Analysis
- max time kernel
145s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
22/05/2024, 22:26
Behavioral task
behavioral1
Sample
a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe
Resource
win7-20240419-en
windows7-x64
8 signatures
150 seconds
General
- Target a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe
- Size 1.2MB
- Sample240522-2ckbtabb9t
- SHA256 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985
- MD5 31ed5612c413997d16a134d6c58584ed
- SHA1 5171463c001dca2f5b27adc8c1e390e9896284e2
- SHA512 3b6b9facea4ff74f5b6696285d25037e62990db1b3fa2b2444a7306023e0e00048a2d853bec07ce5b01c97720bff54426e6fe8a16e094ff0b997e0b43515a59e
- SSDEEP 24576:siAb9TBgREUU9cEieHXV7yN0buhgYsbOlN9U3jaPsM:siAb99yEy0b2lNy3jKsM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Lumma Stealer payload V4 1 IoCs
resource yara_rule behavioral2/memory/3180-7-0x00000000000A0000-0x00000000001D1000-memory.dmp family_lumma_v4 - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 6 pastebin.com 7 pastebin.com - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3180 a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe"C:\Users\Admin\AppData\Local\Temp\a65b36ef70366ea11fd553af7ba234e5ff0b905f5c907ed937ed3e07f8ead985.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:3180