Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2024 03:12

General

  • Target

    WaveInstaller.exe

  • Size

    629KB

  • MD5

    535de7c69bf1dcb0da75019378d1013c

  • SHA1

    86431b08e2aa7d894b24b63d79c7a0528c4aafe9

  • SHA256

    3a8885e171cf29f974602ae3bd8b6af640977748b131c3aaa317712884c46b4c

  • SHA512

    7ca6f5689fc298ea94eef82f7b21a0c51ed6d74cf5dd0d7fc3a042ed9c421f1002dd2fbeea09ff199b9d2c932d4d54d43b4b885a57107383ac090d6001ec0086

  • SSDEEP

    12288:qbhEv/GoncquZUEn4scjlgW9AbOFQZxuZwgOIU+At0++xs06MS6Vo1dAu/FPbACe:qbh8fcqTy45lgb

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://bitchsafettyudjwu.shop/api

https://bouncedgowp.shop/api

https://bannngwko.shop/api

https://bargainnykwo.shop/api

https://affecthorsedpo.shop/api

https://radiationnopp.shop/api

https://answerrsdo.shop/api

https://publicitttyps.shop/api

https://benchillppwo.shop/api

https://reinforcedirectorywd.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      2⤵
        PID:1516

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\d3d9.dll

      Filesize

      448KB

      MD5

      c01368e41af011545cca4b8f3f59a46a

      SHA1

      b5009a2442141707ac2cabbf19bd9835edfb5888

      SHA256

      b8fb3e8a2714129132235bec00d968a2ef8ea27b529d365bfe707418a8135914

      SHA512

      4960b0fe4b8b5746bfb99fb6f2ba0b7e4dc83eb93eca5c3a87c39d3f9f56f5e1fcb3a039f19a995e1effb6a1e39f9c440c31cbc864fc83f6ef04154ec48d7c83

    • memory/1516-12-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/1516-15-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/1516-9-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/4524-0-0x000000007449E000-0x000000007449F000-memory.dmp

      Filesize

      4KB

    • memory/4524-1-0x0000000000910000-0x00000000009B6000-memory.dmp

      Filesize

      664KB

    • memory/4524-2-0x0000000002D70000-0x0000000002D76000-memory.dmp

      Filesize

      24KB

    • memory/4524-14-0x0000000076F31000-0x0000000077051000-memory.dmp

      Filesize

      1.1MB

    • memory/4524-13-0x0000000074490000-0x0000000074C40000-memory.dmp

      Filesize

      7.7MB

    • memory/4524-16-0x0000000074490000-0x0000000074C40000-memory.dmp

      Filesize

      7.7MB