Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 21:19

General

  • Target

    https://www.mediafire.com/folder/c24v5iuste1ga/Lunnar+Fortnite+Hack

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://bouncedgowp.shop/api

https://bannngwko.shop/api

https://bargainnykwo.shop/api

https://affecthorsedpo.shop/api

https://radiationnopp.shop/api

https://answerrsdo.shop/api

https://publicitttyps.shop/api

https://benchillppwo.shop/api

https://reinforcedirectorywd.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/folder/c24v5iuste1ga/Lunnar+Fortnite+Hack
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa437bcc40,0x7ffa437bcc4c,0x7ffa437bcc58
      2⤵
        PID:3176
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,13779477990924452152,6793811591471793499,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1816 /prefetch:2
        2⤵
          PID:4016
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2104,i,13779477990924452152,6793811591471793499,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2192 /prefetch:3
          2⤵
            PID:4032
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,13779477990924452152,6793811591471793499,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2564 /prefetch:8
            2⤵
              PID:2456
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,13779477990924452152,6793811591471793499,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3160 /prefetch:1
              2⤵
                PID:3012
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,13779477990924452152,6793811591471793499,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2844 /prefetch:1
                2⤵
                  PID:3200
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4692,i,13779477990924452152,6793811591471793499,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4704 /prefetch:8
                  2⤵
                    PID:3704
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4920,i,13779477990924452152,6793811591471793499,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5256 /prefetch:8
                    2⤵
                      PID:820
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4844,i,13779477990924452152,6793811591471793499,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4848 /prefetch:8
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4720
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                    1⤵
                      PID:3760
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:4212
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:1768
                        • C:\Users\Admin\Downloads\Lunnar\launcher.exe
                          "C:\Users\Admin\Downloads\Lunnar\launcher.exe"
                          1⤵
                          • Suspicious use of SetThreadContext
                          PID:3928
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            2⤵
                              PID:2772
                          • C:\Users\Admin\Downloads\Lunnar\launcher.exe
                            "C:\Users\Admin\Downloads\Lunnar\launcher.exe"
                            1⤵
                            • Suspicious use of SetThreadContext
                            PID:5012
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              2⤵
                                PID:4504
                            • C:\Windows\system32\NOTEPAD.EXE
                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Lunnar\README.txt
                              1⤵
                              • Opens file in notepad (likely ransom note)
                              PID:5048
                            • C:\Users\Admin\Downloads\Lunnar\if the launcher doesn't work.exe
                              "C:\Users\Admin\Downloads\Lunnar\if the launcher doesn't work.exe"
                              1⤵
                              • Suspicious use of SetThreadContext
                              PID:4552
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                2⤵
                                  PID:2020
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  2⤵
                                    PID:2532
                                • C:\Windows\system32\NOTEPAD.EXE
                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Lunnar\archive password - 123.txt
                                  1⤵
                                    PID:2588
                                  • C:\Users\Admin\Downloads\Lunnar\if the launcher doesn't work.exe
                                    "C:\Users\Admin\Downloads\Lunnar\if the launcher doesn't work.exe"
                                    1⤵
                                    • Suspicious use of SetThreadContext
                                    PID:1588
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      2⤵
                                        PID:2332
                                    • C:\Users\Admin\Downloads\Lunnar\if the launcher doesn't work.exe
                                      "C:\Users\Admin\Downloads\Lunnar\if the launcher doesn't work.exe"
                                      1⤵
                                      • Suspicious use of SetThreadContext
                                      PID:1992
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        2⤵
                                          PID:2152

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4dfa35e4-e996-40fa-8f11-43d5e4d77875.tmp

                                        Filesize

                                        92KB

                                        MD5

                                        3b685cd4c7bd6dcde5746ddef7414b04

                                        SHA1

                                        6916e51f26f1c06213dab0c72fca877ced57637c

                                        SHA256

                                        3f02f274281239e8c01f1619ca9695e7991194daf754db9003a10d1f2134ced7

                                        SHA512

                                        084807862e7e601110c7c64825414e2337c6fee5afab2ce941659b453665f5b472a83531be8908c8764a127437a47c651de5721e7913bb12cfb7b03b4eed30c5

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\06b1b198-3fdb-4a70-932b-adac87c10ce7.tmp

