Analysis

  • max time kernel
    93s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-07-2024 09:56

General

  • Target

    github.software.1.2.9.exe

  • Size

    516KB

  • MD5

    0b7ef465e6ad4c6a671736f20f79e141

  • SHA1

    ecc766f41168c898e985f5c502d000cee588d2b8

  • SHA256

    2a1152a8f1689bf251fbea5c21cc178537ed20a6c92f6bff63403092df23d0c9

  • SHA512

    6fe7dc79b5b023b9bce193c65c54a75065cd569c60492e6f08e6f23fc0865690abeb34644dc384a09eac618cfb2c09f2df74efdf4a2d733f8f60fbddb0555120

  • SSDEEP

    12288:D20S+N0KzL7CteqhzPQkAjY1K1mDuNuQi:G+NRat5hDQkAj

Malware Config

Extracted

Family

lumma

C2

https://closedjuruwk.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\github.software.1.2.9.exe
    "C:\Users\Admin\AppData\Local\Temp\github.software.1.2.9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:4140
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4044

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4036-0-0x00000000009A0000-0x00000000009A1000-memory.dmp

      Filesize

      4KB

    • memory/4044-1-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/4044-3-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/4044-4-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/4044-5-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB