Analysis
-
max time kernel
195s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04-07-2024 22:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe
Resource
win7-20240704-en
0 signatures
300 seconds
General
-
Target
ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe
-
Size
7.7MB
-
MD5
2bc0db539a8fab08bf4104eb7f2de7e7
-
SHA1
ff4a5defedb18c93ef815434b40e19b9452ca410
-
SHA256
ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04
-
SHA512
ffaeb6c876d2aeda75b6576d2b307964a7b5330a0ab73352a4c95ef18ac3b1b1bfff350805553833a754582ed54215337c376bce0abd44c117b5d8a0e1468d71
-
SSDEEP
49152:P8FC9tZ1LK9QkVNdZEOto3XOREES2CG9LlPJHzPihufFRDiLYDEwjB5EtC0D4DAh:UuG9QcnhnLxHmhYFBEtCHi1mK
Malware Config
Extracted
Family
lumma
C2
https://potterryisiw.shop/api
Signatures
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exedescription pid process target process PID 3800 set thread context of 4576 3800 ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe BitLockerToGo.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BitLockerToGo.exepid process 4576 BitLockerToGo.exe 4576 BitLockerToGo.exe 4576 BitLockerToGo.exe 4576 BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exedescription pid process target process PID 3800 wrote to memory of 4576 3800 ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe BitLockerToGo.exe PID 3800 wrote to memory of 4576 3800 ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe BitLockerToGo.exe PID 3800 wrote to memory of 4576 3800 ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe BitLockerToGo.exe PID 3800 wrote to memory of 4576 3800 ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe BitLockerToGo.exe PID 3800 wrote to memory of 4576 3800 ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe BitLockerToGo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe"C:\Users\Admin\AppData\Local\Temp\ec84ec11567566db3ba9096df164f0b7a8217d50ffab16fa3642f8f12d759b04.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4576