Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 20:50
Static task
static1
Behavioral task
behavioral1
Sample
injectorV2.4.exe
Resource
win7-20240705-en
General
-
Target
injectorV2.4.exe
-
Size
495KB
-
MD5
cc50342a5e8ec23330b0864fb94ea4e7
-
SHA1
d029c92b6fb6dc38a4cdd35554ca0b7e1b8f8123
-
SHA256
f0af63b4468d4369d5abd59fba594685f424a136332b358bfac9b76ea201be6a
-
SHA512
161e80e888aad08b2ba02c0fe7fa68856387e17942514daf5bde70190ef5567c995cca38936f0b18691af95f8c30bb9f4f4568a344ded7d10650a5db6054054d
-
SSDEEP
12288:9azuzEtDcRUKgz4IHgR95DO5pkMPLgoQB2Rtv5hS:9VzEC64IHo9VkNgVBGX
Malware Config
Extracted
lumma
https://demandlinzei.shop/api
https://applyzxcksdia.shop/api
https://replacedoxcjzp.shop/api
https://declaredczxi.shop/api
https://catchddkxozvp.shop/api
https://arriveoxpzxo.shop/api
https://contemplateodszsv.shop/api
https://bindceasdiwozx.shop/api
https://conformfucdioz.shop/api
Extracted
lumma
https://tenntysjuxmz.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1960 set thread context of 800 1960 injectorV2.4.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injectorV2.4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2008 1960 injectorV2.4.exe 87 PID 1960 wrote to memory of 2008 1960 injectorV2.4.exe 87 PID 1960 wrote to memory of 2008 1960 injectorV2.4.exe 87 PID 1960 wrote to memory of 800 1960 injectorV2.4.exe 88 PID 1960 wrote to memory of 800 1960 injectorV2.4.exe 88 PID 1960 wrote to memory of 800 1960 injectorV2.4.exe 88 PID 1960 wrote to memory of 800 1960 injectorV2.4.exe 88 PID 1960 wrote to memory of 800 1960 injectorV2.4.exe 88 PID 1960 wrote to memory of 800 1960 injectorV2.4.exe 88 PID 1960 wrote to memory of 800 1960 injectorV2.4.exe 88 PID 1960 wrote to memory of 800 1960 injectorV2.4.exe 88 PID 1960 wrote to memory of 800 1960 injectorV2.4.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\injectorV2.4.exe"C:\Users\Admin\AppData\Local\Temp\injectorV2.4.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2008
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:800
-