Resubmissions
Analysis
-
max time kernel
79s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
05-06-2024 00:19
General
-
Target
Setup.exe
-
Size
15.1MB
-
MD5
679e3f0e646a1a26b3264d08f398b228
-
SHA1
feedf0799a22cdfb393960a2b8edc06b35019664
-
SHA256
3e79d4e30a37e43e13033008ca5bfe51b54e12d24c8dbba76da259d26789b9f1
-
SHA512
46038281c1c73ba9a0265db68a4be35fee3fb640d95c04407424a9cd7bc97013ca5b40ae546f7e25dc77c9d047ee9d4fea98d54e1c7a44977f204623543af99f
-
SSDEEP
393216:A8+b3itt/k6pMm/aGib3gQuq6C2CT9U3TC6dRR8H0ZH3P:qS9CmqzTGunIH3P
Malware Config
Extracted
lumma
https://fomremywellmadderw.shop/api
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 9 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 47 IoCs
-
NTFS ADS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 55 IoCs
-
Suspicious use of SendNotifyMessage 53 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-31P4J.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-31P4J.tmp\Setup.tmp" /SL5="$4021C,11439742,799232,C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe" /VERYSILENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FML4K.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-FML4K.tmp\Setup.tmp" /SL5="$50212,11439742,799232,C:\Users\Admin\AppData\Local\Temp\Setup.exe" /VERYSILENT4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\UnRAR.exe"C:\Users\Admin\AppData\Local\\Managebg_QEE_v3\\CurrentVersion\\bin\\\UnRAR.exe" x -p2024 -o+ "C:\Users\Admin\AppData\Local\\Managebg_QEE_v3\\CurrentVersion\\bin\\\jhgfdsa.rar" "C:\Users\Admin\AppData\Local\\Managebg_QEE_v3\\CurrentVersion\\bin\\"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\ezcd.exe"C:\Users\Admin\AppData\Local\Managebg_QEE_v3\CurrentVersion\bin\ezcd.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cpprest141_2_8\ezcd.exeC:\Users\Admin\AppData\Roaming\cpprest141_2_8\ezcd.exe6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ftur.au3C:\Users\Admin\AppData\Local\Temp\Ftur.au38⤵
- Loads dropped DLL
-
-
-
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146B
MD5a90069ef3555d9fadff08d85349cdef6
SHA100f2f2641cf13bd48558dead920637c2d4d6bd90
SHA2564b4a3a76c1c3d364bc04121a4fa9c1e1ae2d8d95ba5c4ed0d78e86b060f0a979
SHA5128a08db9eedef05eb1f0ed6c6c31f350b5bd595eb906b3e202381dce20cec31a1fae0800b275d6b7dbfa7591b2622a3ce8e9d5c15bbb8c131262c284275cf5efc
-
Filesize
494KB
MD598ccd44353f7bc5bad1bc6ba9ae0cd68
SHA176a4e5bf8d298800c886d29f85ee629e7726052d
SHA256e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b
SHA512d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f
-
Filesize
2.9MB
MD5b1bdb6ded9dff296ceff241fb196457b
SHA15bdfb243477cf12c239bb277cd66ca0dfa5d043d
SHA256a9e79f83f81567cef62d2026ce30e1d5da27352590a6ef1c662cd1a634f73352
SHA5123ba56cca93ed41fd185d81b076146064e1f59d4b3109dd44ecbe26e28e669011562527b7a2bdea0d9fb2f00d03a03c80acc83b6d3430721f0ce57b7c31c36123
-
Filesize
25KB
MD59f812bd3815909e559b15cb13489f294
SHA1df751c956f59b4e3c82496d86895adc7cc1a1619
SHA256ce6fcc2ddf21720c92bee04f5736a4787acffa970a1b0dbeea39ff5efec52c75
SHA5120a360e8b81bf80cb6bdf240d627ddcf71b1a4ca42759de61b2d27fab521a8e6e3afa308cc69caf5a7c8b14d98d3d448f0d400ae1826cbe7d0f0ceafd14682064
-
Filesize
21KB
MD51a72e5f24214eb723e03a22ff53f8a22
SHA1578d1dbfb22e9ff3b10c095d6a06acaf15469709
SHA256fda46141c236a11054d4d3756a36da4412c82dd7877daad86cb65bf53d81ca1a
SHA512530e693daecc7c7080b21e39b856c538bb755516aafdb6839a23768f40bcfc38d71b19586e8c8e37bb1c2b7a7c31fcb8e24a2315a8dd90f50fec22f973d86cb4
-
Filesize
21KB
MD59d136bbecf98a931e6371346059b5626
SHA12466e66bfd88dd66c1c693cbb95ea8a91b9558cd
SHA2567617838af1b589f57e4fe9fee1e1412101878e6d3287cdc52a51cd03e3983717
SHA5128c720c798d2a06f48b106a0a1ef38be9b4a2aebe2a657c8721278afa9fdbab9da2a672f47b7996ca1ce7517015d361d77963c686e0ae637a98c32fd75e5d0610
-
Filesize
25KB
MD56b39d005deb6c5ef2c9dd9e013b32252
SHA179a0736454befd88ba8d6bd88794d07712e38a67
SHA256b0e50572eb82a46ed499775e95bfde7cb25c498957432c18c20cf930f332efd0
SHA51250bc1f669499589a480379d72166dae701914427d51223994d63a0363420ca6fdde07010803270a62451afea9e4ae55206d8a4c00ca4680e7a9120cd33f99a0f
