Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 17:57

General

  • Target

    TEst2.exe

  • Size

    5.2MB

  • MD5

    0944900665d80daea35877425ea31206

  • SHA1

    d5b4ebe23d8d0457de2c82ef1a637b253349fb50

  • SHA256

    4597d3959f9503aae779f95e81bf32b3d7b9d5faca9ee0f741c6bb3b7fa40b74

  • SHA512

    c5dd8c5b3adca98eedf0fc048722c3bc9a60850321fd1eb95ad0c26daaa664ee20fcb0dec7ae73d4abfd1ad85e63baf2068acd6d027b2cac67eb9507edfa275d

  • SSDEEP

    98304:CSYl+O1E/Uo8EoT9AfvDm+CIUzwNhiDbY1UaV/:CS7Uo/bfyhIUziUbIU+

Malware Config

Extracted

Family

lumma

C2

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 4 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 46 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TEst2.exe
    "C:\Users\Admin\AppData\Local\Temp\TEst2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Users\Admin\AppData\Roaming\WeMod.exe
      C:\Users\Admin\AppData\Roaming\WeMod.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2812
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3684
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
            PID:3400
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:2076
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:4328
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop wuauserv
          3⤵
          • Launches sc.exe
          PID:3856
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop bits
          3⤵
          • Launches sc.exe
          PID:2892
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop dosvc
          3⤵
          • Launches sc.exe
          PID:2580
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          3⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:3268
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          3⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:2608
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          3⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:3092
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          3⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:4480
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "WHAMNXEF"
          3⤵
          • Launches sc.exe
          PID:2864
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "WHAMNXEF" binpath= "C:\ProgramData\jlspkeimqrvm\blvsiwuhlygz.exe" start= "auto"
          3⤵
          • Launches sc.exe
          PID:2976
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          3⤵
          • Launches sc.exe
          PID:4568
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "WHAMNXEF"
          3⤵
          • Launches sc.exe
          PID:2860
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WeMod.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5056
          • C:\Windows\system32\choice.exe
            choice /C Y /N /D Y /T 3
            4⤵
              PID:2272
        • C:\Users\Admin\AppData\Roaming\Sirus.exe
          C:\Users\Admin\AppData\Roaming\Sirus.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:452
          • C:\Users\Admin\AppData\Roaming\Sirus.exe
            "C:\Users\Admin\AppData\Roaming\Sirus.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4780
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 240
            3⤵
            • Program crash
            PID:2616
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 452 -ip 452
        1⤵
          PID:2800
        • C:\ProgramData\jlspkeimqrvm\blvsiwuhlygz.exe
          C:\ProgramData\jlspkeimqrvm\blvsiwuhlygz.exe
          1⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1504
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1020
            • C:\Windows\system32\wusa.exe
              wusa /uninstall /kb:890830 /quiet /norestart
              3⤵
                PID:4984
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop UsoSvc
              2⤵
              • Launches sc.exe
              PID:5092
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop WaaSMedicSvc
              2⤵
              • Launches sc.exe
              PID:2720
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop wuauserv
              2⤵
              • Launches sc.exe
              PID:2948
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop bits
              2⤵
              • Launches sc.exe
              PID:3376
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop dosvc
              2⤵
              • Launches sc.exe
              PID:4804
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              2⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:4188
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              2⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:2064
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              2⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:2172
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              2⤵
              • Power Settings
              • Suspicious use of AdjustPrivilegeToken
              PID:428
            • C:\Windows\system32\conhost.exe
              C:\Windows\system32\conhost.exe
              2⤵
                PID:5052
              • C:\Windows\explorer.exe
                explorer.exe
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2892

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ze3exxgr.2g5.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • memory/452-27-0x00000000002A6000-0x00000000002A7000-memory.dmp

