Analysis

  • max time kernel
    94s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 02:32

General

  • Target

    343b51b34ac69ba9e09927634079bb0632509d3a2d9bafdba15d75a8f05b98ec.exe

  • Size

    1.8MB

  • MD5

    830c7205f281af8e8be936566c40d1a5

  • SHA1

    b1cfc6601006600a9823c324b3d26e1364802467

  • SHA256

    343b51b34ac69ba9e09927634079bb0632509d3a2d9bafdba15d75a8f05b98ec

  • SHA512

    4b1f86468ac9949f01fb746027ff3c7defac126cb0e7db1f9cd2b9ef342671575badd19f960994b84228aca5342de0509eec078ab6b02c8d5903399b51901a1c

  • SSDEEP

    24576:/T2gIAMGk8TeOHlRPsZXwYcYxaG1HLYBMGFY1nr6rqQBfgRFemkp9UDKD2acoU8g:/TaGkBOFRPsJwRgnkBFmevBQLYf+Jy

Malware Config

Extracted

Family

lumma

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\343b51b34ac69ba9e09927634079bb0632509d3a2d9bafdba15d75a8f05b98ec.exe
    "C:\Users\Admin\AppData\Local\Temp\343b51b34ac69ba9e09927634079bb0632509d3a2d9bafdba15d75a8f05b98ec.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Users\Admin\AppData\Local\Temp\6KUAE2563U81RSNJ7NR07RF.exe
      "C:\Users\Admin\AppData\Local\Temp\6KUAE2563U81RSNJ7NR07RF.exe"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Windows security modification
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4592
    • C:\Users\Admin\AppData\Local\Temp\ULVXLR13HNK6G7IMA11MQHNI.exe
      "C:\Users\Admin\AppData\Local\Temp\ULVXLR13HNK6G7IMA11MQHNI.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6KUAE2563U81RSNJ7NR07RF.exe

    Filesize

    1.7MB

    MD5

    5ee16489ab5a0d6cf49a20e9fdae3681

    SHA1

    b531e0dd6cf1ec02f0bebf334e0a8ca286a12cf3

    SHA256

    85e590af5f8e19dd85fd3471dcffb1ea1fa0f6cc3084ef50c6b44f02244e1075

    SHA512

    e923a07668fc965eed5adc066cb1991ce8517bd633348da37f7ae32c46624ef29d3d9d8145bbcad9b2112304387a8b348fe37deb700c384b0185595f64a48bfe

  • C:\Users\Admin\AppData\Local\Temp\ULVXLR13HNK6G7IMA11MQHNI.exe

    Filesize

    2.8MB

    MD5

    dfc4ac821d77ac74e88a8d6806f3b381

    SHA1

    328c4646185f83623b64acc275314337cb8507af

    SHA256

    f1fa0545bde183d84cb9b24d6635ffb5ab98bd398659e92adcbb5dc90064531d

    SHA512

    5aee1cf473a623a0b6c659a337d1960e395d67c94fc54a230b9b70936f2ad2bf983547f9c76e13ff20c37fb34dd8185cd8e5d96979f91f9749626e6fa902a2fe

  • memory/1016-20-0x0000000000B90000-0x0000000001092000-memory.dmp

    Filesize

    5.0MB

  • memory/1016-22-0x0000000000B90000-0x0000000001092000-memory.dmp

    Filesize

    5.0MB

  • memory/2412-5-0x00000000009F0000-0x0000000000E9B000-memory.dmp

    Filesize

    4.7MB

  • memory/2412-21-0x00000000009F0000-0x0000000000E9B000-memory.dmp

    Filesize

    4.7MB

  • memory/2412-6-0x00000000009F0000-0x0000000000E9B000-memory.dmp

    Filesize

    4.7MB

  • memory/2412-7-0x00000000009F0000-0x0000000000E9B000-memory.dmp

    Filesize

    4.7MB

  • memory/2412-4-0x00000000009F0000-0x0000000000E9B000-memory.dmp

    Filesize

    4.7MB

  • memory/2412-3-0x00000000009F0000-0x0000000000E9B000-memory.dmp

    Filesize

    4.7MB

  • memory/2412-2-0x00000000009F1000-0x0000000000A16000-memory.dmp

    Filesize

    148KB

  • memory/2412-1-0x0000000077394000-0x0000000077396000-memory.dmp

    Filesize

    8KB

  • memory/2412-0-0x00000000009F0000-0x0000000000E9B000-memory.dmp

    Filesize

    4.7MB

  • memory/4592-14-0x0000000000920000-0x0000000000D8E000-memory.dmp

    Filesize

    4.4MB

  • memory/4592-13-0x0000000000920000-0x0000000000D8E000-memory.dmp

    Filesize

    4.4MB

  • memory/4592-12-0x0000000000920000-0x0000000000D8E000-memory.dmp

    Filesize

    4.4MB

  • memory/4592-23-0x0000000000920000-0x0000000000D8E000-memory.dmp

    Filesize

    4.4MB

  • memory/4592-27-0x0000000000920000-0x0000000000D8E000-memory.dmp

    Filesize

    4.4MB