Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 06:17
Static task
static1
Behavioral task
behavioral1
Sample
7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe
Resource
win7-20240220-en
General
-
Target
7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe
-
Size
1.7MB
-
MD5
20cc0758e201225b9ce53aa91b13f8ac
-
SHA1
ac02cac0e558c5a151902fa86d2ae4eaca684390
-
SHA256
7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5
-
SHA512
cc55c7fdafbbd0df8a841a1eafec2f17232fd7018345eef58dddef5bfc8de08d2bcc9f918d96c037781953500327de3bb686df1d8881d693b9e196c7b61b98cc
-
SSDEEP
49152:QIiwiZqt7ZeI8T3brWl24+wF7bS8KEH8UW3NT6:Q9PQt7ZFeA9+pN6
Malware Config
Extracted
lumma
https://tolerateilusidjukl.shop/api
https://productivelookewr.shop/api
https://shatterbreathepsw.shop/api
https://shortsvelventysjo.shop/api
https://incredibleextedwj.shop/api
https://alcojoldwograpciw.shop/api
https://liabilitynighstjsko.shop/api
https://demonstationfukewko.shop/api
Signatures
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exepid process 3880 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exedescription pid process target process PID 3880 wrote to memory of 3884 3880 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe PID 3880 wrote to memory of 3884 3880 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe PID 3880 wrote to memory of 3884 3880 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe PID 3880 wrote to memory of 3884 3880 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe PID 3880 wrote to memory of 3884 3880 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe PID 3880 wrote to memory of 3884 3880 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe 7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe"C:\Users\Admin\AppData\Local\Temp\7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe"C:\Users\Admin\AppData\Local\Temp\7a07116fe66c2288abd5511f09b30da56b11a2fff49bc9c2efe793b6b8342ff5.exe"2⤵PID:3884
-