                                        Filesize

                                        8KB

                                        MD5

                                        3b067e8130368e42626c6088eec2ee3f

                                        SHA1

                                        3db15b5c4b5d0e76a28c6c7e7f2e01c7e144efd7

                                        SHA256

                                        f10f42b7ca5955d7696063ecf38e074ce7c5c256a51f7193cc8a7c3f8eda814c

                                        SHA512

                                        29dcc337f5c3487b495bc804cfa3233cb040f708692e48dbf29431cbd30bb6df8dd962f917ecd083ba35726c1bded6676cf43d1f984b27d141662bc865a21d33

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        1KB

                                        MD5

                                        8c200788ec74ff7dca6a09b4f282ebe8

                                        SHA1

                                        2573dcadf1abbf6021b95c77c8a7fe112e6cc604

                                        SHA256

                                        d1f46308532a74a979b764f96c2c5f2c37d56bae67e5d11539621cedfdf0ae62

                                        SHA512

                                        66ec6616b84ae67d81479d1628b6dc026b9d54f7b4e555c781bf3d1303a6cd8f6ffcf77568313641dccce7dc51327ac8fc24f6c3b61b31c02a3db64590d06b16

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        1KB

                                        MD5

                                        7b33fe347cef5776f9a5e2b3f2d3eae1

                                        SHA1

                                        4f01c591e37a7bc9030ee87107568109ffbc9b5f

                                        SHA256

                                        310303c2c469b871cb0078bd202798753ee745620da53d00598118575a0ef9ca

                                        SHA512

                                        a75fd8befb79562c307268163955c65c51a1bb91a555a94e648faa4cfe426e7606216cdacc0ccda1f027ef21a1fc4ac2ac061556412a40e5b8570e56084125e9

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        10KB

                                        MD5

                                        08c6b6ad26f551bf6213fbc60cb65424

                                        SHA1

                                        636a6fc67d5b055f99e09086d02336bf6a52502f

                                        SHA256

                                        1f44f661dd5dc6e87c9cb15179513bc18842a17944a9bd5e18556c5785aa5635

                                        SHA512

                                        ca2ad7fb939c7c200b444dccdd32968e75e34af8f89fab68d5a0c5e09fdc60a83fc0ad5a84867fd00f79050acca28a1e2744d23183e388814de861c14d9adda3

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                        Filesize

                                        2B

                                        MD5

                                        d751713988987e9331980363e24189ce

                                        SHA1

                                        97d170e1550eee4afc0af065b78cda302a97674c

                                        SHA256

                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                        SHA512

                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        1KB

                                        MD5

                                        553e0f5921685d134a38e5814610af7e

                                        SHA1

                                        2f2638a528143be6fcf9290f65612cadc456f6a5

                                        SHA256

                                        a34c847850bca0939a46fae376337906a5743bb3fbf9195624dfc90d8142f522

                                        SHA512

                                        cdabcb61ca63e5cd8a84a11dc6f4493c0e1ab1f51cfb17dbc0a6c13656ef29a3f45abbb160137ce626c02a017f1bffa50e3453a582d2a3a25cb0e299e4382b60

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        9KB

                                        MD5

                                        efcd7ed60d5d2a823e12549678342063

                                        SHA1

                                        385ae5d8777eef2e817d2cd97f4d029e95113040

                                        SHA256

                                        715a46b19d0bcf05f41d518e7c2602664ed347206d4462ec37fea0edc2058d4c

                                        SHA512

                                        f46e868352b59f83fedefaea1e847089426a85832996f7e4ab9c990a5188b4438e01fa52c8e02e33859db4a5f3c2a7c776a68044c96085f6b79f5f187b41de83

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        8KB

                                        MD5

                                        a36d97154235e2ccf3b7d22235bcd6ac

                                        SHA1

                                        8ef81cf3ae83d588c9a15fe2074a1c08e8e867f6

                                        SHA256

                                        72c4133a501b6dd611012a34772c3dcb2bcf923f8c66db109e297a29eb134481

                                        SHA512

                                        f810d127e18471bb4fdeab603c14c10aa5567d35699b2fa30b6cf32d94bf98cb516cbdef0816dae3fb6a41420804d835d0cf34792c637507514cb5a2ea32d4d1

