Analysis
-
max time kernel
90s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2024, 02:52
Static task
static1
Behavioral task
behavioral1
Sample
ae6bd3b195dd0a5adc6629bae4cd297bb33ae118f8de11b4f885068829de0f7b.dll
Resource
win7-20240903-en
General
-
Target
ae6bd3b195dd0a5adc6629bae4cd297bb33ae118f8de11b4f885068829de0f7b.dll
-
Size
438KB
-
MD5
a1f9933f151e127f4fc7ff82ad38d2a7
-
SHA1
135f68fc2c89cca9a3d3027c3975d841e4d62323
-
SHA256
ae6bd3b195dd0a5adc6629bae4cd297bb33ae118f8de11b4f885068829de0f7b
-
SHA512
25320a2c3425be6deda37597ceb0e46e4f6875a006179fa04279c3d869844de1e073874499da14ba3260bcea5ec3d6f5c0919986a2242445a7d9f1bd71c91d05
-
SSDEEP
12288:Ys9eQagJtAld4MknEv7gUz05CD1IsHPBdmrv:TeMJtAldRz05oGMdO
Malware Config
Extracted
lumma
https://barebrilliancedkoso.shop/api
https://parallelmercywksoffw.shop/api
https://ohfantasyproclaiwlo.shop/api
https://landdumpycolorwskfw.shop/api
https://flourhishdiscovrw.shop/api
https://conferencefreckewl.shop/api
https://notoriousdcellkw.shop/api
https://liabiliytshareodlkv.shop/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2456 set thread context of 3584 2456 rundll32.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_regiis.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3116 wrote to memory of 2456 3116 rundll32.exe 83 PID 3116 wrote to memory of 2456 3116 rundll32.exe 83 PID 3116 wrote to memory of 2456 3116 rundll32.exe 83 PID 2456 wrote to memory of 3584 2456 rundll32.exe 84 PID 2456 wrote to memory of 3584 2456 rundll32.exe 84 PID 2456 wrote to memory of 3584 2456 rundll32.exe 84 PID 2456 wrote to memory of 3584 2456 rundll32.exe 84 PID 2456 wrote to memory of 3584 2456 rundll32.exe 84 PID 2456 wrote to memory of 3584 2456 rundll32.exe 84 PID 2456 wrote to memory of 3584 2456 rundll32.exe 84 PID 2456 wrote to memory of 3584 2456 rundll32.exe 84 PID 2456 wrote to memory of 3584 2456 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6bd3b195dd0a5adc6629bae4cd297bb33ae118f8de11b4f885068829de0f7b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6bd3b195dd0a5adc6629bae4cd297bb33ae118f8de11b4f885068829de0f7b.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3584
-
-