Analysis

  • max time kernel
    140s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2024 08:13

General

  • Target

    Installer/CapCut.exe

  • Size

    332KB

  • MD5

    9095698e073c305cb31934f911e2f224

  • SHA1

    3c3a7cf49ecc1faf01d8f85d345425a3c417361e

  • SHA256

    a274bbefeca015c06188faf15493b32f3ed4b175a92fa4fdf59a0da55059f6db

  • SHA512

    8470d517a74c721911b7a5b93a8513630a9cfef747ef143296bfdcb3174620ddec7d2e170afbed2621f441aaa663b46eec676c9e8065b9fde87bf15633190fb6

  • SSDEEP

    6144:KurqFF99YI+Ka804ozhmKuRb5B/OalLbQg1/R:YFFXY9vrzoKud59Oahbv

Malware Config

Extracted

Family

lumma

C2

https://navygenerayk.store/api

https://necklacedmny.store/api

https://founpiuer.store/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Installer\CapCut.exe
    "C:\Users\Admin\AppData\Local\Temp\Installer\CapCut.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Lipras'; Add-MpPreference -ExclusionPath 'C:\Users'"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Lipras'; Add-MpPreference -ExclusionPath 'C:\Users'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4112
    • C:\Lipras\pdf.exe
      "C:\Lipras\pdf.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Lipras\pdf.exe

    Filesize

    1.2MB

    MD5

    e9a83661d98fca881cd4497a985a20de

    SHA1

    38c9937610d563b848a634aed39366ef8b2a8f37

    SHA256

    f8dbff120f44cf68bcb802c11f24bbc506f11803e8745883a0f650decea1db47

    SHA512

    df008a6302c877f4dae1780bb3ed3682498586c9e556681c8359012948ba9bb6d720af87b51f1f850d6550d809eb6e9242992b07c6dbf1b9c7b2fd3afe389e2e

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_srsmknzq.3yu.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/976-38-0x0000000000AA0000-0x0000000000E63000-memory.dmp

    Filesize

    3.8MB

  • memory/976-40-0x0000000000AA0000-0x0000000000E63000-memory.dmp

    Filesize

    3.8MB

  • memory/4112-0-0x00007FFE14083000-0x00007FFE14085000-memory.dmp

    Filesize

    8KB

  • memory/4112-1-0x0000019469850000-0x0000019469872000-memory.dmp

    Filesize

    136KB

  • memory/4112-11-0x00007FFE14080000-0x00007FFE14B41000-memory.dmp

    Filesize

    10.8MB

  • memory/4112-12-0x00007FFE14080000-0x00007FFE14B41000-memory.dmp

    Filesize

    10.8MB

  • memory/4112-15-0x00007FFE14080000-0x00007FFE14B41000-memory.dmp

    Filesize

    10.8MB