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        9KB

                                        MD5

                                        dbdf59a4acb1581fc16bfd43d0b851bf

                                        SHA1

                                        4350a1ed145efbc33c840e13a1ebaf52f4247099

                                        SHA256

                                        f7090a0d89c034dd9cfa4187094f412267be502b2fef6d722c9b1c08fd8b4153

                                        SHA512

                                        063ea1e69447a9bb3283a8abeeb218c16b2061229c00c9c9b6eebd2fdbbf4f100fa8664d70af0d5e840d67a136d08d075e3da3b711da2382f278c7aed662eec0

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        9KB

                                        MD5

                                        422ec4d23ccae41b275dca93acff8e76

                                        SHA1

                                        bf9d061ba663a6267902e284bc2d7a90b12094f4

                                        SHA256

                                        76b3b22703545b779229552fe5449acc6077188ff3b54722a608f5d4d08932f4

                                        SHA512

                                        6a4dbab2b22969bb6de5cbb82d232dd44c8e5a41184a712cd9cdbdd88b347496ecc905e24ac38f41fb9031786c9111edfe32913d890cf17a6523a4eac1e6e5f9

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        9KB

                                        MD5

                                        93d52e6ee2b92a160e55ccc965fb1b6f

                                        SHA1

                                        837fdc440e3462ae2bc020c1b9203b416d5814b3

                                        SHA256

                                        ebe39662d6131e977e5e31c69b3da3891c0c24f6c2c49b62c8bfe69a5aee42c4

                                        SHA512

                                        7a990d4f72c1d1703423aad652913c8611ae4d7f756e43db4fdf32abde79389531b554f643ccb93fe83aa02b4ae15e23a6b3b137b3e26cb3a70fde3e5eb23ee2

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        9KB

                                        MD5

                                        e9da4e9e96464831d9ffe978164188ad

                                        SHA1

                                        513ca37e3bbd6701784c02a13101a55f3586a678

                                        SHA256

                                        694484ba477ffff63489b0f01c57e6053a5cf586f21fe27f72f3b500179ea24d

                                        SHA512

                                        a81c131519c3c8f90d4fb13f24f22c3d4594b669358c8c84542706a11954e540aa2301b493e16987f402ca7b2a5db762fccb3bbdd375f3bd708e573528da3008

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        9KB

                                        MD5

                                        73b0eb32123664074e67a214fe95933e

                                        SHA1

                                        2b844bf8d6a6cb03c46eacfd4f0b683f70dd2520

                                        SHA256

                                        9241ddfece3247d0f29d5bb7351ae7b93648a0bf026429885e8ea0a518112c3c

                                        SHA512

                                        8e233976f2c5f2c5c8a7736d5f8e38a55f567494a2611eb55557dc0bbda396def0515d22d48338eef4658b01f442ac0e9a53b95285fc177fabc2b42c19c62f0c

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        9KB

                                        MD5

                                        c13fe1ce5178b779e6c66105b96ed0ab

                                        SHA1

                                        6a8d4c9cce1db67274e974c6df94b2ea2246c540

                                        SHA256

                                        4d6f00be403a4435912fff88e6cc9df7e00e4e08efa0c3316ff18072a4b28dc4

                                        SHA512

                                        c4a026c602b408a2601d0a05d0240efe48f4774376a092fddc4f67d495bd140df1eddd80dd6b21e4b4dab1261d00079c0119e49f2b07fe4d49e06889dd49e4e5

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        92KB

                                        MD5

                                        9f078a35135323dd6bf89a187a0650d4

                                        SHA1

                                        2e260a13e7459f19ea51e2ca0f1913664957eeee

                                        SHA256

                                        26118bea874699f23b38fc834d5b5d67331b61386a83166103dc57c211497700

                                        SHA512

                                        f7c9eb737d601f68d9aa0eb8f5777b39c200254258f43fa68a85c5ee275bb7cdd3b2bbb6ba654bb68be82c8bf22049b6011a8a7f42a0dab6f2907933a407a1ad

                                      • \??\pipe\crashpad_388_GCIJBOXANBXRMBXY

                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                      • memory/2772-274-0x0000000000400000-0x0000000000456000-memory.dmp

                                        Filesize

                                        344KB

                                      • memory/2772-276-0x0000000000400000-0x0000000000456000-memory.dmp

                                        Filesize

                                        344KB

                                      • memory/2772-277-0x0000000000400000-0x0000000000456000-memory.dmp

                                        Filesize

                                        344KB

                                      • memory/2772-290-0x0000000000400000-0x0000000000456000-memory.dmp

                                        Filesize

                                        344KB

                                      • memory/3928-273-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                        Filesize

                                        4KB