.dmp
memory/5108-78-0x0000000074AA0000-0x0000000074AB2000-memory.dmp
memory/5108-80-0x0000000074AA0000-0x0000000074AB2000-memory.dmp
memory/5108-77-0x00007FFF04590000-0x00007FFF04785000-memory.dmp