Overview
overview
10Static
static
10-pril-main...th.exe
windows7-x64
10-pril-main...th.exe
windows10-2004-x64
10-pril-main...aw.exe
windows7-x64
10-pril-main...aw.exe
windows10-2004-x64
10-pril-main...wd.exe
windows7-x64
7-pril-main...wd.exe
windows10-2004-x64
7-pril-main...gh.exe
windows7-x64
10-pril-main...gh.exe
windows10-2004-x64
10-pril-main...se.exe
windows7-x64
10-pril-main...se.exe
windows10-2004-x64
10-pril-main...ed.exe
windows7-x64
10-pril-main...ed.exe
windows10-2004-x64
10Installer/Accord.dll
windows7-x64
1Installer/Accord.dll
windows10-2004-x64
1Installer/CapCut.exe
windows7-x64
8Installer/CapCut.exe
windows10-2004-x64
10Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Installer/...rd.dll
windows7-x64
1Installer/...rd.dll
windows10-2004-x64
1Analysis
-
max time kernel
140s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 08:13
Static task
static1
Behavioral task
behavioral1
Sample
-pril-main/dwthjadth.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
-pril-main/dwthjadth.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
-pril-main/feuiyjjdaw.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
-pril-main/feuiyjjdaw.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
-pril-main/kldrgawdtjawd.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
-pril-main/kldrgawdtjawd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
-pril-main/pothjadwtrgh.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
-pril-main/pothjadwtrgh.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
-pril-main/ptjjsekfthse.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
-pril-main/ptjjsekfthse.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
-pril-main/thadkythjawed.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
-pril-main/thadkythjawed.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Installer/Accord.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Installer/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Installer/CapCut.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Installer/CapCut.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity full v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity full v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity micro v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity micro v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity subset v3.5/Accord.dll
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity subset v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity web v3.5/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Installer/Tools/Accord.3.8.0/lib/net35-unity web v3.5/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Installer/Tools/Accord.3.8.0/lib/net35/Accord.dll
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
Installer/Tools/Accord.3.8.0/lib/net35/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Installer/Tools/Accord.3.8.0/lib/net40/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Installer/Tools/Accord.3.8.0/lib/net40/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Installer/Tools/Accord.3.8.0/lib/net45/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Installer/Tools/Accord.3.8.0/lib/net45/Accord.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Installer/Tools/Accord.3.8.0/lib/net46/Accord.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Installer/Tools/Accord.3.8.0/lib/net46/Accord.dll
Resource
win10v2004-20241007-en
General
-
Target
Installer/CapCut.exe
-
Size
332KB
-
MD5
9095698e073c305cb31934f911e2f224
-
SHA1
3c3a7cf49ecc1faf01d8f85d345425a3c417361e
-
SHA256
a274bbefeca015c06188faf15493b32f3ed4b175a92fa4fdf59a0da55059f6db
-
SHA512
8470d517a74c721911b7a5b93a8513630a9cfef747ef143296bfdcb3174620ddec7d2e170afbed2621f441aaa663b46eec676c9e8065b9fde87bf15633190fb6
-
SSDEEP
6144:KurqFF99YI+Ka804ozhmKuRb5B/OalLbQg1/R:YFFXY9vrzoKud59Oahbv
Malware Config
Extracted
lumma
https://navygenerayk.store/api
https://necklacedmny.store/api
https://founpiuer.store/api
Signatures
-
Lumma family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
pdf.exepid process 976 pdf.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
pdf.exepid process 976 pdf.exe 976 pdf.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pdf.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4112 powershell.exe 4112 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4112 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
pdf.exepid process 976 pdf.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
CapCut.execmd.exedescription pid process target process PID 1112 wrote to memory of 4812 1112 CapCut.exe cmd.exe PID 1112 wrote to memory of 4812 1112 CapCut.exe cmd.exe PID 4812 wrote to memory of 4112 4812 cmd.exe powershell.exe PID 4812 wrote to memory of 4112 4812 cmd.exe powershell.exe PID 1112 wrote to memory of 976 1112 CapCut.exe pdf.exe PID 1112 wrote to memory of 976 1112 CapCut.exe pdf.exe PID 1112 wrote to memory of 976 1112 CapCut.exe pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer\CapCut.exe"C:\Users\Admin\AppData\Local\Temp\Installer\CapCut.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Lipras'; Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Lipras'; Add-MpPreference -ExclusionPath 'C:\Users'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112 -
C:\Lipras\pdf.exe"C:\Lipras\pdf.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e9a83661d98fca881cd4497a985a20de
SHA138c9937610d563b848a634aed39366ef8b2a8f37
SHA256f8dbff120f44cf68bcb802c11f24bbc506f11803e8745883a0f650decea1db47
SHA512df008a6302c877f4dae1780bb3ed3682498586c9e556681c8359012948ba9bb6d720af87b51f1f850d6550d809eb6e9242992b07c6dbf1b9c7b2fd3afe389e2e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82