Analysis
-
max time kernel
42s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 02:29
Static task
static1
Behavioral task
behavioral1
Sample
e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe
Resource
win7-20240704-en
General
-
Target
e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe
-
Size
530KB
-
MD5
d59d4742cfc842fea1de5b31fb1adad0
-
SHA1
8cae96e3deebc00c67f15823f7252c848933c667
-
SHA256
e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173
-
SHA512
fbb74e71df4dca13f0b22bb106b17bddc762ded21177576bbea0cb1e5bfc1f016f045ad6e64a949ccbccfe6dcfdfadb249cd7be7e06e91fed69ca33d9c2982c6
-
SSDEEP
12288:6RyWcpG0Sv9+Xyy7bhFAWnPalObkH+LFW/V3kR:6+pG06APLPdYH+BW/Fk
Malware Config
Extracted
lumma
https://stationacutwo.shop/api
https://bouncedgowp.shop/api
https://bannngwko.shop/api
https://bargainnykwo.shop/api
https://affecthorsedpo.shop/api
https://radiationnopp.shop/api
https://answerrsdo.shop/api
https://publicitttyps.shop/api
https://benchillppwo.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exedescription pid Process procid_target PID 1160 set thread context of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exedescription pid Process procid_target PID 1160 wrote to memory of 3656 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 86 PID 1160 wrote to memory of 3656 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 86 PID 1160 wrote to memory of 3656 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 86 PID 1160 wrote to memory of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87 PID 1160 wrote to memory of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87 PID 1160 wrote to memory of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87 PID 1160 wrote to memory of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87 PID 1160 wrote to memory of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87 PID 1160 wrote to memory of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87 PID 1160 wrote to memory of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87 PID 1160 wrote to memory of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87 PID 1160 wrote to memory of 456 1160 e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe"C:\Users\Admin\AppData\Local\Temp\e7039dbcbc18ba77e6c3121f6373546656ca98cdcc543787c31adac728280173.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3656
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:456
-