Overview

overview

10

Static

static

3

norecoil script.exe

windows10-1703-x64

10

Analysis

  • max time kernel
    130s
  • max time network
    138s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20-04-2024 17:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    norecoil script.exe

  • Size

    316KB

  • MD5

    8b730495ac0cdee27dbf2f7208138d3f

  • SHA1

    1c5b64c2b264ab43fab933177c451a9dcb7d2b43

  • SHA256

    c0a167af284867cf1d0ffa9162a945cd1feb5bd2857c95caa4cc5d8cfec26476

  • SHA512

    7ccff1526bf7cf197cb2da77bf39c041a88d49b04e050cbec0b0cdadee18a8ee4a7e56b09a35fa22e46de528fd8a9c566bba4b1c856b7ffb3a5e638430cc0cbf

  • SSDEEP

    6144:pxTruR4yVpzDhb1rvPUrzNeGy8/XRsLOM8yMXX7DmxvX:pxnu5zzrIzEUXmCM8yMX0

Score
10/10
lummastealer

Malware Config

Extracted

Family

lumma

C2

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://bordersoarmanusjuw.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\norecoil script.exe
    "C:\Users\Admin\AppData\Local\Temp\norecoil script.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:4648
    • C:\Windows\helppane.exe
      C:\Windows\helppane.exe -Embedding
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3044
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1640
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:4664
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      PID:2628
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4440
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:168

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF65D6566F9990E17F.TMP
      Filesize

      16KB

      MD5

      0e7f711f159de54f33d0229f6f701b22

      SHA1

      5f32ed702cbdbed3c119a9ef418a5cdad1e5cef8

      SHA256

      a9461208c67e9ba2ad8c296b4e6a3cb6335651377dea0b9df9fa7eae122119a3

      SHA512

      dc8047e3d45c656b7520cbf7a181e34d153bb9f88a47d595c1640ea85a48b86c94098731c23aee23eb298501bd58ccb74a002187333498a81a9058225d07fbd6

      Download Submit
    • memory/1640-71-0x000001E5D35E0000-0x000001E5D35E1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1640-75-0x000001E5D34F0000-0x000001E5D34F1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1640-13-0x000001E5D4420000-0x000001E5D4430000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1640-29-0x000001E5D4C00000-0x000001E5D4C10000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1640-48-0x000001E5D3590000-0x000001E5D3592000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1640-68-0x000001E5D4540000-0x000001E5D4542000-memory.dmp
      Filesize

      8KB

      Download
    • memory/3524-2-0x0000000073AC0000-0x00000000741AE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/3524-0-0x0000000000770000-0x00000000007C6000-memory.dmp
      Filesize

      344KB

      Download
    • memory/3524-9-0x0000000073AC0000-0x00000000741AE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/3524-10-0x0000000002A20000-0x0000000004A20000-memory.dmp
      Filesize

      32.0MB

      Download
    • memory/3524-12-0x0000000002A20000-0x0000000004A20000-memory.dmp
      Filesize

      32.0MB

      Download
    • memory/4648-8-0x0000000000400000-0x0000000000451000-memory.dmp
      Filesize

      324KB

      Download
    • memory/4648-11-0x0000000000400000-0x0000000000451000-memory.dmp
      Filesize

      324KB

      Download
    • memory/4648-4-0x0000000000400000-0x0000000000451000-memory.dmp
      Filesize

      324KB

      Download