Analysis
-
max time kernel
214s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04-07-2024 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe
Resource
win7-20240508-en
0 signatures
300 seconds
General
-
Target
f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe
-
Size
5.7MB
-
MD5
59c58fdafe6e2a4c7826c987f53aa5dc
-
SHA1
5c72cdf8e33a4e77aff7145d85b3284dcc1356d6
-
SHA256
f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734
-
SHA512
28258b42c6a008e55e37d1ffff4d1ed74f7a9c7268c4928aa9865de710ebe782ddc70215c82dd35f1d8dce8d5c817d499a99e7963d97f32a41e0f62a4c78fe7c
-
SSDEEP
49152:KN9aR05e5WPlFcixvIgDOS1E50r8uvDVDd2xEeq85jV5EsF2KiOxZ9mICXxzhLzH:YoqlFPLDUuvZxAE2e1/
Malware Config
Extracted
Family
lumma
C2
https://potterryisiw.shop/api
Signatures
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exedescription pid process target process PID 596 set thread context of 1216 596 f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe BitLockerToGo.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BitLockerToGo.exepid process 1216 BitLockerToGo.exe 1216 BitLockerToGo.exe 1216 BitLockerToGo.exe 1216 BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exedescription pid process target process PID 596 wrote to memory of 1216 596 f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe BitLockerToGo.exe PID 596 wrote to memory of 1216 596 f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe BitLockerToGo.exe PID 596 wrote to memory of 1216 596 f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe BitLockerToGo.exe PID 596 wrote to memory of 1216 596 f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe BitLockerToGo.exe PID 596 wrote to memory of 1216 596 f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe BitLockerToGo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe"C:\Users\Admin\AppData\Local\Temp\f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1216