Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 00:10

General

  • Target

    DepthsRevivals.exe

  • Size

    6.1MB

  • MD5

    4864a55cff27f686023456a22371e790

  • SHA1

    6ed30c0371fe167d38411bfa6d720fcdcacc4f4c

  • SHA256

    08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2

  • SHA512

    4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb

  • SSDEEP

    98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz

Malware Config

Extracted

Family

lumma

C2

https://wastwfulldashiwnjs.shop/api

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

https://roomabolishsnifftwk.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe
    "C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe
      "C:\Users\Admin\AppData\Local\Temp\DepthsRevivals.exe"
      2⤵
        PID:1832
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f
          3⤵
          • Adds Run key to start application
          PID:3100

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1832-2-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/1832-6-0x0000000000A30000-0x0000000000A84000-memory.dmp

      Filesize

      336KB

    • memory/1832-5-0x0000000000A30000-0x0000000000A84000-memory.dmp

      Filesize

      336KB

    • memory/1832-8-0x0000000000A30000-0x0000000000A84000-memory.dmp

      Filesize

      336KB

    • memory/4792-1-0x00000000102E6000-0x0000000010300000-memory.dmp

      Filesize

      104KB

    • memory/4792-0-0x0000000010000000-0x0000000012DA5000-memory.dmp

      Filesize

      45.6MB

    • memory/4792-7-0x0000000010000000-0x0000000012DA5000-memory.dmp

      Filesize

      45.6MB

    • memory/4792-9-0x0000000012D78000-0x0000000012DA5000-memory.dmp

      Filesize

      180KB