Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:53
Static task
static1
Behavioral task
behavioral1
Sample
4512e58312b81263ef4b105873e5998e.exe
Resource
win7-20240903-en
General
-
Target
4512e58312b81263ef4b105873e5998e.exe
-
Size
1.8MB
-
MD5
4512e58312b81263ef4b105873e5998e
-
SHA1
dcda032da1ee06be9df0d6c036db505c456fd50c
-
SHA256
330c33fbe18dc80716291a8507887f2b3f56161559cf8620ec9b4e3d697e2bf4
-
SHA512
71697bf3535684df2313c919f122b06fc84d119a8d51b00e28c5f528060a1710536d5a3cb71bfc5dc7edc4476a683fdbc1dcd2c95266cc84902a23c64e053962
-
SSDEEP
49152:hB9rdYPqFTZWiOZ3aiiB+oMs2QPGCOCv29V:NZYPiZORFs2vCvQ
Malware Config
Extracted
lumma
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Signatures
-
Lumma family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" WYPEU2PMT17RSBP31CJPY7157Z5B54.exe -
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4512e58312b81263ef4b105873e5998e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4512e58312b81263ef4b105873e5998e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4512e58312b81263ef4b105873e5998e.exe -
Executes dropped EXE 2 IoCs
pid Process 1676 WYPEU2PMT17RSBP31CJPY7157Z5B54.exe 552 HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine 4512e58312b81263ef4b105873e5998e.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine WYPEU2PMT17RSBP31CJPY7157Z5B54.exe -
Loads dropped DLL 4 IoCs
pid Process 1876 4512e58312b81263ef4b105873e5998e.exe 1876 4512e58312b81263ef4b105873e5998e.exe 1876 4512e58312b81263ef4b105873e5998e.exe 1876 4512e58312b81263ef4b105873e5998e.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" WYPEU2PMT17RSBP31CJPY7157Z5B54.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1876 4512e58312b81263ef4b105873e5998e.exe 1676 WYPEU2PMT17RSBP31CJPY7157Z5B54.exe 552 HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4512e58312b81263ef4b105873e5998e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYPEU2PMT17RSBP31CJPY7157Z5B54.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 4512e58312b81263ef4b105873e5998e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 4512e58312b81263ef4b105873e5998e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 4512e58312b81263ef4b105873e5998e.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1876 4512e58312b81263ef4b105873e5998e.exe 1876 4512e58312b81263ef4b105873e5998e.exe 1876 4512e58312b81263ef4b105873e5998e.exe 1876 4512e58312b81263ef4b105873e5998e.exe 1876 4512e58312b81263ef4b105873e5998e.exe 1676 WYPEU2PMT17RSBP31CJPY7157Z5B54.exe 552 HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe 1676 WYPEU2PMT17RSBP31CJPY7157Z5B54.exe 1676 WYPEU2PMT17RSBP31CJPY7157Z5B54.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1676 WYPEU2PMT17RSBP31CJPY7157Z5B54.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1676 1876 4512e58312b81263ef4b105873e5998e.exe 31 PID 1876 wrote to memory of 1676 1876 4512e58312b81263ef4b105873e5998e.exe 31 PID 1876 wrote to memory of 1676 1876 4512e58312b81263ef4b105873e5998e.exe 31 PID 1876 wrote to memory of 1676 1876 4512e58312b81263ef4b105873e5998e.exe 31 PID 1876 wrote to memory of 552 1876 4512e58312b81263ef4b105873e5998e.exe 32 PID 1876 wrote to memory of 552 1876 4512e58312b81263ef4b105873e5998e.exe 32 PID 1876 wrote to memory of 552 1876 4512e58312b81263ef4b105873e5998e.exe 32 PID 1876 wrote to memory of 552 1876 4512e58312b81263ef4b105873e5998e.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4512e58312b81263ef4b105873e5998e.exe"C:\Users\Admin\AppData\Local\Temp\4512e58312b81263ef4b105873e5998e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\WYPEU2PMT17RSBP31CJPY7157Z5B54.exe"C:\Users\Admin\AppData\Local\Temp\WYPEU2PMT17RSBP31CJPY7157Z5B54.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Users\Admin\AppData\Local\Temp\HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe"C:\Users\Admin\AppData\Local\Temp\HL4D3LH3AEVQKRUML6FBSI0TBHQ.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:552
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2.7MB
MD5696ee1c9d08773339efe314269dcf7f5
SHA121bfb4fcb39ccc3969a0d07cf743b113d64a1c63
SHA25657014fe84559fa166db76f925753b65e9b18fc6e175e7c6900b67b4487e6c519
SHA512eb7b0ca0510d332c123c2cdd998e7c8af22f1922ff5f1f8075c8774a93e46268e7965d9ec763f45ad8cd70a0e649dd3041338c2638792a9552590f3922463e14
-
Filesize
1.7MB
MD59dfbaebce6e517991f34b94c67a038e2
SHA182fc1e85fe38a59248fc43837a6f0d32f3f0c0be
SHA2561b625c9923c41449ed1fdce417c57890367204340c2236b4b2f44ca864ae14ad
SHA512dd88abb1f9d0b0fd441e9333b64a88c5f66fb40c8f1ca8c98e4d04299e970410ddc49b60eadfbe7b76a74ef0a4d39cca270d4364d9d83ab66e777ca44257d4d4