Analysis
-
max time kernel
4s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-es -
resource tags
arch:x64arch:x86image:win10v2004-20240709-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
10-07-2024 22:52
Static task
static1
Behavioral task
behavioral1
Sample
LInjector.exe
Resource
win7-20240704-es
General
-
Target
LInjector.exe
-
Size
554KB
-
MD5
613df599866679f7f19d12ff86220db8
-
SHA1
33a2f464888fd8aedd2c4cd8f79e9e43321d8465
-
SHA256
65f8e0e219637833386b6cfe27bd2f8446a214f02149628c63dd0329501e17e6
-
SHA512
4091dc9ce75e7ff9a1131aa200e30ca293a8619a616bce17a4f5fa6e79602848efd422be64be7af8aff3c99f75536d2ea45dbcf1d7afb0a7998a0526bf76ce13
-
SSDEEP
12288:2Nqf82rBbd4Qlj68ZEpv/7B+WIOzys7AsMC6WReVDTKwWZwfwsBAlny7Jc23OBuB:2s82ZWQx6AKsWL
Malware Config
Extracted
lumma
https://extorteauhhwigw.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
LInjector.exepid Process 4604 LInjector.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LInjector.exedescription pid Process procid_target PID 4604 set thread context of 3964 4604 LInjector.exe 87 -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
LInjector.exedescription pid Process procid_target PID 4604 wrote to memory of 3964 4604 LInjector.exe 87 PID 4604 wrote to memory of 3964 4604 LInjector.exe 87 PID 4604 wrote to memory of 3964 4604 LInjector.exe 87 PID 4604 wrote to memory of 3964 4604 LInjector.exe 87 PID 4604 wrote to memory of 3964 4604 LInjector.exe 87 PID 4604 wrote to memory of 3964 4604 LInjector.exe 87 PID 4604 wrote to memory of 3964 4604 LInjector.exe 87 PID 4604 wrote to memory of 3964 4604 LInjector.exe 87 PID 4604 wrote to memory of 3964 4604 LInjector.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\LInjector.exe"C:\Users\Admin\AppData\Local\Temp\LInjector.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"2⤵PID:3964
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
429KB
MD5f6ba3a613a9d9be4b2b93c8ec849d239
SHA1dadd356e8b028fd7ce67e91ddea68b4928a146d3
SHA256d66df0795ea1a1941802c75c10603a6ad3b162ded9153f3623c3816e81e47bba
SHA5120b02ddc1208abdc270637992d15ca64154b7dc5fd5420df3b5a6253655050f415f983aaed06427b3d30315a406b3c6a98d5487a9d5ad5df863cddaa9b2a92989