Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2024 15:13

General

  • Target

    decrypted.exe

  • Size

    11.7MB

  • MD5

    53ce8ea949f61a9b11651c8eafecff76

  • SHA1

    5cb51086968929125d0615739c380ff142e6ff55

  • SHA256

    58e38db883597286180f4a5bb97386c6b8c5c400a8b1ca7254f3da7ef40acf9c

  • SHA512

    e43d409f65c8e0cda692e3c1d2e1cf221b8995de9aef84b0c1429459c7c4a27979a8ce2aba7f89557db6ab2d78a1f37b26c99a7f90636e7e606c49c6a3715c73

  • SSDEEP

    196608:g0hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhv:gXsJYxjo42bIImyaBFmY4ceu+C+n

Malware Config

Extracted

Family

lumma

C2

https://professitonwqu.shop/api

https://mobbipenju.store/api

https://eaglepawnoy.store/api

https://dissapoiznw.store/api

https://studennotediw.store/api

https://bathdoomgaz.store/api

https://spirittunek.store/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 7 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\decrypted.exe
    "C:\Users\Admin\AppData\Local\Temp\decrypted.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Users\Admin\AppData\Local\Temp\is-TGBTE.tmp\decrypted.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TGBTE.tmp\decrypted.tmp" /SL5="$4010A,11050682,1125376,C:\Users\Admin\AppData\Local\Temp\decrypted.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Users\Admin\AppData\Local\Temp\decrypted.exe
        "C:\Users\Admin\AppData\Local\Temp\decrypted.exe" /VERYSILENT /NORESTART
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Users\Admin\AppData\Local\Temp\is-JGTRM.tmp\decrypted.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-JGTRM.tmp\decrypted.tmp" /SL5="$70122,11050682,1125376,C:\Users\Admin\AppData\Local\Temp\decrypted.exe" /VERYSILENT /NORESTART
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\system32\cmd.exe
            "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1652
            • C:\Windows\system32\tasklist.exe
              tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
              6⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2372
            • C:\Windows\system32\find.exe
              find /I "wrsa.exe"
              6⤵
                PID:1076
            • C:\Windows\system32\cmd.exe
              "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2672
              • C:\Windows\system32\tasklist.exe
                tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
                6⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:2936
              • C:\Windows\system32\find.exe
                find /I "opssvc.exe"
                6⤵
                  PID:1792
              • C:\Windows\system32\cmd.exe
                "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:832
                • C:\Windows\system32\tasklist.exe
                  tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
                  6⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2780
                • C:\Windows\system32\find.exe
                  find /I "avastui.exe"
                  6⤵
                    PID:1496
                • C:\Windows\system32\cmd.exe
                  "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2932
                  • C:\Windows\system32\tasklist.exe
                    tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
                    6⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2700
                  • C:\Windows\system32\find.exe
                    find /I "avgui.exe"
                    6⤵
                      PID:956
                  • C:\Windows\system32\cmd.exe
                    "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:580
                    • C:\Windows\system32\tasklist.exe
                      tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
                      6⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2404
                    • C:\Windows\system32\find.exe
                      find /I "nswscsvc.exe"
                      6⤵
                        PID:620
                    • C:\Windows\system32\cmd.exe
                      "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
                      5⤵
                        PID:1488
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
                          6⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1644
                        • C:\Windows\system32\find.exe
                          find /I "sophoshealth.exe"
                          6⤵
                            PID:1576
                        • C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe
                          "C:\Users\Admin\AppData\Local\fragaria\\AutoIt3.exe" "C:\Users\Admin\AppData\Local\fragaria\\VSIXConfigurationUpdater1.a3x"
                          5⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2692
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && AutoIt3.exe C:\ProgramData\\Y0fR5wVEk.a3x && del C:\ProgramData\\Y0fR5wVEk.a3x
                            6⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:1820
                            • C:\Windows\SysWOW64\PING.EXE
                              ping -n 5 127.0.0.1
                              7⤵
                              • System Location Discovery: System Language Discovery
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:2156
                            • C:\Users\Admin\AppData\Local\fragaria\AutoIt3.exe
                              AutoIt3.exe C:\ProgramData\\Y0fR5wVEk.a3x
                              7⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              PID:3008
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                8⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of SetWindowsHookEx
                                PID:1868
                                • C:\Users\Admin\AppData\Local\Temp\tmp4FB9.tmp.exe
                                  "C:\Users\Admin\AppData\Local\Temp\tmp4FB9.tmp.exe"
                                  9⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Modifies system certificate store
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2856

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\Cab8789.tmp

                  Filesize

                  70KB

                  MD5

                  49aebf8cbd62d92ac215b2923fb1b9f5

                  SHA1

                  1723be06719828dda65ad804298d0431f6aff976

                  SHA256

                  b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                  SHA512

                  bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                • C:\Users\Admin\AppData\Local\Temp\Tar87AC.tmp

                  Filesize

                  181KB

                  MD5

                  4ea6026cf93ec6338144661bf1202cd1

                  SHA1

                  a1dec9044f750ad887935a01430bf49322fbdcb7

                  SHA256

                  8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                  SHA512

                  6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                • C:\Users\Admin\AppData\Local\Temp\tmpF884.tmp

