Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
submitted
23-11-2024 02:22
Static task
static1
Behavioral task
behavioral1
Sample
47110ef49f5b24c718d63e79c4cbbb0121bdfc4889d42febe5a5409a2f2f3899.ps1
Resource
win7-20240903-en
General
-
Target
47110ef49f5b24c718d63e79c4cbbb0121bdfc4889d42febe5a5409a2f2f3899.ps1
-
Size
459B
-
MD5
a08cd6c1b50f050a764180741c3b32c4
-
SHA1
8e490919f1fa3ee1a75fd59fa3426d95cc455bd4
-
SHA256
47110ef49f5b24c718d63e79c4cbbb0121bdfc4889d42febe5a5409a2f2f3899
-
SHA512
e5a799d4c3c8572ea4a127ab9ee73d85b80c3339f4d0b73b44b6b183764732bac7e3a19aa9baa86ebb3c4cbf6b1a5c5f102075e3d8401473c657131a8172d77a
Malware Config
Extracted
lumma
https://p3ar11fter.sbs
https://3xp3cts1aim.sbs
https://owner-vacat10n.sbs
https://peepburry828.sbs
https://p10tgrace.sbs
https://befall-sm0ker.sbs
https://librari-night.sbs
https://processhol.sbs
https://w0rdergen1.cyou
Extracted
lumma
https://w0rdergen1.cyou/api
https://librari-night.sbs/api
https://befall-sm0ker.sbs/api
https://owner-vacat10n.sbs/api
Signatures
-
Lumma family
-
Blocklisted process makes network request 1 IoCs
flow pid Process 8 4376 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2272 setup.exe -
pid Process 4376 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4376 powershell.exe 4376 powershell.exe 2272 setup.exe 2272 setup.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4376 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4376 wrote to memory of 2272 4376 powershell.exe 92 PID 4376 wrote to memory of 2272 4376 powershell.exe 92 PID 4376 wrote to memory of 2272 4376 powershell.exe 92
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\47110ef49f5b24c718d63e79c4cbbb0121bdfc4889d42febe5a5409a2f2f3899.ps11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Roaming\Extracted1\setup.exe"C:\Users\Admin\AppData\Roaming\Extracted1\setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
214B
MD5eca6e7c2234994405ad03c7766e82ab5
SHA14804e6769d86021d6e11e182b34b0b893ab0af81
SHA25618dfa69b7c8ea710415ea2ba54d6ead3c477283d22a60c470f6fd32f82cdac39
SHA51297418f511bcdf78fcd46d14eff0789439b49401e2c9912bf65d1f9f29a350883da31cc8b8dcf87f7b4c7f5889fe58a84073ccf3256930284f1d5a089ed41f11e
-
Filesize
214B
MD548aa1ab4bbdfa64a4a70b06827ff621e
SHA191d9bebe5608febe247d9459bf848563850b73fb
SHA2561ec7225d089d90dd0c1f60eb1be665bde4d82472fd8f657f6bf40fcd09804b6f
SHA51254e4c55bd86c91363752e6b86cf04ff4c10000666a3a97d978aad21b8a9b07a23ea0cef1fba81ca894ae284df2ab253c89cd8c04ada5354ef273822e52bf6007
-
Filesize
3.8MB
MD5ac0571edb2c48a0ad96316d995e38abc
SHA156f76fb3d48d1f1c15e70481cd75743b8e2d6a28
SHA256bb9de58568867799c964de3c59a7e70a4c69703444126740dca59a8306ca9be3
SHA5124078b4035aae258fd6e5e46a468dea927d00e1c8ca197acc88434a22f80e38fbf3215117d817f72ce554a2e7aa579b4baac3b3097d28d40bd8cf86deb8c5be0a