Analysis

  • max time kernel
    299s
  • max time network
    279s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/10/2024, 08:17

General

  • Target

    ♡☞Satup#/Setup.exe

  • Size

    5.4MB

  • MD5

    ad2735f096925010a53450cb4178c89e

  • SHA1

    c6d65163c6315a642664f4eaec0fae9528549bfe

  • SHA256

    4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e

  • SHA512

    1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9

  • SSDEEP

    98304:o/zx+riUDpJowboU+XEsumY2XW6jBYeZ1ER:2x+riUDwUj12X1tY5

Malware Config

Extracted

Family

lumma

C2

https://snailyeductyi.sbs

https://ferrycheatyk.sbs

https://deepymouthi.sbs

https://wrigglesight.sbs

https://captaitwik.sbs

https://sidercotay.sbs

https://heroicmint.sbs

https://monstourtu.sbs

Extracted

Family

amadey

Version

5.03

Botnet

41da8a

C2

http://sportszone-financefocus.com

http://sportszone-financefocus2.com

http://sportszone-financefocus3.com

Attributes
  • strings_key

    d7c1288e89ebe71872174bb1aa9f53de

  • url_paths

    /8vjeh73hdjrFs/index.php

    /KFdjj3Cajf4/index.php

    /t7hdh39vjhs/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\♡☞Satup#\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\♡☞Satup#\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Roaming\Ebx\VSBXXPUYIRU\StrCmp.exe
      C:\Users\Admin\AppData\Roaming\Ebx\VSBXXPUYIRU\StrCmp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3608
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
        C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3804
        • C:\Users\Admin\AppData\Local\Temp\3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe
          "C:\Users\Admin\AppData\Local\Temp\3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4104
          • C:\Windows\SysWOW64\more.com
            C:\Windows\SysWOW64\more.com
            5⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:3676
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4100
        • C:\Users\Admin\AppData\Local\Temp\GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe
          "C:\Users\Admin\AppData\Local\Temp\GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4048
          • C:\Windows\SysWOW64\more.com
            C:\Windows\SysWOW64\more.com
            5⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2720
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2984

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\153280d0

          Filesize

          6.2MB

          MD5

          f1490558dbea9dc33d06d9e1398e9972

          SHA1

          abf0043310f4d0ff5d01f9b7006d386fb3600ab5

          SHA256

          ab955a896dd88530e200c6af4978c8e259e6b47abe43ae3cd8b725a816cd55ee

          SHA512

          0f40e13b901961881bf3f2aad4ab1048b779074277dc6714d5985fd5a817f2be6bb63aa4ad6e88148ea98c62c2dd25215a9e4712d7f61e095c621448d4068fae

        • C:\Users\Admin\AppData\Local\Temp\1bd3933a

          Filesize

          2.1MB

          MD5

          68cf885c86d64d0fb592b91ab5486718

          SHA1

          66215ee186427dce5b468ad87f81afba210bffde

          SHA256

          d1554cea4d5d2a1bbc9a87f36e6700ee0335c0710fd42da30257e65d35bc6d44

          SHA512

          7934582b26972bd02e9658d7a4845eb9c6285133fa8f76e93e74a5664d5114990bd5ea53fadb78a485a1dbf4ec1405492a3aba83b9c7054105eef6783371ebdc

        • C:\Users\Admin\AppData\Local\Temp\22150bc5

          Filesize

          6.4MB

          MD5

          0a16f7b2376eb7f30db869d416d170a0

          SHA1

          9086aa5d7e6d5a90f86c10c2c2f99706838efc13

          SHA256

          bfec0f9a55ee2532c8c94c54a4f544be68d02be3c13a08eec279404f4352877c

          SHA512

          ce7d52365b262cca62b2c8f635dfbb923459c997e7226c0d4726cc8dde7a32cd8f2100625ebf0f4d91b5f96a7b9a7d9ffd9aa0e98b0514f81c3cfd1af1cd4f57

