23f525572220eef117b077bc9ee2a39729a0b9b3c58543c814084e63bfca8e34

Analysis

max time kernel
92s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/12/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7047b240f5a5e866262dfcc36f919f3d.exe
Size 5.9MB
Sample241227-q75epawmap
SHA256 23f525572220eef117b077bc9ee2a39729a0b9b3c58543c814084e63bfca8e34
MD5 7047b240f5a5e866262dfcc36f919f3d
SHA1 fe3bb7905f269927ca4f7145d0abc551b4a8e5aa
SHA512 5d5123f969ef1903e9cc49cdea7d551099f9e53620b760f13ec8c6ed076d064d2764507f557d01e326c5436b177a5e5768862a461dae8ef51788c946f0f20d3c
SSDEEP 98304:Lg9hy0Oetf5YeyIuyVIUIUogjNWiGumVNwN4HpQBr+s6Msi6diL4KjtxntM:s6pe/zyIneSosWijswNluHOtt
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Set-up.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7047b240f5a5e866262dfcc36f919f3d.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7047b240f5a5e866262dfcc36f919f3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7047b240f5a5e866262dfcc36f919f3d.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	7047b240f5a5e866262dfcc36f919f3d.exe

Executes dropped EXE 2 IoCs

pid	Process
2064	LummaC2.exe
3140	Set-up.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Wine	7047b240f5a5e866262dfcc36f919f3d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1964	7047b240f5a5e866262dfcc36f919f3d.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0009000000023bbe-15.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7047b240f5a5e866262dfcc36f919f3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LummaC2.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1964	7047b240f5a5e866262dfcc36f919f3d.exe
1964	7047b240f5a5e866262dfcc36f919f3d.exe
3140	Set-up.exe
3140	Set-up.exe
3140	Set-up.exe
3140	Set-up.exe
3140	Set-up.exe
3140	Set-up.exe
3140	Set-up.exe
3140	Set-up.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2064	1964	7047b240f5a5e866262dfcc36f919f3d.exe	83
PID 1964 wrote to memory of 2064	1964	7047b240f5a5e866262dfcc36f919f3d.exe	83
PID 1964 wrote to memory of 2064	1964	7047b240f5a5e866262dfcc36f919f3d.exe	83
PID 1964 wrote to memory of 3140	1964	7047b240f5a5e866262dfcc36f919f3d.exe	84
PID 1964 wrote to memory of 3140	1964	7047b240f5a5e866262dfcc36f919f3d.exe	84
PID 1964 wrote to memory of 3140	1964	7047b240f5a5e866262dfcc36f919f3d.exe	84

C:\Users\Admin\AppData\Local\Temp\7047b240f5a5e866262dfcc36f919f3d.exe
"C:\Users\Admin\AppData\Local\Temp\7047b240f5a5e866262dfcc36f919f3d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\LummaC2.exe
  "C:\Users\Admin\AppData\Local\Temp\LummaC2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2064
- C:\Users\Admin\AppData\Local\Temp\Set-up.exe
  "C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LummaC2.exe

Path C:\Users\Admin\AppData\Local\Temp\LummaC2.exe
Size 292KB
SHA256 c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db
MD5 607000c61fcb5a41b8d511b5ed7625d4
SHA1 dfaa2bfea8a51b14ac089bb6a39f037e769169d1
SHA512 64940f02635ccbc2dcd42449c0c435a6a50bd00fa93d6e2e161371cdc766103ef858ccbaae4497a75576121ea7bc25ba54a9064748f9d6676989a4c9f8b50e58
SSDEEP 6144:R5s/zt4HV88/rCatOZFABeDUbLv0uC8r9qMq2E9ND43F+ZnSi4:8rtsVPrNMG9qwENs8ZJ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Set-up.exe

Path C:\Users\Admin\AppData\Local\Temp\Set-up.exe
Size 6.5MB
SHA256 73aa5ee19f0ea048dcff2f44d6fd5ac41c13e2d7e61371459e756836f72cad43
MD5 2a99036c44c996cedeb2042d389fe23c
SHA1 4f1e624bcc030e44722de26b72c8156bf57e14e8
SHA512 6907cd0e47293c8c96345ed00f2f3fa2241ce1671ee73a599837857bfb39f6c7e373aad843cc78fb550d2db10bdfe066a021cec4c8a49aecdf06a7e71edadedd
SSDEEP 98304:ty1CDpiB/weoINcERH7q/70/ske9dKVyz8SC:jViB/NooB7edGG8SC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1964-0-0x0000000000620000-0x000000000114C000-memory.dmp

Download

memory/1964-1-0x0000000000620000-0x000000000114C000-memory.dmp

Download

memory/1964-2-0x0000000000620000-0x000000000114C000-memory.dmp

Download

memory/1964-21-0x0000000000620000-0x000000000114C000-memory.dmp

Download

memory/3140-22-0x00000000007A0000-0x0000000000E30000-memory.dmp

Download

memory/3140-23-0x00000000007A0000-0x0000000000E30000-memory.dmp

Download

memory/3140-24-0x00000000007A0000-0x0000000000E30000-memory.dmp

Download

memory/3140-25-0x00000000007A0000-0x0000000000E30000-memory.dmp

Download

memory/3140-26-0x00000000007A0000-0x0000000000E30000-memory.dmp

Download