Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 14:04

General

  • Target

    ErikGlorious_crypted_EASY.exe

  • Size

    394KB

  • MD5

    f758008b7884936d9b2a89d14c317b18

  • SHA1

    336c1e0d7ad5d58dbb4184710ed399af4494afde

  • SHA256

    341e941ba420f41c4d5887b2f5f19084bd0dc7addf3e3c694f79ebea2fcad370

  • SHA512

    133d8d0443f94efd806555c57607d88a0c419f508333f827dd856e1829f58c70efcd6a7df2421ca0fbff1a582feec820210e4dff757dacd24c91f01ba3b65a1e

  • SSDEEP

    12288:NF0ceA3g4vjEgKVpBfquOciBeGJr804EpkHeBOVOXRE0NxLFRHMA5X7UUghFx7X0:NJwojIVpxAci

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

https://roomabolishsnifftwk.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ErikGlorious_crypted_EASY.exe
    "C:\Users\Admin\AppData\Local\Temp\ErikGlorious_crypted_EASY.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      2⤵
        PID:2076
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3844
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde57aab58,0x7ffde57aab68,0x7ffde57aab78
        2⤵
          PID:1428
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:2
          2⤵
            PID:4656
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:8
            2⤵
              PID:1916
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:8
              2⤵
                PID:1504
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:1
                2⤵
                  PID:3496
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:1
                  2⤵
                    PID:4396
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:1
                    2⤵
                      PID:4944
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4116 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:8
                      2⤵
                        PID:3956
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4536 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:8
                        2⤵
                          PID:2076
                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                        1⤵
                          PID:2632

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          739B

                          MD5

                          1bb1a40d96a0978a0f103074742c3ed2

                          SHA1

                          5c6023a7e0bcd2399f2defe0f4b5bb770137e3d1

                          SHA256

                          1db0b44309d8a83fdb6026d7ddb35091d05c27976f26abaf9a10163d92b28c2d

                          SHA512

                          847944445ec0eadcb086a86831eccb6bfacc163d2d018924a67d198c10ec0503cfd18262d13f47b19fcbe50453a1a578d975011d484ea715e17c59a1b9009474

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          189B

                          MD5

                          4e1b7414153375e4272b71d6c9b643f8

                          SHA1

                          44a62edc68320b0246dbc93bc1fb2b9662a73a95

                          SHA256

                          42219a512e13879a2435094d4f069e209e7f8f2260ec2278d0f947533f30cb99

                          SHA512

                          b48ba99ab4a359bfedbddf37d6eb96429dc241ec77dc9e2a98ab05fc9a711351d7c36d507db41e5400a1f0bdee340f7c9caec83632e7bb409fad66931fc7059d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          77348866b1ddf2ce76bd33a21a13b691

                          SHA1

                          acbb8c2353949549c90ab6bfabd0eeced8e74006

                          SHA256

                          40e022b43b0a05f9358248b3cc2e0bc184b4c6b0df1e378b2299c30a74f84fb1

                          SHA512

                          03c244d6170ab6bf811e8c6139a847f280d074a503db583c127f6d572f0505d93cf5453aac354872c6e3f9041efc58cc1f5a9eab295380bf2085b3b8109da1ba

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          255KB

                          MD5

                          26ec48ba1499d43c78433f527e723d58

                          SHA1

                          f94257b71ab6a86b5c315e74893327bdd76febda

                          SHA256

                          6af29608ab825c46a8194a9e4e5eea46dfb1110dabc3ae10af1063d6e1908213

                          SHA512

                          50e91eb9569fb8279276344524e1249699631dd97e627530e5419f2a1f75bbc84a67696bcb808345fc0d89d5633d8d7b6e36d4e6509bf9c6d79879f070e902e8

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                        • C:\Users\Admin\AppData\Roaming\d3d9.dll

                          Filesize

                          403KB

                          MD5

                          be271ff6a2ef27c8e8206400281366a6

                          SHA1

                          c84ce338321d94eb53f2a73c8ef76702ddc1e0d1

                          SHA256

                          af8734ac99fc5e32ab090ee1a4003383ceb14c8c076879ce6933cda3389f73ee

                          SHA512

                          04d96e3b1f23aef43f5ea3e6637173a80e1db63b5de16346d3e9ae84b6e440810021d04c134b445cc3d0c59a78251986f9c9ec6e203e6395052442aa2cb3d44b

                        • \??\pipe\crashpad_3844_JUXOQNYMGRTVHNRK

                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                        • memory/2076-9-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                        • memory/2076-15-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                        • memory/2076-11-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                        • memory/3748-14-0x0000000075010000-0x00000000757C0000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/3748-13-0x0000000077AB1000-0x0000000077BD1000-memory.dmp

                          Filesize

                          1.1MB

                        • memory/3748-0-0x000000007501E000-0x000000007501F000-memory.dmp

                          Filesize

                          4KB

                        • memory/3748-2-0x00000000054F0000-0x00000000054F6000-memory.dmp

                          Filesize

                          24KB

                        • memory/3748-1-0x0000000000B60000-0x0000000000BCC000-memory.dmp

                          Filesize

                          432KB

                        • memory/3748-125-0x0000000075010000-0x00000000757C0000-memory.dmp

                          Filesize

                          7.7MB