Resubmissions

06-08-2024 11:22

240806-ng2vrs1hkf 10

06-08-2024 10:55

240806-m1enxaxdmk 7

06-08-2024 10:51

240806-mxymls1eje 3

06-08-2024 10:49

240806-mw4r8sxcnj 10

Analysis

  • max time kernel
    110s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-08-2024 10:49

General

  • Target

    Setup.exe

  • Size

    1.1MB

  • MD5

    c047ae13fc1e25bc494b17ca10aa179e

  • SHA1

    e293c7815c0eb8fbc44d60a3e9b27bd91b44b522

  • SHA256

    6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf

  • SHA512

    0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c

  • SSDEEP

    12288:a9hZPq27B7+x3dPC4gvgdVwTzDxsVyY4YoUwpf5kpRG6xsfJAYo2R0B5YD5sW91A:STS27B7+x3E4tdS/Dxkd4YoDfZ90gLS

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://erdefendkzov.shop/api

https://chippyfroggsyhz.shop/api

https://tenntysjuxmz.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Roaming\Httpta\QWGDXBWDXGLOLVQVHQ\StrCmp.exe
      C:\Users\Admin\AppData\Roaming\Httpta\QWGDXBWDXGLOLVQVHQ\StrCmp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2708
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Users\Admin\AppData\Local\Temp\Encounter.pif
        C:\Users\Admin\AppData\Local\Temp\Encounter.pif
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Encounter.pif

    Filesize

    29KB

    MD5

    d0509de5ba78cdfb67f897b06d9d184d

    SHA1

    f3ea9fa41831739d38353167754c0bb5a9544001

    SHA256

    a5a7183977808efbaa1ca3e55776f09bcae8f30e2aa5b0520c9cd88cd0d4997d

    SHA512

    0cdfb02946e8450a057db69f3e4331adc2b1bffee2d6002ea2a1ba8b9964883dd71c6f5becd41c02a4a06fd84e20836348b56af3696ae21587a774ec75d9f2c5

  • C:\Users\Admin\AppData\Local\Temp\c4133040

    Filesize

    1.2MB

    MD5

    e798e89491502a23dd6fa4b883fbdac3

    SHA1

    336db0cf5438e003100a466688c5d8bdc6625f31

    SHA256

    04467f190d53a02792d10425b883b7d45a807e9dce456656ed7a23217cb26820

    SHA512

    45676f30905f770900543003d9a18803282a7f3d122e0f4aa4f2fafecc9fd25b62d9025252a52f70090180dcfb71b05aed3c9cab7878ad08f5ca49864e1a6721

  • C:\Users\Admin\AppData\Roaming\Httpta\QWGDXBWDXGLOLVQVHQ\StrCmp.exe

    Filesize

    47KB

    MD5

    916d7425a559aaa77f640710a65f9182

    SHA1

    23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13

    SHA256

    118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35

    SHA512

    d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc

  • memory/1488-5-0x00007FFDF78D0000-0x00007FFDF78EC000-memory.dmp

    Filesize

    112KB

  • memory/1488-6-0x00007FFDF78E9000-0x00007FFDF78EA000-memory.dmp

    Filesize

    4KB

  • memory/1488-7-0x00007FFDF78D0000-0x00007FFDF78EC000-memory.dmp

    Filesize

    112KB

  • memory/1488-13-0x00007FFDF78D0000-0x00007FFDF78EC000-memory.dmp

    Filesize

    112KB

  • memory/1488-0-0x00007FFDF78D0000-0x00007FFDF78EC000-memory.dmp

    Filesize

    112KB

  • memory/4644-31-0x00000000009B0000-0x0000000000A1E000-memory.dmp

    Filesize

    440KB

  • memory/4644-26-0x0000000075820000-0x0000000075828000-memory.dmp

    Filesize

    32KB

  • memory/4644-30-0x00007FFDFDED0000-0x00007FFDFE0C5000-memory.dmp

    Filesize

    2.0MB

  • memory/4644-33-0x0000000075821000-0x0000000075828000-memory.dmp

    Filesize

    28KB

  • memory/4644-34-0x00000000009B0000-0x0000000000A1E000-memory.dmp

    Filesize

    440KB

  • memory/4644-35-0x0000000075820000-0x0000000075828000-memory.dmp

    Filesize

    32KB

  • memory/4644-37-0x00000000009B0000-0x0000000000A1E000-memory.dmp

    Filesize

    440KB

  • memory/5112-23-0x00000000758DE000-0x00000000758E0000-memory.dmp

    Filesize

    8KB

  • memory/5112-24-0x00000000758D0000-0x00000000758E4000-memory.dmp

    Filesize

    80KB

  • memory/5112-27-0x00000000758D0000-0x00000000758E4000-memory.dmp

    Filesize

    80KB

  • memory/5112-21-0x00000000758D0000-0x00000000758E4000-memory.dmp

    Filesize

    80KB

  • memory/5112-19-0x00007FFDFDED0000-0x00007FFDFE0C5000-memory.dmp

    Filesize

    2.0MB

  • memory/5112-36-0x00000000758DE000-0x00000000758E0000-memory.dmp

    Filesize

    8KB