Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 04:49

General

  • Target

    Larsson.exe

  • Size

    351KB

  • MD5

    09be66bbb52f8af439e8745d8f872cb6

  • SHA1

    64038d25166fafdc9386fb5e88a4097b481c8204

  • SHA256

    2e49a28f4a1d94d6d7cfd31e54bde4bebf4abb48d048f69fe241ec1502b40943

  • SHA512

    aab694646234c08606387d5210de241bc5bb7c4ae0fafbb776de696464f19ff9b80f159f5329b2c5dcb4b2a6f3352c9a67dc56fdf2333962ecd82ae6bf16301f

  • SSDEEP

    6144:9wcDxEzhXVwYx8I6V+MHzA6mlyoyK0LSvKXMVPMa+Y5hhw:9wXzhFwYd6C6mlyBK0LcK8V0axn

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://turkeyunlikelyofw.shop/api

https://wisemassiveharmonious.shop/api

https://colorfulequalugliess.shop/api

https://relevantvoicelesskw.shop/api

https://detectordiscusser.shop/api

https://associationokeo.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Larsson.exe
    "C:\Users\Admin\AppData\Local\Temp\Larsson.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 256
        3⤵
        • Program crash
        PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1448-12-0x0000000002670000-0x0000000004670000-memory.dmp

    Filesize

    32.0MB

  • memory/1448-1-0x0000000001210000-0x000000000126E000-memory.dmp

    Filesize

    376KB

  • memory/1448-15-0x0000000074310000-0x00000000749FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1448-0-0x000000007431E000-0x000000007431F000-memory.dmp

    Filesize

    4KB

  • memory/2864-14-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/2864-16-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/2864-4-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/2864-5-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/2864-11-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/2864-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2864-8-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/2864-7-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/2864-6-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB