Overview
overview
10Static
static
3Setup.exe
windows7-x64
1Setup.exe
windows10-2004-x64
10python310.dll
windows7-x64
1python310.dll
windows10-2004-x64
1vcruntime140.dll
windows7-x64
1vcruntime140.dll
windows10-2004-x64
1x64/AzureK...ib.dll
windows7-x64
1x64/AzureK...ib.dll
windows10-2004-x64
1x64/BugReporter.exe
windows7-x64
1x64/BugReporter.exe
windows10-2004-x64
1x64/ComExtractor.exe
windows7-x64
1x64/ComExtractor.exe
windows10-2004-x64
1x64/HDHelp...1].exe
windows7-x64
1x64/HDHelp...1].exe
windows10-2004-x64
1x64/Micros...st.dll
windows7-x64
1x64/Micros...st.dll
windows10-2004-x64
1x64/Micros...ml.dll
windows7-x64
1x64/Micros...ml.dll
windows10-2004-x64
1x64/NvSter...1].exe
windows7-x64
1x64/NvSter...1].exe
windows10-2004-x64
3x64/VSLaun...1].exe
windows7-x64
1x64/VSLaun...1].exe
windows10-2004-x64
1x64/WinUiB...er.dll
windows7-x64
1x64/WinUiB...er.dll
windows10-2004-x64
1x64/api-ms...-0.dll
windows10-2004-x64
1x64/api-ms...-0.dll
windows10-2004-x64
1x64/api-ms...-0.dll
windows10-2004-x64
1x64/api-ms...-0.dll
windows10-2004-x64
1x64/api-ms...-0.dll
windows10-2004-x64
1x64/api-ms...-0.dll
windows10-2004-x64
1x64/api-ms...-0.dll
windows10-2004-x64
1x64/api-ms...-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 16:13
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
python310.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
python310.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
vcruntime140.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
vcruntime140.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
x64/AzureKeyVaultDgssLib.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
x64/AzureKeyVaultDgssLib.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
x64/BugReporter.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
x64/BugReporter.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
x64/ComExtractor.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
x64/ComExtractor.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
x64/HDHelper_[0MB]_[1].exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
x64/HDHelper_[0MB]_[1].exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
x64/Microsoft.Toolkit.Win32.UI.XamlHost.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
x64/Microsoft.Toolkit.Win32.UI.XamlHost.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
x64/Microsoft.UI.Xaml.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
x64/Microsoft.UI.Xaml.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
x64/NvStereoUtilityOGL_[1MB]_[1].exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
x64/NvStereoUtilityOGL_[1MB]_[1].exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
x64/VSLauncher_[0MB]_[1].exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
x64/VSLauncher_[0MB]_[1].exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
x64/WinUiBootstrapper.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
x64/WinUiBootstrapper.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
x64/api-ms-win-core-console-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
x64/api-ms-win-core-console-l1-2-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
x64/api-ms-win-core-datetime-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
x64/api-ms-win-core-debug-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
x64/api-ms-win-core-errorhandling-l1-1-0.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral30
Sample
x64/api-ms-win-core-fibers-l1-1-0.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
x64/api-ms-win-core-file-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
x64/api-ms-win-core-file-l1-2-0.dll
Resource
win10v2004-20240426-en
General
-
Target
Setup.exe
-
Size
94KB
-
MD5
9a4cc0d8e7007f7ef20ca585324e0739
-
SHA1
f3e5a2e477cac4bab85940a2158eed78f2d74441
-
SHA256
040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92
-
SHA512
54636a48141804112f5b4f2fc70cb7c959a041e5743aeedb5184091b51daa1d1a03f0016e8299c0d56d924c6c8ae585e4fc864021081ffdf1e6f3eab11dd43b3
-
SSDEEP
1536:9M/AhIxHHWMpdPa5wiE21M8kJIGFvb1Cwn/ZDs5yf:9M4SwMpdCq/IM8uIGfV/ZDso
Malware Config
Extracted
lumma
https://evokeoutlooklits.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 1096 set thread context of 748 1096 Setup.exe comp.exe -
Loads dropped DLL 1 IoCs
Processes:
Autha.au3pid process 3848 Autha.au3 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.execomp.exepid process 1096 Setup.exe 1096 Setup.exe 748 comp.exe 748 comp.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.execomp.exepid process 1096 Setup.exe 748 comp.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Setup.execomp.exedescription pid process target process PID 1096 wrote to memory of 748 1096 Setup.exe comp.exe PID 1096 wrote to memory of 748 1096 Setup.exe comp.exe PID 1096 wrote to memory of 748 1096 Setup.exe comp.exe PID 1096 wrote to memory of 748 1096 Setup.exe comp.exe PID 748 wrote to memory of 3848 748 comp.exe Autha.au3 PID 748 wrote to memory of 3848 748 comp.exe Autha.au3 PID 748 wrote to memory of 3848 748 comp.exe Autha.au3 PID 748 wrote to memory of 3848 748 comp.exe Autha.au3 PID 748 wrote to memory of 3848 748 comp.exe Autha.au3
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\comp.exeC:\Windows\SysWOW64\comp.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Autha.au3C:\Users\Admin\AppData\Local\Temp\Autha.au33⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Autha.au3Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\b0f17e5eFilesize
1.8MB
MD5da5cf14c4c31c3958d9ecf3851c69c3c
SHA1fb2e98085c03c38883bc10f4f07b2716fd3dc656
SHA256ce68edb0f0a181015c2a0072db218c9dbf875717a5330a1e518dd003335103af
SHA5125ff6294a1b602408c8e76d6974ae1870de57d43d477d3f284f9e2d3c309c4f58e3e0969f0d882640a8c13fa393058b6bfd8f5aa5c2173b602c43e24cbb031fe5
-
memory/748-19-0x0000000075AD0000-0x0000000075C4B000-memory.dmpFilesize
1.5MB
-
memory/748-10-0x00007FFB99AB0000-0x00007FFB99CA5000-memory.dmpFilesize
2.0MB
-
memory/748-12-0x0000000075AD0000-0x0000000075C4B000-memory.dmpFilesize
1.5MB
-
memory/748-13-0x0000000075ADE000-0x0000000075AE0000-memory.dmpFilesize
8KB
-
memory/748-14-0x0000000075AD0000-0x0000000075C4B000-memory.dmpFilesize
1.5MB
-
memory/748-26-0x0000000075ADE000-0x0000000075AE0000-memory.dmpFilesize
8KB
-
memory/1096-7-0x00007FFB7BB60000-0x00007FFB7BCD2000-memory.dmpFilesize
1.4MB
-
memory/1096-6-0x00007FFB7BB60000-0x00007FFB7BCD2000-memory.dmpFilesize
1.4MB
-
memory/1096-0-0x00007FFB7BB60000-0x00007FFB7BCD2000-memory.dmpFilesize
1.4MB
-
memory/1096-5-0x00007FFB7BB78000-0x00007FFB7BB79000-memory.dmpFilesize
4KB
-
memory/3848-21-0x0000000000D50000-0x0000000000DA5000-memory.dmpFilesize
340KB
-
memory/3848-22-0x00007FFB99AB0000-0x00007FFB99CA5000-memory.dmpFilesize
2.0MB
-
memory/3848-24-0x0000000000D50000-0x0000000000DA5000-memory.dmpFilesize
340KB