Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • submitted
    23-11-2024 02:22

General

  • Target

    47110ef49f5b24c718d63e79c4cbbb0121bdfc4889d42febe5a5409a2f2f3899.ps1

  • Size

    459B

  • MD5

    a08cd6c1b50f050a764180741c3b32c4

  • SHA1

    8e490919f1fa3ee1a75fd59fa3426d95cc455bd4

  • SHA256

    47110ef49f5b24c718d63e79c4cbbb0121bdfc4889d42febe5a5409a2f2f3899

  • SHA512

    e5a799d4c3c8572ea4a127ab9ee73d85b80c3339f4d0b73b44b6b183764732bac7e3a19aa9baa86ebb3c4cbf6b1a5c5f102075e3d8401473c657131a8172d77a

Malware Config

Extracted

Family

lumma

C2

https://p3ar11fter.sbs

https://3xp3cts1aim.sbs

https://owner-vacat10n.sbs

https://peepburry828.sbs

https://p10tgrace.sbs

https://befall-sm0ker.sbs

https://librari-night.sbs

https://processhol.sbs

https://w0rdergen1.cyou

Extracted

Family

lumma

C2

https://w0rdergen1.cyou/api

https://librari-night.sbs/api

https://befall-sm0ker.sbs/api

https://owner-vacat10n.sbs/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\47110ef49f5b24c718d63e79c4cbbb0121bdfc4889d42febe5a5409a2f2f3899.ps1
    1⤵
    • Blocklisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Users\Admin\AppData\Roaming\Extracted1\setup.exe
      "C:\Users\Admin\AppData\Roaming\Extracted1\setup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hac0io1f.bub.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Extracted1\__MACOSX\._Register.dll

    Filesize

    214B

    MD5

    eca6e7c2234994405ad03c7766e82ab5

    SHA1

    4804e6769d86021d6e11e182b34b0b893ab0af81

    SHA256

    18dfa69b7c8ea710415ea2ba54d6ead3c477283d22a60c470f6fd32f82cdac39

    SHA512

    97418f511bcdf78fcd46d14eff0789439b49401e2c9912bf65d1f9f29a350883da31cc8b8dcf87f7b4c7f5889fe58a84073ccf3256930284f1d5a089ed41f11e

  • C:\Users\Admin\AppData\Roaming\Extracted1\__MACOSX\resource_\._Register.dll

    Filesize

    214B

    MD5

    48aa1ab4bbdfa64a4a70b06827ff621e

    SHA1

    91d9bebe5608febe247d9459bf848563850b73fb

    SHA256

    1ec7225d089d90dd0c1f60eb1be665bde4d82472fd8f657f6bf40fcd09804b6f

    SHA512

    54e4c55bd86c91363752e6b86cf04ff4c10000666a3a97d978aad21b8a9b07a23ea0cef1fba81ca894ae284df2ab253c89cd8c04ada5354ef273822e52bf6007

  • C:\Users\Admin\AppData\Roaming\Extracted1\setup.exe

    Filesize

    3.8MB

    MD5

    ac0571edb2c48a0ad96316d995e38abc

    SHA1

    56f76fb3d48d1f1c15e70481cd75743b8e2d6a28

    SHA256

    bb9de58568867799c964de3c59a7e70a4c69703444126740dca59a8306ca9be3

    SHA512

    4078b4035aae258fd6e5e46a468dea927d00e1c8ca197acc88434a22f80e38fbf3215117d817f72ce554a2e7aa579b4baac3b3097d28d40bd8cf86deb8c5be0a

  • memory/2272-488-0x0000000000400000-0x000000000080C000-memory.dmp

    Filesize

    4.0MB

  • memory/2272-487-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

    Filesize

    4KB

  • memory/2272-485-0x0000000002760000-0x00000000027B4000-memory.dmp

    Filesize

    336KB

  • memory/2272-484-0x0000000002760000-0x00000000027B4000-memory.dmp

    Filesize

    336KB

  • memory/2272-483-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

    Filesize

    4KB

  • memory/4376-12-0x00007FF868440000-0x00007FF868F01000-memory.dmp

    Filesize

    10.8MB

  • memory/4376-18-0x000001D9328B0000-0x000001D9328C2000-memory.dmp

    Filesize

    72KB

  • memory/4376-17-0x000001D9324D0000-0x000001D9324DA000-memory.dmp

    Filesize

    40KB

  • memory/4376-15-0x00007FF868440000-0x00007FF868F01000-memory.dmp

    Filesize

    10.8MB

  • memory/4376-482-0x00007FF868440000-0x00007FF868F01000-memory.dmp

    Filesize

    10.8MB

  • memory/4376-14-0x00007FF868443000-0x00007FF868445000-memory.dmp

    Filesize

    8KB

  • memory/4376-13-0x00007FF868440000-0x00007FF868F01000-memory.dmp

    Filesize

    10.8MB

  • memory/4376-0-0x00007FF868443000-0x00007FF868445000-memory.dmp

    Filesize

    8KB

  • memory/4376-11-0x00007FF868440000-0x00007FF868F01000-memory.dmp

    Filesize

    10.8MB

  • memory/4376-10-0x000001D9324E0000-0x000001D932502000-memory.dmp

    Filesize

    136KB