        • C:\Users\Admin\AppData\Local\Temp\22cb35a8

          Filesize

          1.1MB

          MD5

          23bb6aa658769a7acfd8b299cf9a4267

          SHA1

          0003390b4c0e16d2585716eb556dca51337e74b9

          SHA256

          afd46becb1249c696a4ef7657389fc19c2e32e2972daef8dd4a57313178a790c

          SHA512

          cbdd8f6269a07c5516935566493cb9ab816a30f1ad95632911c98d7dad638af74f73ca70d2648c541a7907d6a6ec519c3453a543bd3263b47779a273bb1a50f8

        • C:\Users\Admin\AppData\Local\Temp\295dc575

          Filesize

          1.1MB

          MD5

          d9cdee993821347477038d87c0d0e976

          SHA1

          420bde3ec149bc06fb2b8ed07a24cca7cd0629a2

          SHA256

          eecaaa565cc0495e223b31caafd211e08d68997c025d71f9bde98bf4a88bdc08

          SHA512

          30a9abe407fde348ea9bf3ef59f24dd845072dcb718867a60b8bb65bd04ded9138448d7e9f807a19aa3eeed222bbbe42c043befb729507dce06dde53b43b8876

        • C:\Users\Admin\AppData\Local\Temp\3BCDWZ09PWCVSL2WTGLG4ASPLE38WDI.exe

          Filesize

          13.2MB

          MD5

          c13aa2a232a5023b77dfaa4772409b0f

          SHA1

          f00b458bf0899de09f688c04c21fbff8a5fc147c

          SHA256

          190ecfadbb3b3bb9400f9f27f2db55c0978cb51ef9569f1cd6636e5523acb4ae

          SHA512

          67605e2b6ff63a33d1133e1972a93dcae1303f1afaf704c14d73ec9a5b58525cb860ce55de9f3995cfbd58be7fcbb7adf7eca45678c11f80768666e88a2368a7

        • C:\Users\Admin\AppData\Local\Temp\AutoIt3.exe

          Filesize

          921KB

          MD5

          3f58a517f1f4796225137e7659ad2adb

          SHA1

          e264ba0e9987b0ad0812e5dd4dd3075531cfe269

          SHA256

          1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48

          SHA512

          acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

        • C:\Users\Admin\AppData\Local\Temp\GGCE7NQWOCYIWLMS1RVVUC4Z0TNB.exe

          Filesize

          9.1MB

          MD5

          de559fd217e239c23c2c6da8a73ba3de

          SHA1

          e499ff1ae6da50e17723bcd0d90b2f8fc663a709

          SHA256

          102dc63d733c2b78c2a4a72c6709675bd62121cfd38460be6805bca60b5eaa69

          SHA512

          1824012ca5e17765256a4834ac229a04eda74f1d954ecbc89ae4d1fe2ab79d2d3d7d0328030734a5f703c51b14e51e710d4804300f42c5dfb8caf02d4b99def7

