80a8fee2e4d5909bf2dbe60be97d7ea44bbc5d9e3745caf83a06653287ea229c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2024, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b50d06fdc5a763244d12f5d2e7c1ee3c.exe
Size 5.9MB
Sample241227-jgem1ssret
SHA256 80a8fee2e4d5909bf2dbe60be97d7ea44bbc5d9e3745caf83a06653287ea229c
MD5 b50d06fdc5a763244d12f5d2e7c1ee3c
SHA1 3c809781c51c973199894746f7dab09ca9c6a416
SHA512 eb52ddb0c3d66bfae4e48b96d97c2f95eebbc9e4832952fbd52926d73af29dab3766231fd03946ffb6f348c7d3f9dfe3b09754c038a48e6358d8cba689a0ea64
SSDEEP 98304:LkkKwG21Ovtlc2jHCyHPmfttKL8K1mTMKd3VU0rfBKUmlShrxlxrWVpcb:LPKbHlc22yvmVtkx1nC1UVlSlxrWs
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Set-up.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b50d06fdc5a763244d12f5d2e7c1ee3c.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b50d06fdc5a763244d12f5d2e7c1ee3c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b50d06fdc5a763244d12f5d2e7c1ee3c.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	b50d06fdc5a763244d12f5d2e7c1ee3c.exe

Executes dropped EXE 2 IoCs

pid	Process
1132	LummaC2.exe
3320	Set-up.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	b50d06fdc5a763244d12f5d2e7c1ee3c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
844	b50d06fdc5a763244d12f5d2e7c1ee3c.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000b000000023b77-15.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b50d06fdc5a763244d12f5d2e7c1ee3c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LummaC2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
844	b50d06fdc5a763244d12f5d2e7c1ee3c.exe
844	b50d06fdc5a763244d12f5d2e7c1ee3c.exe
3320	Set-up.exe
3320	Set-up.exe
3320	Set-up.exe
3320	Set-up.exe
3320	Set-up.exe
3320	Set-up.exe
3320	Set-up.exe
3320	Set-up.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1132	844	b50d06fdc5a763244d12f5d2e7c1ee3c.exe	83
PID 844 wrote to memory of 1132	844	b50d06fdc5a763244d12f5d2e7c1ee3c.exe	83
PID 844 wrote to memory of 1132	844	b50d06fdc5a763244d12f5d2e7c1ee3c.exe	83
PID 844 wrote to memory of 3320	844	b50d06fdc5a763244d12f5d2e7c1ee3c.exe	84
PID 844 wrote to memory of 3320	844	b50d06fdc5a763244d12f5d2e7c1ee3c.exe	84
PID 844 wrote to memory of 3320	844	b50d06fdc5a763244d12f5d2e7c1ee3c.exe	84

C:\Users\Admin\AppData\Local\Temp\b50d06fdc5a763244d12f5d2e7c1ee3c.exe
"C:\Users\Admin\AppData\Local\Temp\b50d06fdc5a763244d12f5d2e7c1ee3c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\LummaC2.exe
  "C:\Users\Admin\AppData\Local\Temp\LummaC2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1132
- C:\Users\Admin\AppData\Local\Temp\Set-up.exe
  "C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LummaC2.exe

Path C:\Users\Admin\AppData\Local\Temp\LummaC2.exe
Size 292KB
SHA256 c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db
MD5 607000c61fcb5a41b8d511b5ed7625d4
SHA1 dfaa2bfea8a51b14ac089bb6a39f037e769169d1
SHA512 64940f02635ccbc2dcd42449c0c435a6a50bd00fa93d6e2e161371cdc766103ef858ccbaae4497a75576121ea7bc25ba54a9064748f9d6676989a4c9f8b50e58
SSDEEP 6144:R5s/zt4HV88/rCatOZFABeDUbLv0uC8r9qMq2E9ND43F+ZnSi4:8rtsVPrNMG9qwENs8ZJ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Set-up.exe

Path C:\Users\Admin\AppData\Local\Temp\Set-up.exe
Size 6.5MB
SHA256 73aa5ee19f0ea048dcff2f44d6fd5ac41c13e2d7e61371459e756836f72cad43
MD5 2a99036c44c996cedeb2042d389fe23c
SHA1 4f1e624bcc030e44722de26b72c8156bf57e14e8
SHA512 6907cd0e47293c8c96345ed00f2f3fa2241ce1671ee73a599837857bfb39f6c7e373aad843cc78fb550d2db10bdfe066a021cec4c8a49aecdf06a7e71edadedd
SSDEEP 98304:ty1CDpiB/weoINcERH7q/70/ske9dKVyz8SC:jViB/NooB7edGG8SC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/844-0-0x0000000000600000-0x0000000001132000-memory.dmp

Download

memory/844-1-0x0000000000600000-0x0000000001132000-memory.dmp

Download

memory/844-2-0x0000000000600000-0x0000000001132000-memory.dmp

Download

memory/844-21-0x0000000000600000-0x0000000001132000-memory.dmp

Download

memory/3320-22-0x00000000009F0000-0x0000000001080000-memory.dmp

Download

memory/3320-23-0x00000000009F0000-0x0000000001080000-memory.dmp

Download

memory/3320-26-0x00000000009F0000-0x0000000001080000-memory.dmp

Download