                  Filesize

                  20KB

                  MD5

                  c9ff7748d8fcef4cf84a5501e996a641

                  SHA1

                  02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

                  SHA256

                  4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

                  SHA512

                  d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

                • C:\Users\Admin\AppData\Local\fragaria\VSIXConfigurationUpdater.wav

                  Filesize

                  939KB

                  MD5

                  c25a5d1ff98e3558b128797de0f7ede8

                  SHA1

                  e6b742ba4fa0836f16b135ab530391ea52e7a83c

                  SHA256

                  7344920e5ee6ff4f75013be233fea20b872bd4d9adcf0434eaeebcba79099819

                  SHA512

                  f515507befee96cf2f86db0db2c8dda831063900729e0449df0f32a88c76c7752ee364d5d1e072175b5a9eccd6f54f72e5c08656b5bf8d711a414ceda91aa5c0

                • C:\Users\Admin\AppData\Local\fragaria\VSIXConfigurationUpdater1.a3x

                  Filesize

                  60KB

                  MD5

                  292aad866f9decedfdb2b3126fab6061

                  SHA1

                  ea5273f207b22196dbed7e1ddc691ce4418a6d87

                  SHA256

                  5da1f6349763ccbf7ada3167e0a8e1eeeb158c6cdd0b2aee8f9278812be0d59b

                  SHA512

                  750573570f029858d689836c8ec7e49f9e3646783adeb34597a7cfd6411a86b2aa060626e7ed9d97ec7dac15d295b36ed03225fdd4238aad59cf2851c91a0119

                • \Users\Admin\AppData\Local\Temp\is-A0RA6.tmp\_isetup\_iscrypt.dll

                  Filesize

                  2KB

                  MD5

                  a69559718ab506675e907fe49deb71e9

                  SHA1

                  bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                  SHA256

                  2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                  SHA512

                  e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                • \Users\Admin\AppData\Local\Temp\is-TGBTE.tmp\decrypted.tmp

                  Filesize

                  3.4MB

                  MD5

                  edf47d593acf0e39438d621e8357ad34

                  SHA1

                  5732a17515b0112ce47637393043a1a2e4836218

                  SHA256

                  5f0f2e763c33ef0d3bb30041927a39191a257b533e16f1f89bf2939d669c9412

                  SHA512

                  8f49244aa4d4ba31ecef404b9f42b7e9798951a8065dea3699e10464ab676f72227c3084e51c7c256e385605cfa95a35bd88fff01477ecf426153ffcf2f9994f

                • \Users\Admin\AppData\Local\Temp\tmp4FB9.tmp.exe

                  Filesize

                  5.1MB

                  MD5

                  40ec60bf0761652fc0f5cc888128acff

                  SHA1

                  1fde0d7c443e47efbcd26135b8bdf961bec46a89

                  SHA256

                  0d7341486b8814c8de2dd5660308e103f293d707da933289ca709ce0be39507e

                  SHA512

                  7a863d1322947c0781ea839a918ac018d34545a75d2eb61612cea3aadf43f2221d8e993bc0f2a0c8b8f4f5250245142ca9a61d2573a305ea21a38b01e692ef85

                • \Users\Admin\AppData\Local\fragaria\AutoIt3.exe

                  Filesize

                  921KB

                  MD5

                  3f58a517f1f4796225137e7659ad2adb

                  SHA1

                  e264ba0e9987b0ad0812e5dd4dd3075531cfe269

                  SHA256

                  1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48

                  SHA512

                  acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

                • memory/1164-179-0x0000000000920000-0x0000000000CA0000-memory.dmp

                  Filesize

                  3.5MB

                • memory/1844-8-0x0000000000100000-0x0000000000101000-memory.dmp

                  Filesize

                  4KB

                • memory/1844-17-0x0000000000950000-0x0000000000CD0000-memory.dmp

                  Filesize

                  3.5MB

                • memory/1868-193-0x0000000000400000-0x00000000004C6000-memory.dmp

                  Filesize

                  792KB

                • memory/1868-192-0x0000000000400000-0x00000000004C6000-memory.dmp

                  Filesize

                  792KB

                • memory/1868-194-0x0000000000400000-0x00000000004C6000-memory.dmp

                  Filesize

                  792KB

                • memory/1960-182-0x0000000000880000-0x00000000009A1000-memory.dmp

                  Filesize

                  1.1MB

                • memory/1960-15-0x0000000000880000-0x00000000009A1000-memory.dmp

                  Filesize

                  1.1MB

                • memory/2168-0-0x0000000000880000-0x00000000009A1000-memory.dmp

                  Filesize

                  1.1MB

                • memory/2168-28-0x0000000000880000-0x00000000009A1000-memory.dmp

                  Filesize

                  1.1MB

                • memory/2168-2-0x0000000000881000-0x0000000000929000-memory.dmp

                  Filesize

                  672KB

                • memory/2856-216-0x0000000000930000-0x000000000098E000-memory.dmp

                  Filesize

                  376KB

                • memory/2856-228-0x0000000000400000-0x0000000000922000-memory.dmp

                  Filesize

                  5.1MB