Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-10-2024 02:29

General

  • Target

    e87d959e9c41f1e49f73d74442df2421f7b8ff121631f18509e0476273f3b97b.exe

  • Size

    580KB

  • MD5

    08111bef3ab8fbae5493a1c03502cb61

  • SHA1

    5022d59e2ee31a6e88ff093e94e4709897a6b53a

  • SHA256

    e87d959e9c41f1e49f73d74442df2421f7b8ff121631f18509e0476273f3b97b

  • SHA512

    c875262e2bb6c9dd671c7a3ab08170ca02ca40191a9f41f730c41c2be3efa58179c4335eecfbd733bd34f004cbff23d746684ed97af2a04995b7931c95cd2537

  • SSDEEP

    12288:7goEhvQ9zc3c+IE5zkuzwlI8fH4pR0CO8SANRz5AYx4SDEO:7+vQz+NkO8fH8bSArzqpMt

Malware Config

Extracted

Family

vidar

C2

http://lade.petperfectcare.com:80

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

lumma

Signatures

  • Detect Vidar Stealer 17 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e87d959e9c41f1e49f73d74442df2421f7b8ff121631f18509e0476273f3b97b.exe
    "C:\Users\Admin\AppData\Local\Temp\e87d959e9c41f1e49f73d74442df2421f7b8ff121631f18509e0476273f3b97b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
        PID:216
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        2⤵
          PID:2036
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          2⤵
            PID:4156
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            2⤵
              PID:2992
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1868
              • C:\ProgramData\IJDHCBGHJE.exe
                "C:\ProgramData\IJDHCBGHJE.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4656
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  4⤵
                    PID:4500
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:3360
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 280
                    4⤵
                    • Program crash
                    PID:2560
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IECBAFCAAKJD" & exit
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:864
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 10
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:4744
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 296
                2⤵
                • Program crash
                PID:2412
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4884 -ip 4884
              1⤵
                PID:3380
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4656 -ip 4656
                1⤵
                  PID:1752

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\IJDHCBGHJE.exe

                  Filesize

                  538KB

                  MD5

                  dacd4b31325975471833abb8657d732f

                  SHA1

                  6e383ec6569894c748bfc948652f2e5694a1989c

                  SHA256

                  84f9830b538a6dc944b35532e5d326a246b0ba8861ec6e19bea213dd71372f2b

                  SHA512

                  14a1be7aed57f4183f10f769b453b5928deea5c1d0697f4ceb3e29ac11fdf307238e24880379fc9747ee74f6f63298a4aad2f285d323287c5951f50cfe96b126

                • C:\ProgramData\mozglue.dll

                  Filesize

                  593KB

                  MD5

                  c8fd9be83bc728cc04beffafc2907fe9

                  SHA1

                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                  SHA256

                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                  SHA512

                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                • C:\ProgramData\nss3.dll

                  Filesize

                  2.0MB

                  MD5

                  1cc453cdf74f31e4d913ff9c10acdde2

                  SHA1

                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                  SHA256

                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                  SHA512

                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                • memory/1868-45-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-3-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-8-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-10-0x000000001FB50000-0x000000001FDAF000-memory.dmp

                  Filesize

                  2.4MB

                • memory/1868-18-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-19-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-27-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-28-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-44-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-102-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-4-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-7-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-73-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-74-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-81-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-82-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-83-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/1868-1-0x0000000000400000-0x0000000000676000-memory.dmp

                  Filesize

                  2.5MB

                • memory/3360-98-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/3360-101-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/3360-100-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/4656-97-0x0000000000CF5000-0x0000000000CF6000-memory.dmp

                  Filesize

                  4KB

                • memory/4884-0-0x000000000044D000-0x000000000044F000-memory.dmp

                  Filesize

                  8KB