-
Filesize
25KB
MD597f24295c9bd6e1acae0c391e68a64cf
SHA175700dce304c45ec330a9405523f0f22e5dcbb18
SHA256189d551fb3cba3dbb9b9c1797e127a52ac486d996f0ac7cba864fe35984a8d28
SHA512cac75f623545c41b2597a25c14f2af7eb93e3e768b345d3b0e1928d8fd1f12bec39b18b8277f9550aa6a66d9cfe1bf6c3db93ae1eb2a6c07019d4f210b3e5998
-
Filesize
25KB
MD5d282a4fa046d05d40d138cc68c518914
SHA1d5012090399f405ffe7d2fed09650e3544528322
SHA2568b1471101145343da5f2c5981c515da4dfae783622ed71d40693fe59c3088d7a
SHA512718926e728627f67ba60a391339b784accd861a15596f90d7f4e6292709ac3d170bcbca3cbf6267635136cb00b4f93da7dfd219fa0beee0cf8d95ce7090409e4
-
Filesize
21KB
MD56d35a57a6d8d569f870b96e00e7f1f4d
SHA18407bdb3cd5ec15b2ce738b3dbd704aa289ce3e1
SHA256f41511e477a164eb9451ca51fb3810437f3b15f21e6f5c6ce0956e84ec823723
SHA5124317b86d32ca93e5f0d832819cf1ab8af68e853a19eb07dd1fa4d168a0b2a8eab309194884ed3a613b09fc6d511be872a053f76f00ea443499006cdd226fea8f
-
Filesize
21KB
MD58ed70910380aa0b28317512d72762cc0
SHA10421518370f24f9559f96459d0798d98b81ea732
SHA256f15af0db93d9385ff9d8efdc06aacd0729d0dfcb66e91ca0243bb160f2ed89d0
SHA512b31ef07eaac310fdd3df3546246e7dc696595b8e92141e3db79a44ddc3358b12129e3829a53c76d0fef214e3f29dba77fa5d556211830a140ea34ff62258d9d7
-
Filesize
8.5MB
MD598169506fec94c2b12ba9930ad704515
SHA1bce662a9fb94551f648ba2d7e29659957fd6a428
SHA2569b8a5b0a45adf843e24214b46c285e44e73bc6eaf9e2a3b2c14a6d93ae541363
SHA5127f4f7ac2326a1a8b7afc72822dae328753578eb0a4ffcec5adb4e4fb0c49703070f71e7411df221ee9f44d6b43a0a94921fe530877c5d5e71640b807e96def30
-
Filesize
46KB
MD5e1e1bf5a99a816a279d1309d61d80f2d
SHA1427726ac33db371d40a687ef11b6071239bc70f6
SHA256317cd902474c2dd27c9ad4af84d6b97b2831a996d9cd05ce2fb2518ffc38f923
SHA512a6a2807324218eb28039bf3f946f3fadcdf5507b1d85c126a55b94c07c048a43db26183692e3e385680c299b01f4666f2ab17fc366f946fd6097e3d71e46088d
-
Filesize
9.7MB
MD5d4cf9207c2e3ba875410515927a9c3b2
SHA11564182a98cbf350c3d0e6ecfdcd622226c6217f
SHA256ec329b9da2c72d3dd84d0b8f41b2ba8c2e95208aa614c6f10ca2ede6e6d2b52b
SHA512b7b7e96d3c0ce2286b3ebcb978b976aaf31674c204f8c868daa9019b61e67cee4b4c0da90aa1ed8463474c9a156880cc422719ae7a78617ee5d7cda0be4a5034
-
Filesize
4.0MB
MD542943c6acaf8d5ca953911b2bb99fc14
SHA1ea719eafd2857b43b20228827f5596f1137ac3d5
SHA256427ef018d494bf6cb8531ab3bbcb501ed4c8c7c6479097b33ab4d15750eccc4c
SHA51285e71abc6db8a2e4eaad70d35ca613a918046715c8447b4c975021791f160aa3d1c4cb19969f81dd7b9f98f13dec41619c44e3c5948ae593af9c3d0cfec346fc
-
Filesize
1.3MB
MD5976de7d9e2ddca3c71bc51dc64e8ea6f
SHA12a76dc465078e110b20287730b64176ce844ab9f
SHA25647a827e4291894470af7ad714fcafda799ad69715100e28cbc5570801c8dbdb8
SHA512804a41d05e0ebad7803a039d94a2b79a0b22340faaf6ec6aa773e67f34cf6fe5439aa8621761e30e65631ee083feea36a2f482b4614e5173e5669a756a419763
-
Filesize
116KB
MD5699dd61122d91e80abdfcc396ce0ec10
SHA17b23a6562e78e1d4be2a16fc7044bdcea724855e
SHA256f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
SHA5122517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff
-
Filesize
1.8MB
MD57c24dbf7bc0b2c6c02465735eeb2b7a3
SHA1939c33e8c026de214189c1feafb7da4b93237df6
SHA2560ec6a9a2aca251d664b08825a9b7144a3671981bb8c91101d9e1f79af837ce10
SHA512209bbd248bb2428b9943f74eabfafbaa76d212d0938211c9fcfbecf1298a6e6563c48b864e1d17da28679094c75dfa97fba20eec60b10344a3dd9e6b93700634
-
Filesize
3.0MB
MD562c2965912072266823bafdec2273528
SHA1a737d8b8d31a440137894c0852c71976d64fb6fc
SHA256d26099f9c70cd8a482e372523b96cdd5e01ff373725d786c9b9dd9749d3a03ab
SHA5122dd306f9e3d78a6531b1bdd28ecc5be118bd45b3fad6197d404ab3dbadae60902fedf5df3cd8db2e07e63e5d80e672d6693b6e74c5df01a25d962ec912631c46
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
832KB
-
Filesize
728KB
-
Filesize
832KB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
1.4MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
1.9MB
-
Filesize
25.0MB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
2.0MB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
25.0MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
1.9MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB