Analysis
-
max time kernel
32s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 19:03
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240708-en
windows7-x64
General
-
Target
Loader.exe
-
Size
550KB
-
MD5
ee6be1648866b63fd7f860fa0114f368
-
SHA1
42cab62fff29eb98851b33986b637514fc904f4b
-
SHA256
e17bf83e09457d8cecd1f3e903fa4c9770e17e823731650a453bc479591ac511
-
SHA512
d6492d3b3c1d94d6c87b77a9a248e8c46b889d2e23938ddb8a8e242caccb23e8cd1a1fbeffee6b140cf6fd3ea7e8da89190286a912032ce4a671257bd8e3e28a
-
SSDEEP
12288:SQ5vTleU6iA6AiJ/uJxZjUXUxYcuORWETWOORGzbZr4QClJJRJAr6Ok:SQ5pexaALoXe4
Malware Config
Extracted
lumma
https://covvercilverow.shop/api
https://surroundeocw.shop/api
https://abortinoiwiam.shop/api
https://pumpkinkwquo.shop/api
https://priooozekw.shop/api
https://deallyharvenw.shop/api
https://defenddsouneuw.shop/api
https://racedsuitreow.shop/api
https://roaddrermncomplai.shop/api
Signatures
-
Lumma family
-
Loads dropped DLL 1 IoCs
Processes:
Loader.exepid Process 2184 Loader.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Loader.exedescription pid Process procid_target PID 2184 set thread context of 3776 2184 Loader.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
aspnet_regiis.exeLoader.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_regiis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
taskmgr.exepid Process 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid Process Token: SeDebugPrivilege 724 taskmgr.exe Token: SeSystemProfilePrivilege 724 taskmgr.exe Token: SeCreateGlobalPrivilege 724 taskmgr.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
Processes:
taskmgr.exepid Process 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
Processes:
taskmgr.exepid Process 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe 724 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Loader.exedescription pid Process procid_target PID 2184 wrote to memory of 3776 2184 Loader.exe 86 PID 2184 wrote to memory of 3776 2184 Loader.exe 86 PID 2184 wrote to memory of 3776 2184 Loader.exe 86 PID 2184 wrote to memory of 3776 2184 Loader.exe 86 PID 2184 wrote to memory of 3776 2184 Loader.exe 86 PID 2184 wrote to memory of 3776 2184 Loader.exe 86 PID 2184 wrote to memory of 3776 2184 Loader.exe 86 PID 2184 wrote to memory of 3776 2184 Loader.exe 86 PID 2184 wrote to memory of 3776 2184 Loader.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3776
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
642KB
MD59bc424be13dca227268ab018dca9ef0c
SHA1f6f42e926f511d57ef298613634f3a186ec25ddc
SHA25659d3999d0989c9c91dae93c26499f5a14b837a0fe56e6fc29f57456f54a1f8a2
SHA51270a1abb35bd95efc40af6653d5db2e155fab9a8575b7ae5b69ab3fbcd60925c66a675dac6cba57564a430e9b92f1a2ea9e912c4d7f356b82696ed77e92b52715