Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-07-2024 17:47

General

  • Target

    github_installer.exe

  • Size

    127.5MB

  • MD5

    b632cf3c5bb16abf2045630f5ef5863d

  • SHA1

    9cc11f5ea081b9f05014725460146c5e15b16195

  • SHA256

    87dd6cb04b85a8238640b1e527ef18b2e1577bc1d75c4c4d91f15e18d186e9fb

  • SHA512

    6bce013a52bda1cf1f5a95c1d0b05443f892069758065c0f6760a005046d1a76b6ba10c452ec991bf08a20c138967626d175e21c9a4da7815fd7956a2a5fad58

  • SSDEEP

    12288:3U7KDE27/KjEWQ3TNX/urrGAQWlcAy/Mc21DkGmFyqDttJtJJ9g/Yq6FkCssSL4k:E7KI2JT1urrOs/

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://stationacutwo.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Loads dropped DLL 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\github_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\github_installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\d3d9.dll

    Filesize

    427KB

    MD5

    ff0531892270c9da7859e1adf5e0bf65

    SHA1

    9087ff214b0228efddbd68e043685234ba0d7932

    SHA256

    3fb33acf13aaafdd8d26fc70cab223812f8bf286550e620a09f91155a0b7b86e

    SHA512

    7995903d039ba81c837e6a7fe5fdaaf3e003115f2bd826cc9940fccb77ceca0ae2f6ccb56eca5fda1acf2bbc579e7e9ae4fb54df39ee626a2de23ddcdec81c27

  • memory/3684-12-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3684-15-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3684-9-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3684-16-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/4456-0-0x00000000751DE000-0x00000000751DF000-memory.dmp

    Filesize

    4KB

  • memory/4456-1-0x0000000000690000-0x0000000000724000-memory.dmp

    Filesize

    592KB

  • memory/4456-2-0x0000000005010000-0x0000000005016000-memory.dmp

    Filesize

    24KB

  • memory/4456-13-0x0000000077C71000-0x0000000077D91000-memory.dmp

    Filesize

    1.1MB

  • memory/4456-14-0x00000000751D0000-0x0000000075980000-memory.dmp

    Filesize

    7.7MB

  • memory/4456-17-0x00000000751D0000-0x0000000075980000-memory.dmp

    Filesize

    7.7MB