              Filesize

              4KB

            • memory/1496-67-0x00007FFC93B50000-0x00007FFC93BEE000-memory.dmp

              Filesize

              632KB

            • memory/1496-117-0x00007FFC93B50000-0x00007FFC93BEE000-memory.dmp

              Filesize

              632KB

            • memory/1496-63-0x00007FF723A80000-0x00007FF723FC5000-memory.dmp

              Filesize

              5.3MB

            • memory/1496-62-0x0000026D5B480000-0x0000026D5B4DF000-memory.dmp

              Filesize

              380KB

            • memory/1496-118-0x00007FF723A80000-0x00007FF723FC5000-memory.dmp

              Filesize

              5.3MB

            • memory/1496-116-0x00007FFC92610000-0x00007FFC928D9000-memory.dmp

              Filesize

              2.8MB

            • memory/1496-115-0x00007FFC94C30000-0x00007FFC94E25000-memory.dmp

              Filesize

              2.0MB

            • memory/1496-61-0x00007FF723A80000-0x00007FF723FC5000-memory.dmp

              Filesize

              5.3MB

            • memory/1496-58-0x00007FF723A80000-0x00007FF723FC5000-memory.dmp

              Filesize

              5.3MB

            • memory/1496-57-0x00007FF723A80000-0x00007FF723FC5000-memory.dmp

              Filesize

              5.3MB

            • memory/1496-59-0x00007FF723A80000-0x00007FF723FC5000-memory.dmp

              Filesize

              5.3MB

            • memory/1496-60-0x00007FF723A80000-0x00007FF723FC5000-memory.dmp

              Filesize

              5.3MB

            • memory/1504-87-0x000001D15EE80000-0x000001D15EE9C000-memory.dmp

              Filesize

              112KB

            • memory/1504-94-0x000001D15F0F0000-0x000001D15F0F6000-memory.dmp

              Filesize

              24KB

            • memory/1504-88-0x000001D15EEA0000-0x000001D15EF55000-memory.dmp

              Filesize

              724KB

            • memory/1504-89-0x000001D15EF60000-0x000001D15EF6A000-memory.dmp

              Filesize

              40KB

            • memory/1504-93-0x000001D15F0C0000-0x000001D15F0C8000-memory.dmp

              Filesize

              32KB

            • memory/1504-90-0x000001D15F0D0000-0x000001D15F0EC000-memory.dmp

              Filesize

              112KB

            • memory/1504-95-0x000001D15F100000-0x000001D15F10A000-memory.dmp

              Filesize

              40KB

            • memory/1504-91-0x000001D15F0B0000-0x000001D15F0BA000-memory.dmp

              Filesize

              40KB

            • memory/1504-92-0x000001D15F110000-0x000001D15F12A000-memory.dmp

              Filesize

              104KB

            • memory/2812-19-0x00007FF7EFCB0000-0x00007FF7F01F5000-memory.dmp

              Filesize

              5.3MB

            • memory/2812-53-0x00007FFC93B50000-0x00007FFC93BEE000-memory.dmp

              Filesize

              632KB

            • memory/2812-54-0x00007FF7EFCB0000-0x00007FF7F01F5000-memory.dmp

              Filesize

              5.3MB

            • memory/2812-52-0x00007FFC92610000-0x00007FFC928D9000-memory.dmp

              Filesize

              2.8MB

            • memory/2812-51-0x00007FFC94C30000-0x00007FFC94E25000-memory.dmp

              Filesize

              2.0MB

            • memory/2812-43-0x00007FF7EFCB0000-0x00007FF7F01F5000-memory.dmp

              Filesize

              5.3MB

            • memory/2812-46-0x00007FFC93B50000-0x00007FFC93BEE000-memory.dmp

              Filesize

              632KB

            • memory/2812-23-0x00007FF7EFF41000-0x00007FF7F01F5000-memory.dmp

              Filesize

              2.7MB

            • memory/2812-21-0x00007FFC92610000-0x00007FFC928D9000-memory.dmp

              Filesize

              2.8MB

            • memory/2812-22-0x00007FFC93B50000-0x00007FFC93BEE000-memory.dmp

              Filesize

              632KB

            • memory/2812-4-0x00007FF7EFCB0000-0x00007FF7F01F5000-memory.dmp

              Filesize

              5.3MB

            • memory/2812-20-0x00007FFC94C30000-0x00007FFC94E25000-memory.dmp

              Filesize

              2.0MB

            • memory/2812-16-0x00007FFC93B50000-0x00007FFC93BEE000-memory.dmp

              Filesize

              632KB

            • memory/2812-17-0x0000023F859C0000-0x0000023F859C1000-memory.dmp

              Filesize

              4KB

            • memory/2812-6-0x00007FF7EFF41000-0x00007FF7F01F5000-memory.dmp

              Filesize

              2.7MB

            • memory/2812-8-0x00007FF7EFCB0000-0x00007FF7F01F5000-memory.dmp

              Filesize

              5.3MB

            • memory/2812-12-0x00007FF7EFCB0000-0x00007FF7F01F5000-memory.dmp

              Filesize

              5.3MB

            • memory/2812-10-0x00007FF7EFCB0000-0x00007FF7F01F5000-memory.dmp

              Filesize

              5.3MB

            • memory/2812-11-0x0000023F87000000-0x0000023F8705F000-memory.dmp

              Filesize

              380KB

            • memory/2812-7-0x00007FF7EFCB0000-0x00007FF7F01F5000-memory.dmp

              Filesize

              5.3MB

            • memory/2812-5-0x00007FF7EFCB0000-0x00007FF7F01F5000-memory.dmp

              Filesize

              5.3MB

            • memory/2892-112-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-111-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-125-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-124-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-106-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-108-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-110-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-113-0x0000000000D40000-0x0000000000D60000-memory.dmp

              Filesize

              128KB

            • memory/2892-119-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-123-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-122-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-121-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-120-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-105-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/2892-109-0x0000000140000000-0x0000000140835000-memory.dmp

              Filesize

              8.2MB

            • memory/3684-38-0x00000265EE0C0000-0x00000265EE0E2000-memory.dmp

              Filesize

              136KB

            • memory/4780-31-0x0000000000400000-0x000000000045C000-memory.dmp

              Filesize

              368KB

            • memory/4780-28-0x0000000000400000-0x000000000045C000-memory.dmp

              Filesize

              368KB

            • memory/4780-32-0x0000000000240000-0x000000000034E000-memory.dmp

              Filesize

              1.1MB

            • memory/5052-102-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/5052-98-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/5052-107-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/5052-99-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/5052-100-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB

            • memory/5052-101-0x0000000140000000-0x000000014000E000-memory.dmp

              Filesize

              56KB