Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 03:01
Static task
static1
Behavioral task
behavioral1
Sample
d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe
Resource
win7-20240705-en
General
-
Target
d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe
-
Size
9.1MB
-
MD5
c3a8a0fd943924bfbd176c99df56ed2c
-
SHA1
8bc8d69cbec44704f062c08a919da992a425c720
-
SHA256
d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6
-
SHA512
71edb53cbf8d52d79615d5db834430870d6764ddcca4d8cf61d5fc4ddf404b259a974eb90944028ff20153561aa8b9fcc3374ae9badc6f6ac6b6d30150444f41
-
SSDEEP
49152:W6apzy+VptPhfIO7G+mHaw5u+8FyvgA8/F4tY8VclZEAJj8s/HXXjP5bsJTxjc5J:CJRnt9IgnDsvg6i3FvEen/m+ATZ
Malware Config
Extracted
lumma
https://respectabledpcs.shop/api
https://bouncedgowp.shop/api
https://bannngwko.shop/api
https://bargainnykwo.shop/api
https://affecthorsedpo.shop/api
https://radiationnopp.shop/api
https://answerrsdo.shop/api
https://publicitttyps.shop/api
https://benchillppwo.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exedescription pid Process procid_target PID 4000 set thread context of 1152 4000 d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe 86 -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exedescription pid Process procid_target PID 4000 wrote to memory of 1152 4000 d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe 86 PID 4000 wrote to memory of 1152 4000 d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe 86 PID 4000 wrote to memory of 1152 4000 d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe 86 PID 4000 wrote to memory of 1152 4000 d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe 86 PID 4000 wrote to memory of 1152 4000 d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe"C:\Users\Admin\AppData\Local\Temp\d1556baf48f206639e69f0e800e3360aa362f267c1c30b724140b6c713648df6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵PID:1152
-