Analysis
-
max time kernel
195s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04-07-2024 22:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe
Resource
win7-20240419-en
2 signatures
300 seconds
General
-
Target
842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe
-
Size
7.0MB
-
MD5
f308be1162c86c3d72ad06c4c85a67d4
-
SHA1
c09e56bde09f752265d8527dd930715ce8e149e2
-
SHA256
842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174
-
SHA512
801d273afcf3994c0b02466e3d5343cbb5ec6665abaf5b9a6e4e376e39e0dec6b572d9b7760f53842e6a65c6314567c85fea9a41833a8c29ed3b0c5d57c1108a
-
SSDEEP
49152:EfMhc7XOayJj55BNcU0KA///skFyE6OjBuXVBw5yyk0+fNH4YxVjM5EmOj1Ggdap:Osc7XL4JNgB01XVKkuFEmBhIGFH
Malware Config
Extracted
Family
lumma
C2
https://potterryisiw.shop/api
Signatures
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exedescription pid process target process PID 4704 set thread context of 3820 4704 842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe BitLockerToGo.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BitLockerToGo.exepid process 3820 BitLockerToGo.exe 3820 BitLockerToGo.exe 3820 BitLockerToGo.exe 3820 BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exedescription pid process target process PID 4704 wrote to memory of 3820 4704 842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe BitLockerToGo.exe PID 4704 wrote to memory of 3820 4704 842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe BitLockerToGo.exe PID 4704 wrote to memory of 3820 4704 842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe BitLockerToGo.exe PID 4704 wrote to memory of 3820 4704 842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe BitLockerToGo.exe PID 4704 wrote to memory of 3820 4704 842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe BitLockerToGo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe"C:\Users\Admin\AppData\Local\Temp\842e6467d3f6bddb484929a8dba9757920e0b484d8addf40a8fe69f8b205f174.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3820