        • C:\Users\Admin\AppData\Roaming\Ebx\VSBXXPUYIRU\StrCmp.exe

          Filesize

          47KB

          MD5

          916d7425a559aaa77f640710a65f9182

          SHA1

          23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13

          SHA256

          118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35

          SHA512

          d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc

        • memory/2072-0-0x00007FFB2AAE0000-0x00007FFB2B28E000-memory.dmp

          Filesize

          7.7MB

        • memory/2072-23-0x00007FFB2AAF9000-0x00007FFB2AAFA000-memory.dmp

          Filesize

          4KB

        • memory/2072-12-0x00007FFB2AAF9000-0x00007FFB2AAFA000-memory.dmp

          Filesize

          4KB

        • memory/2072-16-0x00007FFB2AAE0000-0x00007FFB2B28E000-memory.dmp

          Filesize

          7.7MB

        • memory/2072-20-0x00007FFB2AAE0000-0x00007FFB2B28E000-memory.dmp

          Filesize

          7.7MB

        • memory/2072-22-0x00007FFB2AAE0000-0x00007FFB2B28E000-memory.dmp

          Filesize

          7.7MB

        • memory/2720-102-0x0000000003D50000-0x0000000004352000-memory.dmp

          Filesize

          6.0MB

        • memory/2720-84-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

          Filesize

          2.0MB

        • memory/2720-87-0x0000000003D50000-0x0000000004352000-memory.dmp

          Filesize

          6.0MB

        • memory/2720-88-0x0000000076580000-0x0000000076B82000-memory.dmp

          Filesize

          6.0MB

        • memory/2720-96-0x0000000003D50000-0x0000000004352000-memory.dmp

          Filesize

          6.0MB

        • memory/2724-27-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

          Filesize

          2.0MB

        • memory/2724-29-0x0000000076580000-0x0000000076B82000-memory.dmp

          Filesize

          6.0MB

        • memory/2724-30-0x000000007658E000-0x0000000076590000-memory.dmp

          Filesize

          8KB

        • memory/2724-36-0x0000000076580000-0x0000000076B82000-memory.dmp

          Filesize

          6.0MB

        • memory/2724-37-0x000000007658E000-0x0000000076590000-memory.dmp

          Filesize

          8KB

        • memory/2724-32-0x0000000076580000-0x0000000076B82000-memory.dmp

          Filesize

          6.0MB

        • memory/2984-111-0x0000000000350000-0x00000000003C3000-memory.dmp

          Filesize

          460KB

        • memory/2984-104-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

          Filesize

          2.0MB

        • memory/2984-105-0x0000000000350000-0x00000000003C3000-memory.dmp

          Filesize

          460KB

        • memory/3676-100-0x0000000003760000-0x0000000003D62000-memory.dmp

          Filesize

          6.0MB

        • memory/3676-83-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

          Filesize

          2.0MB

        • memory/3676-94-0x0000000076580000-0x0000000076B82000-memory.dmp

          Filesize

          6.0MB

        • memory/3676-95-0x0000000003760000-0x0000000003D62000-memory.dmp

          Filesize

          6.0MB

        • memory/3804-39-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

          Filesize

          2.0MB

        • memory/3804-41-0x00000000009A0000-0x0000000000A18000-memory.dmp

          Filesize

          480KB

        • memory/3804-56-0x00000000009A0000-0x0000000000A18000-memory.dmp

          Filesize

          480KB

        • memory/4048-79-0x0000000076580000-0x0000000076B82000-memory.dmp

          Filesize

          6.0MB

        • memory/4048-66-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

          Filesize

          2.0MB

        • memory/4048-65-0x0000000076580000-0x0000000076B82000-memory.dmp

          Filesize

          6.0MB

        • memory/4048-58-0x0000000000ED0000-0x0000000001976000-memory.dmp

          Filesize

          10.6MB

        • memory/4100-101-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

          Filesize

          2.0MB

        • memory/4100-103-0x00000000012B0000-0x0000000001884000-memory.dmp

          Filesize

          5.8MB

        • memory/4100-109-0x00000000012B0000-0x0000000001884000-memory.dmp

          Filesize

          5.8MB

        • memory/4100-112-0x00000000012B0000-0x0000000001884000-memory.dmp

          Filesize

          5.8MB

        • memory/4100-114-0x00000000012B0000-0x0000000001884000-memory.dmp

          Filesize

          5.8MB

        • memory/4100-116-0x00000000012B0000-0x0000000001884000-memory.dmp

          Filesize

          5.8MB

        • memory/4100-118-0x00000000012B0000-0x0000000001884000-memory.dmp

          Filesize

          5.8MB

        • memory/4100-120-0x00000000012B0000-0x0000000001884000-memory.dmp

          Filesize

          5.8MB

        • memory/4100-122-0x00000000012B0000-0x0000000001884000-memory.dmp

          Filesize

          5.8MB

        • memory/4104-53-0x0000000076580000-0x0000000076B82000-memory.dmp

          Filesize

          6.0MB

        • memory/4104-46-0x0000000000400000-0x0000000001163000-memory.dmp

          Filesize

          13.4MB

        • memory/4104-57-0x00007FFB2B6C0000-0x00007FFB2B8C9000-memory.dmp

          Filesize

          2.0MB

        • memory/4104-74-0x0000000076580000-0x0000000076B82000-memory.dmp

          Filesize

          6.0MB