Analysis

  • max time kernel
    52s
  • max time network
    54s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/10/2024, 08:17

General

  • Target

    ♡☞Satup#.rar

  • Size

    13.9MB

  • MD5

    5689633947ce68a9441cfa84d6eb5532

  • SHA1

    0c709b7cf753a35d34ab78271d681488ab977ce4

  • SHA256

    ebb0f6f813ac2adbae62bb646656a190523504505fe1f18acee25593300e38b9

  • SHA512

    2d439c6be3c96d0a64ec77e20601736620bf17aa00b58cc0d885274cc716f6650fba1fe958a298cfc34d93d20f8ff0408aa227a46949d51c284ac6eda1765832

  • SSDEEP

    393216:zyN6rForKUzpotvj2rTbcXHt+a0OhE2sp0xvxUBqlTU83:emqzOb2rTkt+D2sOUBs4E

Malware Config

Extracted

Family

lumma

C2

https://snailyeductyi.sbs

https://ferrycheatyk.sbs

https://deepymouthi.sbs

https://wrigglesight.sbs

https://captaitwik.sbs

https://sidercotay.sbs

https://heroicmint.sbs

https://monstourtu.sbs

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 20 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\♡☞Satup#.rar"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5728
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:984
    • C:\Users\Admin\Desktop\♡☞Satup#\Setup.exe
      "C:\Users\Admin\Desktop\♡☞Satup#\Setup.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:5164
      • C:\Users\Admin\AppData\Roaming\Ebx\DNUAIYTCNWRBMBPE\StrCmp.exe
        C:\Users\Admin\AppData\Roaming\Ebx\DNUAIYTCNWRBMBPE\StrCmp.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4000
      • C:\Windows\SysWOW64\more.com
        C:\Windows\SysWOW64\more.com
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:5528
        • C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
          C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3132
    • C:\Users\Admin\Desktop\♡☞Satup#\Setup.exe
      "C:\Users\Admin\Desktop\♡☞Satup#\Setup.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Users\Admin\AppData\Roaming\Ebx\DNUAIYTCNWRBMBPE\StrCmp.exe
        C:\Users\Admin\AppData\Roaming\Ebx\DNUAIYTCNWRBMBPE\StrCmp.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2020
      • C:\Windows\SysWOW64\more.com
        C:\Windows\SysWOW64\more.com
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2480

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\272fafb1

            Filesize

            2.1MB

            MD5

            48f1eb682629c9954bb6f46dbd85630c

            SHA1

            c367c08f734043d33f57b391c88f75f48e8544bf

            SHA256

            49132644cd6a9ca3ca35cce72a2b0361500c7abbf414b47d26d6e0101feb319e

            SHA512

            d3bb72c65ea2746bc9ed67658a12acc30a7fa102dce7d647d112f1d990ad4100a086e703aa534fe2ebf9769eca337ca6269e71e204f5a1472da6ac91360bbf4e

          • C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe

            Filesize

            921KB

            MD5

            3f58a517f1f4796225137e7659ad2adb

            SHA1

            e264ba0e9987b0ad0812e5dd4dd3075531cfe269

            SHA256

            1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48

            SHA512

            acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

          • C:\Users\Admin\AppData\Local\Temp\bf748a4f

            Filesize

            2.1MB

            MD5

            c62f38475921f284a36e3e855b10aaea

            SHA1

            f1d14fc22d1578cc3f18d10e44163d93240c52e6

            SHA256

            0ba748580ce1ca08d38634c6d5e5900400d4e70ff61362a9f0894816675c3766

            SHA512

            e844eea1192e831a341b0832499de7956ad30a06799a439b8fdda28c141db2fe6ab5d32fb307baed3de942f16fd081ad42614d4fecf934fb24a55bb8dd44826a

