Analysis
-
max time kernel
94s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 19:48
Static task
static1
Behavioral task
behavioral1
Sample
qeUaxJCA3FO.exe
Resource
win7-20240611-en
General
-
Target
qeUaxJCA3FO.exe
-
Size
518KB
-
MD5
efc76b9581da08661c9c91c2a6e7d289
-
SHA1
ef7674fe136d80308a44d99ac72b8be550604110
-
SHA256
85356bb669ec17503e48ca457e99347f5386ba644fba9d638d4188a7b4970153
-
SHA512
b2d3432b68b227a5ad64faf6cc789f32ab2234a070c25393849c3d170616a125c1c3c82e18a7952b3ddd3a0024ff845c67aa67ce9b011b9cd9b74e093fc4e5d1
-
SSDEEP
12288:MnUGt+HbHe5BjPORtvLP9qpbY7/2E1yItd2ybSLxWP1yh:Mnncbs1PODZqpBCSiS8Pg
Malware Config
Extracted
lumma
https://bitchsafettyudjwu.shop/api
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
qeUaxJCA3FO.exedescription pid process target process PID 3260 set thread context of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1712 3260 WerFault.exe qeUaxJCA3FO.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegAsm.exepid process 5084 RegAsm.exe 5084 RegAsm.exe 5084 RegAsm.exe 5084 RegAsm.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
qeUaxJCA3FO.exedescription pid process target process PID 3260 wrote to memory of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe PID 3260 wrote to memory of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe PID 3260 wrote to memory of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe PID 3260 wrote to memory of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe PID 3260 wrote to memory of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe PID 3260 wrote to memory of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe PID 3260 wrote to memory of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe PID 3260 wrote to memory of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe PID 3260 wrote to memory of 5084 3260 qeUaxJCA3FO.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qeUaxJCA3FO.exe"C:\Users\Admin\AppData\Local\Temp\qeUaxJCA3FO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 2802⤵
- Program crash
PID:1712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3260 -ip 32601⤵PID:3052