Overview

overview

10

Static

static

10

Installer/Accord.dll

windows7-x64

1

Installer/Accord.dll

windows10-2004-x64

1

Installer/CapCut.exe

windows7-x64

8

Installer/CapCut.exe

windows10-2004-x64

10

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...rd.dll

windows7-x64

1

Installer/...rd.dll

windows10-2004-x64

1

Installer/...eo.dll

windows7-x64

1

Installer/...eo.dll

windows10-2004-x64

1

Installer/...eo.dll

windows7-x64

1

Installer/...eo.dll

windows10-2004-x64

1

Installer/...eo.dll

windows7-x64

1

Installer/...eo.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    main.zip
  • Size 20.1MB
  • Sample241029-1rppea1ark
  • SHA256 babf47d8493a17a590dfe66ba74f204a24c9e2ff878a52deabe3082766d72a79
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratdcratlummaquasarstormkittyvenomratvidarofficediscoveryexecutionratstealer

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.0.0

Botnet

  • Office

C2

  • 82.117.243.110:5173

Mutex

  • edH11NGQWIdCwvLx00

Attributes
  • encryption_key

    aGPuRaDerdUDJPrAfXtB

  • install_name

    csrss.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Framework

  • subdirectory

    SubDir

Extracted

Family

  • vidar

C2

  • https://t.me/asg7rd

  • https://steamcommunity.com/profiles/76561199794498376

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Extracted

Family

  • lumma

C2

  • https://navygenerayk.store/api

  • https://necklacedmny.store/api

  • https://founpiuer.store/api

Targets

    • Target
      Installer/Accord.dll
    • Size 128KB
    • SHA256 d36c225a84415c01bc2a8e84096590a7206dfc3d36173e3c7b6a62a04c0a33a9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      Installer/CapCut.exe
    • Size 332KB
    • SHA256 a274bbefeca015c06188faf15493b32f3ed4b175a92fa4fdf59a0da55059f6db
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    executionlummadiscoverystealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral3behavioral4
    • Target
      Installer/Tools/Accord.3.8.0/lib/net35-unity full v3.5/Accord.dll
    • Size 148KB
    • SHA256 4e9838f1e2d120ed2297bab01042c5d947506fbf4a96e330528cc5bcf8960da0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      Installer/Tools/Accord.3.8.0/lib/net35-unity micro v3.5/Accord.dll
    • Size 148KB
    • SHA256 4e9838f1e2d120ed2297bab01042c5d947506fbf4a96e330528cc5bcf8960da0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      Installer/Tools/Accord.3.8.0/lib/net35-unity subset v3.5/Accord.dll
    • Size 148KB
    • SHA256 4e9838f1e2d120ed2297bab01042c5d947506fbf4a96e330528cc5bcf8960da0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral9
    • Target
      Installer/Tools/Accord.3.8.0/lib/net35-unity web v3.5/Accord.dll
    • Size 148KB
    • SHA256 4e9838f1e2d120ed2297bab01042c5d947506fbf4a96e330528cc5bcf8960da0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      Installer/Tools/Accord.3.8.0/lib/net35/Accord.dll
    • Size 148KB
    • SHA256 4e9838f1e2d120ed2297bab01042c5d947506fbf4a96e330528cc5bcf8960da0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      Installer/Tools/Accord.3.8.0/lib/net40/Accord.dll
    • Size 128KB
    • SHA256 24e35568c79531d41330439a59ef5e2cd2e55bb87e0428daef37d9aa11ab432a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      Installer/Tools/Accord.3.8.0/lib/net45/Accord.dll
    • Size 128KB
    • SHA256 67a1977a211dd33752c7e6fcafb1e6ab61b6f26f529b1373e54d1ca512ada858
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      Installer/Tools/Accord.3.8.0/lib/net46/Accord.dll
    • Size 128KB
    • SHA256 b8eba126ccbe1e641b062fa1a4f45d094519bd5bc6ea81a4a24d4c2e549e883f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      Installer/Tools/Accord.3.8.0/lib/net462/Accord.dll
    • Size 128KB
    • SHA256 d36c225a84415c01bc2a8e84096590a7206dfc3d36173e3c7b6a62a04c0a33a9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      Installer/Tools/Accord.3.8.0/lib/netstandard1.4/Accord.dll
    • Size 119KB
    • SHA256 3b3bbe2b42ec0ca04aedd3a27eaa6e9ee24a24734ae285c2b2920ffdec94bba0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      Installer/Tools/Accord.3.8.0/lib/netstandard2.0/Accord.dll
    • Size 112KB
    • SHA256 6fc7ed6a7e60a666ded3284c1c5558624c2a9f7300cf8dcf76f698df5aad40f2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      Installer/Tools/Accord.Video.3.8.0/lib/net35-unity full v3.5/Accord.Video.dll
    • Size 40KB
    • SHA256 40139b60e4f0e397d955a87a658cee8d6be061eb8c45abba0f229d000a9a9f53
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      Installer/Tools/Accord.Video.3.8.0/lib/net35-unity micro v3.5/Accord.Video.dll
    • Size 40KB
    • SHA256 40139b60e4f0e397d955a87a658cee8d6be061eb8c45abba0f229d000a9a9f53
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      Installer/Tools/Accord.Video.3.8.0/lib/net35-unity subset v3.5/Accord.Video.dll
    • Size 40KB
    • SHA256 40139b60e4f0e397d955a87a658cee8d6be061eb8c45abba0f229d000a9a9f53
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

officeratstealerquasardcratvidarasyncratstormkittyvenomrat
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

execution
Score
8/10

behavioral4

lummadiscoveryexecutionstealer
Score
10/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10