Analysis
-
max time kernel
445s -
max time network
1181s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-fr -
resource tags
arch:x64arch:x86image:win10v2004-20240508-frlocale:fr-fros:windows10-2004-x64systemwindows -
submitted
29-06-2024 16:48
Static task
static1
1 signatures
General
-
Target
CheatInjector.exe
-
Size
507KB
-
MD5
74fc9ce1b489f3817b04bb3332162450
-
SHA1
01158dfdec93914f4f72ff59da271a9b89ba9c89
-
SHA256
b2d867a161a63c67631ed8fe41c64990975627400ac0907862e4e8dad8018ad1
-
SHA512
51b24b45b07711e9c8651dbc1cd5660704b08dd78ec4bd2afb30f3abc28a897ba1b1e867ae6ba265d16358a19403036661e80d6c987c5f51d66fb00ac70d48a8
-
SSDEEP
12288:0G0NNkaifcy3CqcNB6PLi2764VOg4l983MdNYgq8aqe:0jyaCcyPWi64VFYHdNDta
Malware Config
Extracted
Family
lumma
C2
https://bitchsafettyudjwu.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4032 set thread context of 4480 4032 CheatInjector.exe 82 -
Program crash 1 IoCs
pid pid_target Process procid_target 1652 4032 WerFault.exe 80 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4020 taskmgr.exe Token: SeSystemProfilePrivilege 4020 taskmgr.exe Token: SeCreateGlobalPrivilege 4020 taskmgr.exe Token: 33 4020 taskmgr.exe Token: SeIncBasePriorityPrivilege 4020 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe 4020 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4032 wrote to memory of 4480 4032 CheatInjector.exe 82 PID 4032 wrote to memory of 4480 4032 CheatInjector.exe 82 PID 4032 wrote to memory of 4480 4032 CheatInjector.exe 82 PID 4032 wrote to memory of 4480 4032 CheatInjector.exe 82 PID 4032 wrote to memory of 4480 4032 CheatInjector.exe 82 PID 4032 wrote to memory of 4480 4032 CheatInjector.exe 82 PID 4032 wrote to memory of 4480 4032 CheatInjector.exe 82 PID 4032 wrote to memory of 4480 4032 CheatInjector.exe 82 PID 4032 wrote to memory of 4480 4032 CheatInjector.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatInjector.exe"C:\Users\Admin\AppData\Local\Temp\CheatInjector.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 3082⤵
- Program crash
PID:1652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4032 -ip 40321⤵PID:1436
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4020
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2024
-
C:\Windows\System32\fruvan.exe"C:\Windows\System32\fruvan.exe"1⤵PID:2652