Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    139s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/07/2024, 22:39

General

  • Target

    Setup.exe

  • Size

    17.0MB

  • MD5

    39b6666813ca7dec9a5badc3f260d61e

  • SHA1

    0225465060612c872b76d15a66d817692d5d3141

  • SHA256

    1dd1d95832125dfb8f2a472d5394f6d3943f55e1cd53de38b2e21335c22cb0f5

  • SHA512

    9852d4d3120fd23641104fa9e9fca936ff313c948e9d144343f32d6ba58897dec6dda8a49501e0d3a2363347aa5e6ea7e824f5c6f8ab68c3bb8af994cfbc52a5

  • SSDEEP

    98304:KOR0QzG1Fv+ysIhnQKzgGf4fo+jC9DSp/F1vjrWLeJH9BAx68xFnxS8R:KOwFnJUC9DSpNdy6V8xFnxTR

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://pallmusksopzm.shop/api

https://horizonvxjis.shop/api

https://effectivedoxzj.shop/api

https://parntorpkxzlp.shop/api

https://stimultaionsppzv.shop/api

https://grassytaisol.shop/api

https://broccoltisop.shop/api

https://shellfyyousdjz.shop/api

https://bravedreacisopm.shop/api

Extracted

Family

lumma

C2

https://pallmusksopzm.shop/api

https://horizonvxjis.shop/api

https://effectivedoxzj.shop/api

https://parntorpkxzlp.shop/api

https://stimultaionsppzv.shop/api

https://grassytaisol.shop/api

https://broccoltisop.shop/api

https://shellfyyousdjz.shop/api

https://bravedreacisopm.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:164
    • C:\Users\Admin\AppData\Roaming\Backup2\UOKRKZBVNNOVFOQC\StrCmp.exe
      C:\Users\Admin\AppData\Roaming\Backup2\UOKRKZBVNNOVFOQC\StrCmp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3864
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\SysWOW64\SearchIndexer.exe
        C:\Windows\SysWOW64\SearchIndexer.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2e6b5ae8

    Filesize

    1.3MB

    MD5

    fa3ee8ebf9cfa0e27c7b70146ae3bca4

    SHA1

    1692df2417689987b278eb696de6cd129ed9c023

    SHA256

    1c4a66d0abf09477f10ff7bd44b06e874f07caef6b040368ec44e25f54f22046

    SHA512

    1920272847a301033e1ecaf086954a006aea92188da8ff8183477da615c49ddb5c013873d119875bd3738c04d70ffe09575311ed58355d4ddd8accd7e24eb9d9

  • C:\Users\Admin\AppData\Local\Temp\3850de57

    Filesize

    1.1MB

    MD5

    512d9dfb85f108ec3f9e2b32b9a3e6d5

    SHA1

    48bab3cd9157a5d7267514dacb93514330750da8

    SHA256

    722ca45afe31d15f62e341497033c5bbd54fbe1b7ebfa22ce9d99c60c5af46fa

    SHA512

    94db753e491951ccb0b9613b083442d433db1944e8bdc718365e35874b29c324cc1f531d5c497448e806e25e3d7f99317dcd8b4b7bfc93e31c4774838c3145b9

  • C:\Users\Admin\AppData\Roaming\Backup2\UOKRKZBVNNOVFOQC\StrCmp.exe

    Filesize

    47KB

    MD5

    916d7425a559aaa77f640710a65f9182

    SHA1

    23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13

    SHA256

    118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35

    SHA512

    d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc

  • memory/164-17-0x00000000729B0000-0x0000000072B2B000-memory.dmp

    Filesize

    1.5MB

  • memory/164-12-0x00000000729B0000-0x0000000072B2B000-memory.dmp

    Filesize

    1.5MB

  • memory/164-9-0x00000000729B0000-0x0000000072B2B000-memory.dmp

    Filesize

    1.5MB

  • memory/164-10-0x00000000729C2000-0x00000000729C4000-memory.dmp

    Filesize

    8KB

  • memory/164-0-0x0000000000400000-0x00000000007B2000-memory.dmp

    Filesize

    3.7MB

  • memory/164-6-0x00000000729B0000-0x0000000072B2B000-memory.dmp

    Filesize

    1.5MB

  • memory/164-7-0x00007FF8E6570000-0x00007FF8E674B000-memory.dmp

    Filesize

    1.9MB

  • memory/592-27-0x00007FF8E6570000-0x00007FF8E674B000-memory.dmp

    Filesize

    1.9MB

  • memory/592-29-0x0000000000CF0000-0x0000000000D5D000-memory.dmp

    Filesize

    436KB

  • memory/592-28-0x0000000000CF0000-0x0000000000D5D000-memory.dmp

    Filesize

    436KB

  • memory/2284-21-0x00000000729B0000-0x0000000072B2B000-memory.dmp

    Filesize

    1.5MB

  • memory/2284-26-0x00000000729B0000-0x0000000072B2B000-memory.dmp

    Filesize

    1.5MB

  • memory/2284-24-0x00000000729B0000-0x0000000072B2B000-memory.dmp

    Filesize

    1.5MB

  • memory/2284-23-0x00000000729B0000-0x0000000072B2B000-memory.dmp

    Filesize

    1.5MB

  • memory/2284-22-0x00007FF8E6570000-0x00007FF8E674B000-memory.dmp

    Filesize

    1.9MB