Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 01:01

General

  • Target

    0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117.exe

  • Size

    3.3MB

  • MD5

    031f0b4bce3ba22d9e46cbeec1b73360

  • SHA1

    4d6899fff97cff74a188c772aacfee3ea73731e6

  • SHA256

    0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117

  • SHA512

    f1bd60f3989d56f7775956347f03e8b69f36f4424ecf6bdbb818c9cc4ac4f4ac16e32a21ff3a096acc1ea69f9b98126d42b582e9556ecec2503042b12217279f

  • SSDEEP

    49152:B6Ee3j3piO4kHpKW4l4Gkdnx6KUnUa7ufJcbHpmqn8W42LQEKJWAOfraP:B6x3vZ4mGkz6KUr7ufJFiy60WAOfraP

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://sloganprogrevidefkso.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Detects executables packed with unregistered version of .NET Reactor 1 IoCs
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117.exe
    "C:\Users\Admin\AppData\Local\Temp\0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      2⤵
        PID:2472
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 1004
        2⤵
        • Program crash
        PID:2224
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 932 -ip 932
      1⤵
        PID:4848

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

        Filesize

        742KB

        MD5

        544cd51a596619b78e9b54b70088307d

        SHA1

        4769ddd2dbc1dc44b758964ed0bd231b85880b65

        SHA256

        dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

        SHA512

        f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

      • memory/932-12-0x0000000074E60000-0x0000000075610000-memory.dmp

        Filesize

        7.7MB

      • memory/932-1-0x00000000002C0000-0x0000000000606000-memory.dmp

        Filesize

        3.3MB

      • memory/932-13-0x0000000074E60000-0x0000000075610000-memory.dmp

        Filesize

        7.7MB

      • memory/932-4-0x0000000005240000-0x00000000053D2000-memory.dmp

        Filesize

        1.6MB

      • memory/932-14-0x0000000074E60000-0x0000000075610000-memory.dmp

        Filesize

        7.7MB

      • memory/932-10-0x0000000005750000-0x0000000005760000-memory.dmp

        Filesize

        64KB

      • memory/932-11-0x0000000074E60000-0x0000000075610000-memory.dmp

        Filesize

        7.7MB

      • memory/932-15-0x0000000074E60000-0x0000000075610000-memory.dmp

        Filesize

        7.7MB

      • memory/932-3-0x0000000074E60000-0x0000000075610000-memory.dmp

        Filesize

        7.7MB

      • memory/932-2-0x0000000004FD0000-0x000000000506C000-memory.dmp

        Filesize

        624KB

      • memory/932-0-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

        Filesize

        4KB

      • memory/932-23-0x0000000074E60000-0x0000000075610000-memory.dmp

        Filesize

        7.7MB

      • memory/932-22-0x0000000074E60000-0x0000000075610000-memory.dmp

        Filesize

        7.7MB

      • memory/932-20-0x0000000074E60000-0x0000000075610000-memory.dmp

        Filesize

        7.7MB

      • memory/2472-18-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2472-21-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

      • memory/2472-16-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB