Analysis

  • max time kernel
    134s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 15:17

General

  • Target

    Set-up.exe

  • Size

    5.5MB

  • MD5

    537915708fe4e81e18e99d5104b353ed

  • SHA1

    128ddb7096e5b748c72dc13f55b593d8d20aa3fb

  • SHA256

    6dc7275f2143d1de0ca66c487b0f2ebff3d4c6a79684f03b9619bf23143ecf74

  • SHA512

    9ceaaf7aa5889be9f5606646403133782d004b9d78ef83d7007dfce67c0f4f688d7931aebc74f1fc30aac2f1dd6281bdadfb52bc3ea46aca33b334adb4067ae2

  • SSDEEP

    49152:ERUl697ngPTrho9J8kgdjbHNZ5PP/Re5m3mxVN6KEp0v7J7k66ZRkQTXw+sljVop:uAXqnhON8m3mzNHTdw6YSX+sleu5y

Malware Config

Extracted

Family

lumma

C2

https://mindfuljournal.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Set-up.exe
    "C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:492
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -exec bypass -f "C:\Users\Admin\AppData\Local\Temp\3O6QTUU1MR033UWI6MBVM5Z.ps1"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2928
        • C:\Users\Admin\AppData\Roaming\9A2VOZ.pif
          "C:\Users\Admin\AppData\Roaming\9A2VOZ.pif" "C:\Users\Admin\AppData\Roaming\N67EEG.xlsx"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          PID:2340
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            5⤵
              PID:1720
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              5⤵
                PID:1472
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                5⤵
                  PID:2692
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                  5⤵
                    PID:2952
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                    5⤵
                      PID:632
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                      5⤵
                        PID:1284
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                        5⤵
                          PID:1828
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                          5⤵
                            PID:3028
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                            5⤵
                              PID:2964
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                              5⤵
                                PID:1296
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                5⤵
                                  PID:3032
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                  5⤵
                                    PID:3040
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                    5⤵
                                      PID:2832
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                      5⤵
                                        PID:2848
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                        5⤵
                                          PID:2856
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                          5⤵
                                            PID:2712
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                            5⤵
                                              PID:2932
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                              5⤵
                                                PID:2948
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                5⤵
                                                  PID:2996
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                  5⤵
                                                    PID:3068
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                    5⤵
                                                      PID:2940
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                      5⤵
                                                        PID:1560
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                        5⤵
                                                          PID:1220
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                          5⤵
                                                            PID:2608
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                            5⤵
                                                              PID:2816
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                              5⤵
                                                                PID:1536
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                5⤵
                                                                  PID:3004
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                  5⤵
                                                                    PID:3052
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                    5⤵
                                                                      PID:544
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                      5⤵
                                                                        PID:1584
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                        5⤵
                                                                          PID:3056
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                          5⤵
                                                                            PID:1512
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                            5⤵
                                                                              PID:2020
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                              5⤵
                                                                                PID:560
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                5⤵
                                                                                  PID:1640
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                  5⤵
                                                                                    PID:1824
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                    5⤵
                                                                                      PID:1748
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                      5⤵
                                                                                        PID:1924
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                        5⤵
                                                                                          PID:1752
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                          5⤵
                                                                                            PID:2072

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\Local\Temp\3O6QTUU1MR033UWI6MBVM5Z.ps1

                                                                                    Filesize

                                                                                    332B

                                                                                    MD5

                                                                                    a93ef812fcdf3af24ff8b33a75d4992e

                                                                                    SHA1

                                                                                    b282892bd321a8709474f43d790d7e661edaa98f

                                                                                    SHA256

                                                                                    d5a89ca10e0e354df724efa955616b27501534cd5153f3c387c9d569a73cdbc6

                                                                                    SHA512

                                                                                    272da3e9cb498541454f381d360e4dd47498ecf1f604844dcaea21316a3f37547688f52439d38bb6208f513ba8fc9e442b82cbb622c6579323530c342853b037

                                                                                  • C:\Users\Admin\AppData\Local\Temp\c44e025e

                                                                                    Filesize

                                                                                    1013KB

                                                                                    MD5

                                                                                    51ce6bb7811c2cb519df4248405e4724

                                                                                    SHA1

                                                                                    237195ac7a01b2db385b09ebad099c77ee9780e7

                                                                                    SHA256

                                                                                    c07ff059a3774eb806e8c74eaba95e64ba4768cae00335a9eb9bd350ee220deb

                                                                                    SHA512

                                                                                    c2cb5517d2e568db6adff52abfa6c99ef6993392cb54616765e5a0e90d57468a53c36e83af96baf030c6b4d6b9d3dde549e60ba73527f18161a6b203aa2b2347

                                                                                  • C:\Users\Admin\AppData\Roaming\N67EEG.xlsx

                                                                                    Filesize

                                                                                    5.7MB

                                                                                    MD5

                                                                                    3c6d0866e54ab391bc09713fde4c9d38

                                                                                    SHA1

                                                                                    a1a4e9c067e3c85739e85fb45f7ecdb363bcf856

                                                                                    SHA256

                                                                                    ffe15bff44969541749b01e1ab80492c95990bf4af35fb62e0d93bf6a4b81682

                                                                                    SHA512

                                                                                    eebf8ca2e3d778ca9706276b26c4d3daedf9cb7067d695cbf9e07755e6887e782d25a8aa6785034052b39105518c69f7e09b12c8199e58d13fcaf6b7f82b58b4

                                                                                  • \Users\Admin\AppData\Roaming\9A2VOZ.pif

                                                                                    Filesize

                                                                                    921KB

                                                                                    MD5

                                                                                    3f58a517f1f4796225137e7659ad2adb

                                                                                    SHA1

                                                                                    e264ba0e9987b0ad0812e5dd4dd3075531cfe269

                                                                                    SHA256

                                                                                    1da298cab4d537b0b7b5dabf09bff6a212b9e45731e0cc772f99026005fb9e48

                                                                                    SHA512

                                                                                    acf740aafce390d06c6a76c84e7ae7c0f721731973aadbe3e57f2eb63241a01303cc6bf11a3f9a88f8be0237998b5772bdaf569137d63ba3d0f877e7d27fc634

                                                                                  • memory/492-18-0x0000000074080000-0x00000000742C0000-memory.dmp

                                                                                    Filesize

                                                                                    2.2MB

                                                                                  • memory/492-16-0x0000000074080000-0x00000000742C0000-memory.dmp

                                                                                    Filesize

                                                                                    2.2MB

                                                                                  • memory/492-13-0x0000000074080000-0x00000000742C0000-memory.dmp

                                                                                    Filesize

                                                                                    2.2MB

                                                                                  • memory/492-14-0x0000000076F40000-0x00000000770E9000-memory.dmp

                                                                                    Filesize

                                                                                    1.7MB

                                                                                  • memory/492-15-0x0000000074080000-0x00000000742C0000-memory.dmp

                                                                                    Filesize

                                                                                    2.2MB

                                                                                  • memory/2308-9-0x0000000074080000-0x00000000742C0000-memory.dmp

                                                                                    Filesize

                                                                                    2.2MB

                                                                                  • memory/2308-0-0x0000000074080000-0x00000000742C0000-memory.dmp

                                                                                    Filesize

                                                                                    2.2MB

                                                                                  • memory/2308-10-0x0000000074080000-0x00000000742C0000-memory.dmp

                                                                                    Filesize

                                                                                    2.2MB

                                                                                  • memory/2308-8-0x0000000074093000-0x0000000074095000-memory.dmp

                                                                                    Filesize

                                                                                    8KB

                                                                                  • memory/2308-1-0x0000000076F40000-0x00000000770E9000-memory.dmp

                                                                                    Filesize

                                                                                    1.7MB

                                                                                  • memory/2772-19-0x0000000076F40000-0x00000000770E9000-memory.dmp

                                                                                    Filesize

                                                                                    1.7MB

                                                                                  • memory/2772-20-0x0000000000080000-0x00000000000D9000-memory.dmp

                                                                                    Filesize

                                                                                    356KB

                                                                                  • memory/2772-23-0x00000000002BF000-0x00000000002C7000-memory.dmp

                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/2772-24-0x0000000000080000-0x00000000000D9000-memory.dmp

                                                                                    Filesize

                                                                                    356KB

                                                                                  • memory/2772-30-0x00000000006E0000-0x0000000000719000-memory.dmp

                                                                                    Filesize

                                                                                    228KB

                                                                                  • memory/2772-31-0x00000000006E0000-0x0000000000719000-memory.dmp

                                                                                    Filesize

                                                                                    228KB

                                                                                  • memory/2772-37-0x0000000000080000-0x00000000000D9000-memory.dmp

                                                                                    Filesize

                                                                                    356KB