Analysis
-
max time kernel
34s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 01:56
Static task
static1
Behavioral task
behavioral1
Sample
0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe
Resource
win7-20240705-en
General
-
Target
0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe
-
Size
127.6MB
-
MD5
61c04f7b7aa1d782cc08a3fda3421883
-
SHA1
9ff160e1364c3143a573d49bbc7edfc5f4ac500b
-
SHA256
0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4
-
SHA512
317d72ae0e113e107a04dbddb4f155ae8ee601daa6d4c22bcf3e249ef2ba242a6939aafe623429c235cb02577c76beff9cc41aa8d7ecaba5502b3b43ff409406
-
SSDEEP
12288:NSoR5kM0NRovC58AHgkOWkeQi4LNBoiZPm6J+FdgADD39h8Vl6L6pLQc6+dwkPFd:NSod0NRov4vgXX
Malware Config
Extracted
lumma
https://demandlinzei.shop/api
https://applyzxcksdia.shop/api
https://replacedoxcjzp.shop/api
https://declaredczxi.shop/api
https://catchddkxozvp.shop/api
https://arriveoxpzxo.shop/api
https://contemplateodszsv.shop/api
https://bindceasdiwozx.shop/api
https://conformfucdioz.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exepid Process 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exedescription pid Process procid_target PID 4508 set thread context of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87 -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exedescription pid Process procid_target PID 4508 wrote to memory of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87 PID 4508 wrote to memory of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87 PID 4508 wrote to memory of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87 PID 4508 wrote to memory of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87 PID 4508 wrote to memory of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87 PID 4508 wrote to memory of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87 PID 4508 wrote to memory of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87 PID 4508 wrote to memory of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87 PID 4508 wrote to memory of 1740 4508 0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe"C:\Users\Admin\AppData\Local\Temp\0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"2⤵PID:1740
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
437KB
MD5bb25a1b9cc4e7f73119c5d88501a3f42
SHA1a60d282ad86582e3a4a1aac56ec93fc6232bec21
SHA25694563140c985b4d77ccff4f39b9af9d882847100018b26e63032a529158b75d1
SHA5123ca098d3e3b50a4d6a70dc6e1197f3e7af5d1cbb2cf9c0fcc392e9db4a6de2e0616f29d995e825d35dd67cfebcb0caebcdfe9fd3a42456db88220a1500774974