Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-07-2024 19:28

General

  • Target

    1d19a11b77dccb759dd86f9d0481bc144ea353118865ac8476be21733af1678b.exe

  • Size

    565KB

  • MD5

    efdc51a044c4265b8623d212737a4b84

  • SHA1

    b26024ce65d9585070b7af5b4e7f4e3647e4be7e

  • SHA256

    1d19a11b77dccb759dd86f9d0481bc144ea353118865ac8476be21733af1678b

  • SHA512

    a68a83c1054d2b1dfb43144e58ccaddc1f58468e02e2f40978c1fe9119747f737de65930ed3f500c00e9d8ae5e00e42a7a30f8e366af1e58178729536dd514e5

  • SSDEEP

    12288:sENv3ccWd6SUCVBsQLyfXgOKyDFzKIHB4ladY8kqqwhyvT5NkeTEWYRqWXYLlmlV:sENvMFd6xuLyfXglOpm

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://bitchsafettyudjwu.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Loads dropped DLL 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d19a11b77dccb759dd86f9d0481bc144ea353118865ac8476be21733af1678b.exe
    "C:\Users\Admin\AppData\Local\Temp\1d19a11b77dccb759dd86f9d0481bc144ea353118865ac8476be21733af1678b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\d3d9.dll

    Filesize

    452KB

    MD5

    b0774c8d79fb4ba12d2dbb647ade2a8f

    SHA1

    8f91d3922240734f01db7aa2118eb0973d1c5a15

    SHA256

    5de43f8c8868e9e42b3187817dd376f868f7f3c5324b4907ce74badd226e7b6a

    SHA512

    c675b10f0d71434d8b547ddda0041a6d920f01efefa310877cf9ec14f3c1a2a762fda5c6669f3261f8351b0f9afbdcb78d8fd7d68df6dc993ff1ddb3b1443ffe

  • memory/3228-10-0x0000000000C00000-0x0000000000C59000-memory.dmp

    Filesize

    356KB

  • memory/3228-18-0x0000000000C00000-0x0000000000C59000-memory.dmp

    Filesize

    356KB

  • memory/3228-14-0x0000000000C00000-0x0000000000C59000-memory.dmp

    Filesize

    356KB

  • memory/4536-0-0x00000000751EE000-0x00000000751EF000-memory.dmp

    Filesize

    4KB

  • memory/4536-1-0x00000000003A0000-0x0000000000436000-memory.dmp

    Filesize

    600KB

  • memory/4536-2-0x00000000027D0000-0x00000000027D6000-memory.dmp

    Filesize

    24KB

  • memory/4536-8-0x00000000751E0000-0x0000000075990000-memory.dmp

    Filesize

    7.7MB

  • memory/4536-19-0x00000000751E0000-0x0000000075990000-memory.dmp

    Filesize

    7.7MB

  • memory/4536-20-0x00000000751E0000-0x0000000075990000-memory.dmp

    Filesize

    7.7MB