Analysis
-
max time kernel
191s -
max time network
295s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04-07-2024 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe
Resource
win7-20240221-en
0 signatures
300 seconds
General
-
Target
c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe
-
Size
17.9MB
-
MD5
5f43d8f10c84f166a69eeea31229a4ae
-
SHA1
3876d8bfb443b9bbbff5b3f34e0fc57357930efa
-
SHA256
c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b
-
SHA512
af9b64ef2a20a5af075ce23fb5a3ae13592fccab4189eaed532fde46d43cf0230095b2d0d78cf7d0f7f9f29dd241c2b729e17f09bec2daa4d2ca4fb56a2c890b
-
SSDEEP
98304:Q/PL8Lelkmo3OhN0eMWNOgLN1wGkxXUtzlwEM8FNJlliOliuXdj:Q1im2OhNuoYUVMKtliuh
Malware Config
Extracted
Family
lumma
C2
https://invisibledovereats.shop/api
Signatures
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exedescription pid process target process PID 2648 set thread context of 1760 2648 c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe BitLockerToGo.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BitLockerToGo.exepid process 1760 BitLockerToGo.exe 1760 BitLockerToGo.exe 1760 BitLockerToGo.exe 1760 BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exedescription pid process target process PID 2648 wrote to memory of 1760 2648 c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe BitLockerToGo.exe PID 2648 wrote to memory of 1760 2648 c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe BitLockerToGo.exe PID 2648 wrote to memory of 1760 2648 c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe BitLockerToGo.exe PID 2648 wrote to memory of 1760 2648 c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe BitLockerToGo.exe PID 2648 wrote to memory of 1760 2648 c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe BitLockerToGo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe"C:\Users\Admin\AppData\Local\Temp\c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760