Analysis

  • max time kernel
    324s
  • max time network
    326s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-07-2024 19:49

General

  • Target

    Setup.exe

  • Size

    531KB

  • MD5

    b1479bd80cbfea3cb5db91c52bba0615

  • SHA1

    5669b797bd023efbc6f1e6823a9b1b98f4031ad3

  • SHA256

    1dda11a1f85b968ac0cf7b71f31956839690a7134069fe6073062021d53b5023

  • SHA512

    3bd87b7deb5cad4f4a89ea366ce6f8c23eb5a5d2f0c079c1d97b9d3a5b98e83e5396f0af1b3cd435fb75d195284856369e7811e5462a2b8f1bc9b55ec7b86f61

  • SSDEEP

    12288:+egSWmZ6T5wsKyrrSJSPu4sVDOcotJTGX9w32tsh:+ejFZgtESPuFaU9wGts

Malware Config

Extracted

Family

lumma

C2

https://bitchsafettyudjwu.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:1596
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1944
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 652
        2⤵
        • Program crash
        PID:2156
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4116 -ip 4116
      1⤵
        PID:5004
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3440

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1944-5-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

      • memory/1944-1-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

      • memory/1944-3-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

      • memory/1944-4-0x0000000000400000-0x000000000045A000-memory.dmp

        Filesize

        360KB

      • memory/3440-7-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/3440-6-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/3440-8-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/3440-12-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/3440-18-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/3440-17-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/3440-16-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/3440-15-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/3440-14-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/3440-13-0x000001E11B390000-0x000001E11B391000-memory.dmp

        Filesize

        4KB

      • memory/4116-0-0x0000000001150000-0x0000000001151000-memory.dmp

        Filesize

        4KB