Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 04:23
Static task
static1
Behavioral task
behavioral1
Sample
b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe
Resource
win7-20240903-en
General
-
Target
b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe
-
Size
1.8MB
-
MD5
42b62e1e747b64a54a3f6896df2128d5
-
SHA1
4b0d19351ed7eb44908eae3020b8298ed221d100
-
SHA256
b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7
-
SHA512
dca1b52076478cb15bded75a98ea7d689e548d87c1117c33bf303750b6495d396deb9de30711fc1eabfa0e47af20460c0bc1c15b2c85b683401c40c7e101e229
-
SSDEEP
49152:CtR8X2NBoIch/r5dAYs8fbx6XBM15lyMUqPd/R:CTWYc/w4xExExR
Malware Config
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://tacitglibbr.biz/api
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://tacitglibbr.biz/api
Signatures
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 70RVXN0CWC6TU951AIMTMZKMQI.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 70RVXN0CWC6TU951AIMTMZKMQI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 70RVXN0CWC6TU951AIMTMZKMQI.exe -
Executes dropped EXE 2 IoCs
pid Process 2892 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe 1564 70RVXN0CWC6TU951AIMTMZKMQI.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine 70RVXN0CWC6TU951AIMTMZKMQI.exe -
Loads dropped DLL 3 IoCs
pid Process 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 2892 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe 1564 70RVXN0CWC6TU951AIMTMZKMQI.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70RVXN0CWC6TU951AIMTMZKMQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 2892 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe 2892 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe 2892 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe 1564 70RVXN0CWC6TU951AIMTMZKMQI.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2892 26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2892 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 32 PID 1832 wrote to memory of 2892 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 32 PID 1832 wrote to memory of 2892 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 32 PID 1832 wrote to memory of 2892 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 32 PID 1832 wrote to memory of 1564 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 33 PID 1832 wrote to memory of 1564 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 33 PID 1832 wrote to memory of 1564 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 33 PID 1832 wrote to memory of 1564 1832 b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe"C:\Users\Admin\AppData\Local\Temp\b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe"C:\Users\Admin\AppData\Local\Temp\26AS0V51H3BBLIDJY0NDJG38V9V1HAD.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\70RVXN0CWC6TU951AIMTMZKMQI.exe"C:\Users\Admin\AppData\Local\Temp\70RVXN0CWC6TU951AIMTMZKMQI.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1564
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
2Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD52bd7be5558ce4203112063f6b2c45454
SHA1c0aa5acecc953e6cab2482b12c9e31ee9ce2804c
SHA256be4d98eb32b36999f88fa786b3ee8d77abf2177421c04984c27e16aa8153e4aa
SHA51269e472d56b45a8ce6df10725f80e20738327a4d9037894e8da910747081ce9496e5c4c59cf23a128088cea1c62a514ddf457680854a37cdcf27c22eeffe546f2
-
Filesize
2.8MB
MD57d8e297d9b2cdcb4bfc19cb761f0abf8
SHA17c41c6737ebc85cee2b5f61fdc515606356ed262
SHA2568a988b1b507d489e9627de9f397353e9713e8bdd8125686d3fbcba852ca77bf6
SHA512e937f013c613a5b5ad6df0ceb78b97711328c767bb353ecdc61f29e72e64bced3dde757c5a77ae1516d902e5099f10c9b2455381610f4827d52c2b44e6d4fd41