Analysis
-
max time kernel
140s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 00:01
Static task
static1
Behavioral task
behavioral1
Sample
DepthsRevivals.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DepthsRevivals.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
msimg32.dll
Resource
win7-20240221-en
General
-
Target
DepthsRevivals.exe
-
Size
6.1MB
-
MD5
4864a55cff27f686023456a22371e790
-
SHA1
6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
-
SHA256
08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
-
SHA512
4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
-
SSDEEP
98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
Malware Config
Extracted
lumma
https://wastwfulldashiwnjs.shop/api
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\ChromeData.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
DepthsRevivals.exepid process 828 DepthsRevivals.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
DepthsRevivals.execmd.exedescription pid process target process PID 828 wrote to memory of 4516 828 DepthsRevivals.exe DepthsRevivals.exe PID 828 wrote to memory of 4516 828 DepthsRevivals.exe DepthsRevivals.exe PID 828 wrote to memory of 4516 828 DepthsRevivals.exe DepthsRevivals.exe PID 828 wrote to memory of 4516 828 DepthsRevivals.exe DepthsRevivals.exe PID 828 wrote to memory of 4516 828 DepthsRevivals.exe DepthsRevivals.exe PID 828 wrote to memory of 4516 828 DepthsRevivals.exe DepthsRevivals.exe PID 828 wrote to memory of 2412 828 DepthsRevivals.exe cmd.exe PID 828 wrote to memory of 2412 828 DepthsRevivals.exe cmd.exe PID 828 wrote to memory of 2412 828 DepthsRevivals.exe cmd.exe PID 2412 wrote to memory of 1704 2412 cmd.exe reg.exe PID 2412 wrote to memory of 1704 2412 cmd.exe reg.exe PID 2412 wrote to memory of 1704 2412 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"2⤵PID:4516
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f3⤵
- Adds Run key to start application
PID:1704
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:4316