          • C:\Users\Admin\AppData\Roaming\Ebx\DNUAIYTCNWRBMBPE\StrCmp.exe

            Filesize

            47KB

            MD5

            916d7425a559aaa77f640710a65f9182

            SHA1

            23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13

            SHA256

            118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35

            SHA512

            d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc

          • C:\Users\Admin\Desktop\♡☞Satup#\Qt5Core.dll

            Filesize

            6.0MB

            MD5

            68e600cb754e04557ef716b9ebc93fe4

            SHA1

            8302ab611e787c312b971ce05935ff6e956faede

            SHA256

            8f4c72e3c7de1ab5d894ec7813f65c5298ecafc183f31924b44a427433ffca42

            SHA512

            8bbd7d14b59f01eba7c46a6e8592c037cab73bed1eb0762fc278cf7b81082784e88d777a32f71bc2de128c0186321004bfa4ca68d1bcaa5660694c007219e98e

          • C:\Users\Admin\Desktop\♡☞Satup#\Qt5Network.dll

            Filesize

            1.3MB

            MD5

            375f1024c7b1d57a549ae13ee43f0251

            SHA1

            870f80500d067de505cda1496bb1cb4707f7ca6b

            SHA256

            42be1410c01d758949fef6ee9bfc2fa25d0720cf6613c4ef953ad339601c215f

            SHA512

            49f6a9d21c38784690aae673708d9eddfec7de383ae659ba7ec1261dd426d4c18e26803ff801fafc5568131b93cf56deade25575b498422bbb02d270313e5da0

          • C:\Users\Admin\Desktop\♡☞Satup#\Setup.exe

            Filesize

            5.4MB

            MD5

            ad2735f096925010a53450cb4178c89e

            SHA1

            c6d65163c6315a642664f4eaec0fae9528549bfe

            SHA256

            4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e

            SHA512

            1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9

          • C:\Users\Admin\Desktop\♡☞Satup#\VCRUNTIME140_1.dll

            Filesize

            48KB

            MD5

            cf0a1c4776ffe23ada5e570fc36e39fe

            SHA1

            2050fadecc11550ad9bde0b542bcf87e19d37f1a

            SHA256

            6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47

            SHA512

            d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168

          • C:\Users\Admin\Desktop\♡☞Satup#\libcrypto-1_1-x64.dll

            Filesize

            2.7MB

            MD5

            28dea3e780552eb5c53b3b9b1f556628

            SHA1

            55dccd5b30ce0363e8ebdfeb1cca38d1289748b8

            SHA256

            52415829d85c06df8724a3d3d00c98f12beabf5d6f3cbad919ec8000841a86e8

            SHA512

            19dfe5f71901e43ea34d257f693ae1a36433dbdbcd7c9440d9b0f9eea24de65c4a8fe332f7b88144e1a719a6ba791c2048b4dd3e5b1ed0fdd4c813603ad35112

          • C:\Users\Admin\Desktop\♡☞Satup#\libssl-1_1-x64.dll

            Filesize

            669KB

            MD5

            4ad03043a32e9a1ef64115fc1ace5787

            SHA1

            352e0e3a628c8626cff7eed348221e889f6a25c4

            SHA256

            a0e43cbc4a2d8d39f225abd91980001b7b2b5001e8b2b8292537ae39b17b85d1

            SHA512

            edfae3660a5f19a9deda0375efba7261d211a74f1d8b6bf1a8440fed4619c4b747aca8301d221fd91230e7af1dab73123707cc6eda90e53eb8b6b80872689ba6

          • C:\Users\Admin\Desktop\♡☞Satup#\msvcp140.dll

            Filesize

            564KB

            MD5

            1ba6d1cf0508775096f9e121a24e5863

            SHA1

            df552810d779476610da3c8b956cc921ed6c91ae

            SHA256

            74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823

            SHA512

            9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

          • C:\Users\Admin\Desktop\♡☞Satup#\msvcp140_1.dll

            Filesize

            34KB

            MD5

            69d96e09a54fbc5cf92a0e084ab33856

            SHA1

            b4629d51b5c4d8d78ccb3370b40a850f735b8949

            SHA256

            a3a1199de32bbbc8318ec33e2e1ce556247d012851e4b367fe853a51e74ce4ee

            SHA512

            2087827137c473cdbec87789361ed34fad88c9fe80ef86b54e72aea891d91af50b17b7a603f9ae2060b3089ce9966fad6d7fbe22dee980c07ed491a75503f2cf

