Analysis
- max time kernel
135s - max time network
136s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
15/06/2024, 17:23
General
- Target CFXBypass.exe
- Size 490KB
- Sample240615-vycerssdlr
- SHA256 f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
Malware Config
Extracted
-
lumma
-
https://cleartotalfisherwo.shop/api
-
https://worryfillvolcawoi.shop/api
-
https://enthusiasimtitleow.shop/api
-
https://dismissalcylinderhostw.shop/api
-
https://affordcharmcropwo.shop/api
-
https://diskretainvigorousiw.shop/api
-
https://communicationgenerwo.shop/api
-
https://pillowbrocccolipe.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 29 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\CFXBypass.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ReadUpdate.wmv"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding2⤵
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ReadUpdate.wmv"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
allservices.xml
wmsetup.log
vlc-qt-interface.ini
vlc-qt-interface.ini.lock
vlcrc
memory/2124-102-0x00007FF98A0C0000-0x00007FF98A0D1000-memory.dmp
memory/2124-94-0x00007FF98A5D0000-0x00007FF98A5ED000-memory.dmp
memory/2124-117-0x00007FF978CD0000-0x00007FF979D80000-memory.dmp
memory/2124-115-0x00007FF98A930000-0x00007FF98A964000-memory.dmp
memory/2124-116-0x00007FF98A670000-0x00007FF98A926000-memory.dmp
memory/2124-114-0x00007FF6C2D40000-0x00007FF6C2E38000-memory.dmp
memory/2124-86-0x00007FF6C2D40000-0x00007FF6C2E38000-memory.dmp
memory/2124-87-0x00007FF98A930000-0x00007FF98A964000-memory.dmp
memory/2124-88-0x00007FF98A670000-0x00007FF98A926000-memory.dmp
memory/2124-96-0x00007FF989670000-0x00007FF98987B000-memory.dmp
memory/2124-95-0x00007FF98A290000-0x00007FF98A2A1000-memory.dmp
memory/2124-99-0x00007FF98A1D0000-0x00007FF98A1F1000-memory.dmp
memory/2124-104-0x00007FF98A080000-0x00007FF98A09B000-memory.dmp
memory/2124-97-0x00007FF978CD0000-0x00007FF979D80000-memory.dmp
memory/2124-103-0x00007FF98A0A0000-0x00007FF98A0B1000-memory.dmp
memory/2124-89-0x00007FF98DA80000-0x00007FF98DA98000-memory.dmp
memory/2124-101-0x00007FF98A190000-0x00007FF98A1A1000-memory.dmp
memory/2124-100-0x00007FF98A1B0000-0x00007FF98A1C8000-memory.dmp
memory/2124-98-0x00007FF98A200000-0x00007FF98A241000-memory.dmp
memory/2124-90-0x00007FF98A650000-0x00007FF98A667000-memory.dmp
memory/2124-93-0x00007FF98A5F0000-0x00007FF98A601000-memory.dmp
memory/2124-92-0x00007FF98A610000-0x00007FF98A627000-memory.dmp
memory/2124-91-0x00007FF98A630000-0x00007FF98A641000-memory.dmp
memory/2612-80-0x00007FF6C2D40000-0x00007FF6C2E38000-memory.dmp
memory/2612-82-0x00007FF98A670000-0x00007FF98A926000-memory.dmp
memory/2612-85-0x00007FF98A630000-0x00007FF98A641000-memory.dmp
memory/2612-84-0x00007FF98A650000-0x00007FF98A667000-memory.dmp
memory/2612-83-0x00007FF98DA80000-0x00007FF98DA98000-memory.dmp
memory/2612-81-0x00007FF98A930000-0x00007FF98A964000-memory.dmp
memory/4988-9-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/4988-11-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/4988-0-0x0000000000A80000-0x0000000000ACB000-memory.dmp
memory/4988-10-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/4988-8-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/4988-7-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/4988-6-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/4988-5-0x0000000000F60000-0x0000000000F61000-memory.dmp