Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 02:55
Static task
static1
Behavioral task
behavioral1
Sample
c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe
Resource
win7-20240705-en
General
-
Target
c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe
-
Size
8.6MB
-
MD5
0e9459f87d4d72ca3f3fb54af7432de9
-
SHA1
8941d42eb6f891aca9652cb3cbcdefc547a0ee1c
-
SHA256
c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44
-
SHA512
4b646775910d27e0c8b410a0e7e8b5b05f63839a6c26ee25952a27740688db4029916a6fb88e70accfab239f5eab532ae169f7146cdb093f826162b46689c728
-
SSDEEP
49152:4kmANd/Zz39voeJAg/Bst+YhOQz4W3FlFPyHF80WBh5OIm/tJe34jcH5EGgMLhZk:Uoh3FJBWz4W1lFbBnPE6wUa7nPF
Malware Config
Extracted
lumma
https://stationacutwo.shop/api
https://bouncedgowp.shop/api
https://bannngwko.shop/api
https://bargainnykwo.shop/api
https://affecthorsedpo.shop/api
https://radiationnopp.shop/api
https://answerrsdo.shop/api
https://publicitttyps.shop/api
https://benchillppwo.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exedescription pid Process procid_target PID 1544 set thread context of 760 1544 c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe 86 -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exedescription pid Process procid_target PID 1544 wrote to memory of 760 1544 c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe 86 PID 1544 wrote to memory of 760 1544 c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe 86 PID 1544 wrote to memory of 760 1544 c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe 86 PID 1544 wrote to memory of 760 1544 c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe 86 PID 1544 wrote to memory of 760 1544 c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe"C:\Users\Admin\AppData\Local\Temp\c4452b42ae44c837bb125fa539edfd57241aff7f40c63365ff4cde0d9a823f44.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵PID:760
-