Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 12:52
Static task
static1
Behavioral task
behavioral1
Sample
creaminstaller.exe
Resource
win7-20240705-en
General
-
Target
creaminstaller.exe
-
Size
517KB
-
MD5
ff6ebaba7de1e99d37206afc9f9281e7
-
SHA1
c1f7bfb48bc6ff019ae697a9a724e821cb0b2624
-
SHA256
0d58b7e445ac81c5000f1fc82566974158440aeabd57b2b16080659386ea64f8
-
SHA512
22dd0ef1411ce92347f0fc055b2f869d33d7f058622228cbca5833b55ce7a3bcf5b3c25ad9cbbe859cb634a0e5bd5c884fc1e96f0f17cad55c2372109094141f
-
SSDEEP
12288:KYAHs+2jwV5HLhhzAEeSZ3U7gOsIqvjM8gUnRfYpr0JP/trch:KYpVjUrfAEeSK71sJM8DBzc
Malware Config
Extracted
lumma
https://bitchsafettyudjwu.shop/api
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
creaminstaller.exedescription pid process target process PID 2944 set thread context of 2040 2944 creaminstaller.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4756 2944 WerFault.exe creaminstaller.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
RegAsm.exepid process 2040 RegAsm.exe 2040 RegAsm.exe 2040 RegAsm.exe 2040 RegAsm.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
creaminstaller.exedescription pid process target process PID 2944 wrote to memory of 2040 2944 creaminstaller.exe RegAsm.exe PID 2944 wrote to memory of 2040 2944 creaminstaller.exe RegAsm.exe PID 2944 wrote to memory of 2040 2944 creaminstaller.exe RegAsm.exe PID 2944 wrote to memory of 2040 2944 creaminstaller.exe RegAsm.exe PID 2944 wrote to memory of 2040 2944 creaminstaller.exe RegAsm.exe PID 2944 wrote to memory of 2040 2944 creaminstaller.exe RegAsm.exe PID 2944 wrote to memory of 2040 2944 creaminstaller.exe RegAsm.exe PID 2944 wrote to memory of 2040 2944 creaminstaller.exe RegAsm.exe PID 2944 wrote to memory of 2040 2944 creaminstaller.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\creaminstaller.exe"C:\Users\Admin\AppData\Local\Temp\creaminstaller.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 3082⤵
- Program crash
PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2944 -ip 29441⤵PID:3552
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4496