Analysis

  • max time kernel
    214s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04-07-2024 22:48

General

  • Target

    f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe

  • Size

    5.7MB

  • MD5

    59c58fdafe6e2a4c7826c987f53aa5dc

  • SHA1

    5c72cdf8e33a4e77aff7145d85b3284dcc1356d6

  • SHA256

    f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734

  • SHA512

    28258b42c6a008e55e37d1ffff4d1ed74f7a9c7268c4928aa9865de710ebe782ddc70215c82dd35f1d8dce8d5c817d499a99e7963d97f32a41e0f62a4c78fe7c

  • SSDEEP

    49152:KN9aR05e5WPlFcixvIgDOS1E50r8uvDVDd2xEeq85jV5EsF2KiOxZ9mICXxzhLzH:YoqlFPLDUuvZxAE2e1/

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://potterryisiw.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe
    "C:\Users\Admin\AppData\Local\Temp\f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:596
    • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1216

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/596-2-0x00007FF743930000-0x00007FF743F73000-memory.dmp

    Filesize

    6.3MB

  • memory/596-6-0x00007FF743930000-0x00007FF743F73000-memory.dmp

    Filesize

    6.3MB

  • memory/1216-5-0x0000000000180000-0x00000000001D9000-memory.dmp

    Filesize

    356KB

  • memory/1216-8-0x0000000000180000-0x00000000001D9000-memory.dmp

    Filesize

    356KB

  • memory/1216-9-0x0000000000180000-0x00000000001D9000-memory.dmp

    Filesize

    356KB

  • memory/1216-10-0x0000000000180000-0x00000000001D9000-memory.dmp

    Filesize

    356KB