Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
21/09/2024, 03:52
General
- Target tera14.zip
- Size 29.8MB
- Sample240921-efgnrstenh
- SHA256 6d8a4ad90fe9e228e39f576ed197f0b6461a8a8fb4329cd9fa006f2334de29c3
Malware Config
Extracted
-
lumma
-
https://ohhyhousedmxznw.shop/api
Signatures
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\tera14.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Documents\tera14\Set-up.exe"C:\Users\Admin\Documents\tera14\Set-up.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rzfc\ANHOKOIHKJDTDHIVJF\StrCmp.exeC:\Users\Admin\AppData\Roaming\rzfc\ANHOKOIHKJDTDHIVJF\StrCmp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Entangled.a3xC:\Users\Admin\AppData\Local\Temp\Entangled.a3x3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 12884⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 12564⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 13004⤵
- Program crash
-
-
-
-
C:\Users\Admin\Documents\tera14\Set-up.exe"C:\Users\Admin\Documents\tera14\Set-up.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Entangled.a3xC:\Users\Admin\AppData\Local\Temp\Entangled.a3x3⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 908 -ip 9081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 908 -ip 9081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 908 -ip 9081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7cc42c46
Entangled.a3x
cbb34747
StrCmp.exe
WebUI.dll
ehmbs
memory/832-23-0x00007FFA71690000-0x00007FFA71885000-memory.dmp
memory/832-33-0x0000000000400000-0x000000000061B000-memory.dmp
memory/832-22-0x0000000075D20000-0x00000000762D3000-memory.dmp
memory/832-31-0x0000000075D20000-0x00000000762D3000-memory.dmp
memory/908-43-0x0000000000800000-0x0000000000878000-memory.dmp
memory/908-44-0x00007FFA71690000-0x00007FFA71885000-memory.dmp
memory/908-47-0x0000000000800000-0x0000000000878000-memory.dmp
memory/1756-52-0x0000000000C90000-0x0000000000D08000-memory.dmp
memory/1756-53-0x00007FFA71690000-0x00007FFA71885000-memory.dmp
memory/1756-54-0x0000000000C90000-0x0000000000D08000-memory.dmp
memory/3588-15-0x0000000075D20000-0x00000000762D3000-memory.dmp
memory/3588-19-0x0000000000400000-0x000000000061B000-memory.dmp
memory/3588-16-0x0000000075D33000-0x0000000075D34000-memory.dmp
memory/3588-0-0x0000000075D20000-0x00000000762D3000-memory.dmp
memory/3588-12-0x0000000075D20000-0x00000000762D3000-memory.dmp
memory/3588-9-0x0000000075D20000-0x00000000762D3000-memory.dmp
memory/3588-7-0x0000000075D20000-0x00000000762D3000-memory.dmp
memory/3588-5-0x0000000075D33000-0x0000000075D34000-memory.dmp
memory/3588-1-0x00007FFA71690000-0x00007FFA71885000-memory.dmp
memory/4860-35-0x00007FFA71690000-0x00007FFA71885000-memory.dmp
memory/5024-30-0x00007FFA71690000-0x00007FFA71885000-memory.dmp
memory/5024-37-0x0000000075D20000-0x00000000762D3000-memory.dmp