Overview
overview
10Static
static
10Installer/Accord.dll
windows7-x64
1Installer/Accord.dll
windows10-2004-x64
1Installer/CapCut.exe
windows7-x64
8Installer/CapCut.exe
windows10-2004-x64
10Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...eo.dll
windows7-x64
1Installer/...eo.dll
windows10-2004-x64
1Installer/...eo.dll
windows7-x64
1Installer/...eo.dll
windows10-2004-x64
1Installer/...eo.dll
windows7-x64
1Installer/...eo.dll
windows10-2004-x64
1Analysis
-
max time kernel
136s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2024 21:53
Behavioral task
behavioral1
Sample
Installer/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Installer/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Installer/CapCut.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Installer/CapCut.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity full v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity full v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity micro v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity micro v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity subset v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity subset v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity web v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity web v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Installer/Tools/Accord.3.8.0/lib/net35/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Installer/Tools/Accord.3.8.0/lib/net35/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Installer/Tools/Accord.3.8.0/lib/net40/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Installer/Tools/Accord.3.8.0/lib/net40/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Installer/Tools/Accord.3.8.0/lib/net45/Accord.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
Installer/Tools/Accord.3.8.0/lib/net45/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Installer/Tools/Accord.3.8.0/lib/net46/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Installer/Tools/Accord.3.8.0/lib/net46/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Installer/Tools/Accord.3.8.0/lib/net462/Accord.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
Installer/Tools/Accord.3.8.0/lib/net462/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Installer/Tools/Accord.3.8.0/lib/netstandard1.4/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Installer/Tools/Accord.3.8.0/lib/netstandard1.4/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Installer/Tools/Accord.3.8.0/lib/netstandard2.0/Accord.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
Installer/Tools/Accord.3.8.0/lib/netstandard2.0/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Installer/Tools/Accord.Video.3.8.0/lib/net35-unity full v3.5/Accord.Video.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Installer/Tools/Accord.Video.3.8.0/lib/net35-unity full v3.5/Accord.Video.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Installer/Tools/Accord.Video.3.8.0/lib/net35-unity micro v3.5/Accord.Video.dll
Resource
win7-20241023-en
Behavioral task
behavioral30
Sample
Installer/Tools/Accord.Video.3.8.0/lib/net35-unity micro v3.5/Accord.Video.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Installer/Tools/Accord.Video.3.8.0/lib/net35-unity subset v3.5/Accord.Video.dll
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
Installer/Tools/Accord.Video.3.8.0/lib/net35-unity subset v3.5/Accord.Video.dll
Resource
win10v2004-20241007-en
General
-
Target
Installer/CapCut.exe
-
Size
332KB
-
MD5
9095698e073c305cb31934f911e2f224
-
SHA1
3c3a7cf49ecc1faf01d8f85d345425a3c417361e
-
SHA256
a274bbefeca015c06188faf15493b32f3ed4b175a92fa4fdf59a0da55059f6db
-
SHA512
8470d517a74c721911b7a5b93a8513630a9cfef747ef143296bfdcb3174620ddec7d2e170afbed2621f441aaa663b46eec676c9e8065b9fde87bf15633190fb6
-
SSDEEP
6144:KurqFF99YI+Ka804ozhmKuRb5B/OalLbQg1/R:YFFXY9vrzoKud59Oahbv
Malware Config
Extracted
lumma
https://navygenerayk.store/api
https://necklacedmny.store/api
https://founpiuer.store/api
Signatures
-
Lumma family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4324 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1356 pdf.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 33 raw.githubusercontent.com 34 raw.githubusercontent.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1356 pdf.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4324 powershell.exe 4324 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4324 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1356 pdf.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3680 wrote to memory of 3388 3680 CapCut.exe 92 PID 3680 wrote to memory of 3388 3680 CapCut.exe 92 PID 3388 wrote to memory of 4324 3388 cmd.exe 93 PID 3388 wrote to memory of 4324 3388 cmd.exe 93 PID 3680 wrote to memory of 1356 3680 CapCut.exe 97 PID 3680 wrote to memory of 1356 3680 CapCut.exe 97 PID 3680 wrote to memory of 1356 3680 CapCut.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer\CapCut.exe"C:\Users\Admin\AppData\Local\Temp\Installer\CapCut.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Lipras'; Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Lipras'; Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
-
-
C:\Lipras\pdf.exe"C:\Lipras\pdf.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e9a83661d98fca881cd4497a985a20de
SHA138c9937610d563b848a634aed39366ef8b2a8f37
SHA256f8dbff120f44cf68bcb802c11f24bbc506f11803e8745883a0f650decea1db47
SHA512df008a6302c877f4dae1780bb3ed3682498586c9e556681c8359012948ba9bb6d720af87b51f1f850d6550d809eb6e9242992b07c6dbf1b9c7b2fd3afe389e2e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82