Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 13:32
Static task
static1
Behavioral task
behavioral1
Sample
74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe
Resource
win11-20240426-en
General
-
Target
74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe
-
Size
460KB
-
MD5
c49297876753f4cd93461e26db8b586e
-
SHA1
ca9e6c59d61709585867a41de09429542c380a36
-
SHA256
74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b
-
SHA512
8cdb0953e129b0bb74d946d304ad9b21c0365b85b0db378ba568057c30234ec1ce0e18cc26d25fc70180680928051ba2b6829768bdd714286fcb1d359d0f00d3
-
SSDEEP
12288:zTUgQwrx/PEWHuPYwakIS/GsTrnLXGil1erhFn:/UgnV6gYISe0rnyibgjn
Malware Config
Extracted
lumma
https://civilianurinedtsraov.shop/api
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://roomabolishsnifftwk.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exedescription pid Process procid_target PID 380 set thread context of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85 -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exedescription pid Process procid_target PID 380 wrote to memory of 4436 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 83 PID 380 wrote to memory of 4436 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 83 PID 380 wrote to memory of 4436 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 83 PID 380 wrote to memory of 3836 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 84 PID 380 wrote to memory of 3836 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 84 PID 380 wrote to memory of 3836 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 84 PID 380 wrote to memory of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85 PID 380 wrote to memory of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85 PID 380 wrote to memory of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85 PID 380 wrote to memory of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85 PID 380 wrote to memory of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85 PID 380 wrote to memory of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85 PID 380 wrote to memory of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85 PID 380 wrote to memory of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85 PID 380 wrote to memory of 3880 380 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe"C:\Users\Admin\AppData\Local\Temp\74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4436
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3836
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3880
-