          • C:\Users\Admin\Desktop\♡☞Satup#\qqwggw

            Filesize

            1.5MB

            MD5

            6cd79a6896d40ef0bb4169739095ad1b

            SHA1

            a0c07b0fce662754caf1db5182ea367e4e486131

            SHA256

            f3a88572035d1b6e6da481faf2c5b52eaa123e85ac0b010f34a8e6e13a29b6ea

            SHA512

            2a81fbff07d4cf5de19aacfe6ba5d2b4f724c9bbc153fcfda9978558073d7c83ad82154b4e0f0f1c0cc6a21b4375058c03762e52d07194b98c8a88d1ec4fdb59

          • C:\Users\Admin\Desktop\♡☞Satup#\steam_api64.dll

            Filesize

            291KB

            MD5

            6b4ab6e60364c55f18a56a39021b74a6

            SHA1

            39cac2889d8ca497ee0d8434fc9f6966f18fa336

            SHA256

            1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3

            SHA512

            c08de8c6e331d13dfe868ab340e41552fc49123a9f782a5a63b95795d5d979e68b5a6ab171153978679c0791dc3e3809c883471a05864041ce60b240ccdd4c21

          • C:\Users\Admin\Desktop\♡☞Satup#\vcruntime140.dll

            Filesize

            106KB

            MD5

            49c96cecda5c6c660a107d378fdfc3d4

            SHA1

            00149b7a66723e3f0310f139489fe172f818ca8e

            SHA256

            69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

            SHA512

            e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

          • C:\Users\Admin\Desktop\♡☞Satup#\wabxvfx

            Filesize

            67KB

            MD5

            4ccb9be6fad56a7da6f2f4e6afa4d238

            SHA1

            825723472886eaa0d0b20a2e8a931c9dfe9505e7

            SHA256

            f5e2f2e47d8e63be081054aaf5088030924d91d892f4397295c5de9240967c6d

            SHA512

            21e429e346c58d462b41149d8d3f679724646638bdc19e2eae6bb91d02f9a836cc96dc1970c6e3105ba707224a12fb03fdfcfafaa88d24efd6fa2d5afa23509c

          • memory/2480-133-0x00007FFACCE00000-0x00007FFACD009000-memory.dmp

            Filesize

            2.0MB

          • memory/3132-127-0x00007FFACCE00000-0x00007FFACD009000-memory.dmp

            Filesize

            2.0MB

          • memory/3132-132-0x0000000000F00000-0x0000000000F78000-memory.dmp

            Filesize

            480KB

          • memory/4664-90-0x00007FFACC0E0000-0x00007FFACC88E000-memory.dmp

            Filesize

            7.7MB

          • memory/4664-114-0x00007FFACC0E0000-0x00007FFACC88E000-memory.dmp

            Filesize

            7.7MB

          • memory/4664-125-0x00007FFACC0E0000-0x00007FFACC88E000-memory.dmp

            Filesize

            7.7MB

          • memory/5164-75-0x00007FFACC0F9000-0x00007FFACC0FA000-memory.dmp

            Filesize

            4KB

          • memory/5164-74-0x00007FFACC0E0000-0x00007FFACC88E000-memory.dmp

            Filesize

            7.7MB

          • memory/5164-71-0x00007FFACC0E0000-0x00007FFACC88E000-memory.dmp

            Filesize

            7.7MB

          • memory/5164-66-0x00007FFACC0E0000-0x00007FFACC88E000-memory.dmp

            Filesize

            7.7MB

          • memory/5164-67-0x00007FFACC0F9000-0x00007FFACC0FA000-memory.dmp

            Filesize

            4KB

          • memory/5164-53-0x00007FFACC0E0000-0x00007FFACC88E000-memory.dmp

            Filesize

            7.7MB

          • memory/5528-79-0x00007FFACCE00000-0x00007FFACD009000-memory.dmp

            Filesize

            2.0MB

          • memory/5528-120-0x0000000077380000-0x0000000077982000-memory.dmp

            Filesize

            6.0MB