Analysis
-
max time kernel
43s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2024 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
60 seconds
General
-
Target
61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe
-
Size
1.8MB
-
MD5
6d02dfe090a1e4d84bdfa569ebe81d9c
-
SHA1
cae4963adf527d1ded42e49d3b47d20a9f79ed88
-
SHA256
61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc
-
SHA512
fadc5b2a169b17305c0110baadb2a8465d89bed99f5267bd0b4d2f978076fa058230327212f1b6364f967348ecaf520d65f87e5819146055c003550aa5ee4f1b
-
SSDEEP
49152:g0fj7cubxQeTYtOJoIoqtZS0blvr1NgYbkhg9j2:frTbxQest0oqpx/gY5Z
Malware Config
Extracted
Family
lumma
C2
https://p3ar11fter.sbs
https://3xp3cts1aim.sbs
https://owner-vacat10n.sbs
https://peepburry828.sbs
https://p10tgrace.sbs
https://befall-sm0ker.sbs
https://librari-night.sbs
https://processhol.sbs
https://cook-rain.sbs
Extracted
Family
lumma
C2
https://cook-rain.sbs/api
Signatures
-
Lumma family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine 61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exepid Process 4060 61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
Processes:
61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exetaskmgr.exepid Process 4060 61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe 4060 61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 5024 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid Process Token: SeDebugPrivilege 5024 taskmgr.exe Token: SeSystemProfilePrivilege 5024 taskmgr.exe Token: SeCreateGlobalPrivilege 5024 taskmgr.exe Token: 33 5024 taskmgr.exe Token: SeIncBasePriorityPrivilege 5024 taskmgr.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
Processes:
taskmgr.exepid Process 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe -
Suspicious use of SendNotifyMessage 56 IoCs
Processes:
taskmgr.exepid Process 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe 5024 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe"C:\Users\Admin\AppData\Local\Temp\61c8b17d2e8d8317a67de78ee3e19c583d50fb2ecac1914638fb02c3439db4bc.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4060
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5024