Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 23:44
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240708-en
4 signatures
150 seconds
General
-
Target
Setup.exe
-
Size
277KB
-
MD5
4e86daaa61c7d8709cc696921f8b98e9
-
SHA1
0b17183cd1b0c883398ab435a95de12fe51a512e
-
SHA256
23cfec6448915ea72e1641a9c36fa44cffc5accd8c731cc4ebb600a0ca643dbf
-
SHA512
ad5cfe045b0f9a800c23236a30614aa7af3b619e7b1ef782f46ff947c963bb4362bbc7b9fdb714b3f351de40815e335175439cda01e718713c61ce55f3ca90d5
-
SSDEEP
6144:mzgv9Yiq0Si+Jfwwhllf8BGLfTEgaq7+qlApkBuJtB7cEO:lWt0Si+VwYllf8BGrTnaOMQAB7cEO
Malware Config
Extracted
Family
lumma
C2
https://torubleeodsmzo.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2776 set thread context of 2720 2776 Setup.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30 PID 2776 wrote to memory of 2720 2776 Setup.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2720
-