Resubmissions

17-09-2024 11:12

240917-navg4szenq 3

17-09-2024 11:09

240917-m9bcvazclb 3

17-09-2024 11:07

240917-m79gvszbqc 10

Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 11:07

General

  • Target

    Setup.exe

  • Size

    80KB

  • MD5

    2a8613b7d99903516b8fe02fd820bf52

  • SHA1

    78a96addcb556ab1d490fac80f929305263d06b9

  • SHA256

    f1d68c5e7c7660d4f2ce412c109b7fe3e088872fa0ebe61ca9ab9dd92a496407

  • SHA512

    af0902aeb6169ea507b787da7b61c3533df4610c3f51c1d8f65dfc9008c8ce2580f2d86a49a4d0acc2c51c731f3e4c447d0d1d8e779dc1c75e43d30b79c46436

  • SSDEEP

    1536:9A8oAY5SXfidLez+Q+EGfdUHLLXJ+CqoVpPBucQwk7qnKXKo5OMY8xk03ben8TK:M7Ohz+Q+EGlUHLLXJ+CqoTPBucQwktXS

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://dumpliportiwo.shop/api

https://keennylrwmqlw.shop/api

https://licenseodqwmqn.shop/api

https://tendencctywop.shop/api

https://tesecuuweqo.shop/api

https://relaxatinownio.shop/api

https://reggwardssdqw.shop/api

https://eemmbryequo.shop/api

https://tryyudjasudqo.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Roaming\EDW\ZRVVBPCDSWKMAHZOMK\StrCmp.exe
      C:\Users\Admin\AppData\Roaming\EDW\ZRVVBPCDSWKMAHZOMK\StrCmp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:552
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Program Files\Google\Chrome\Application\updater.exe
        "C:\Program Files\Google\Chrome\Application\updater.exe"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Google\Chrome\Application\updater.exe

    Filesize

    994KB

    MD5

    de0ea31558536ca7e3164c3cd4578bf5

    SHA1

    5cc890c3ade653bb1ed1e53dabb0410602ee52df

    SHA256

    6e599490e164505af796569dce30e18218b179b2b791fe69764892b3ed3e7478

    SHA512

    c47299cd5f3b4961f423c2ca1fef5a33eb4b0f63dc232af70ef9da39f6f82270406061dd543461de7e47abd1244e26d6190de6035120211b27d4c23f97a25aba

  • C:\Users\Admin\AppData\Local\Temp\4de7ffb8

    Filesize

    2.1MB

    MD5

    7514588e0a6b92d7e27d7ce757a49710

    SHA1

    28440dc824c40f85860b24c8352f3e39307d2bec

    SHA256

    051e8be64329b6b8aa9cc0684b6f705a3f9d245b8d46786caf57ca393ec164c5

    SHA512

    57a374b1c11f87c70ad700e0edb981b31239a46598d34315ae736cc663242b7c0d7f52144ed3e12813003697252d4bbd1ed4a29afe723ca3405e499e36a505dd

  • C:\Users\Admin\AppData\Roaming\EDW\ZRVVBPCDSWKMAHZOMK\StrCmp.exe

    Filesize

    47KB

    MD5

    916d7425a559aaa77f640710a65f9182

    SHA1

    23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13

    SHA256

    118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35

    SHA512

    d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc

  • memory/2372-38-0x0000000000C30000-0x0000000000CA1000-memory.dmp

    Filesize

    452KB

  • memory/2372-36-0x00007FFCE8710000-0x00007FFCE8905000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-21-0x0000000072E53000-0x0000000072E54000-memory.dmp

    Filesize

    4KB

  • memory/3048-17-0x0000000072E40000-0x0000000072FBB000-memory.dmp

    Filesize

    1.5MB

  • memory/3048-20-0x0000000072E40000-0x0000000072FBB000-memory.dmp

    Filesize

    1.5MB

  • memory/3048-0-0x0000000072E40000-0x0000000072FBB000-memory.dmp

    Filesize

    1.5MB

  • memory/3048-14-0x0000000072E40000-0x0000000072FBB000-memory.dmp

    Filesize

    1.5MB

  • memory/3048-12-0x0000000072E40000-0x0000000072FBB000-memory.dmp

    Filesize

    1.5MB

  • memory/3048-10-0x0000000072E53000-0x0000000072E54000-memory.dmp

    Filesize

    4KB

  • memory/3048-1-0x00007FFCE8710000-0x00007FFCE8905000-memory.dmp

    Filesize

    2.0MB

  • memory/4956-24-0x0000000072E40000-0x0000000072FBB000-memory.dmp

    Filesize

    1.5MB

  • memory/4956-26-0x00007FFCE8710000-0x00007FFCE8905000-memory.dmp

    Filesize

    2.0MB

  • memory/4956-28-0x0000000072E40000-0x0000000072FBB000-memory.dmp

    Filesize

    1.5MB

  • memory/4956-29-0x0000000072E40000-0x0000000072FBB000-memory.dmp

    Filesize

    1.5MB

  • memory/4956-34-0x0000000072E40000-0x0000000072FBB000-memory.dmp

    Filesize

    1.5MB