Resubmissions
03/01/2025, 21:12 UTC
250103-z2cl6atlfy 1003/01/2025, 20:40 UTC
250103-zgabassmaw 1003/01/2025, 20:37 UTC
250103-zelljsvndk 1003/01/2025, 19:29 UTC
250103-x7cg8sslen 10Analysis
-
max time kernel
57s -
max time network
59s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/01/2025, 20:37 UTC
Static task
static1
Behavioral task
behavioral1
Sample
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
Resource
win10v2004-20241007-en
General
-
Target
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
-
Size
1.1MB
-
MD5
79972f296cb418a20b17d2440850d790
-
SHA1
3a096f7084a15176a30bb69126468059846c30ed
-
SHA256
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0
-
SHA512
9d0632eeb7c6907b70fe2dce984b20b0e83c1c4c9b0a2cc17c01f7b2be53171c5beb5c9fb5994ba51ebd2e83d3d8579e732535097b85681a3305914c3d89d38e
-
SSDEEP
24576:Rz/BfKdNZHQMtptCohxX+8Fn90yIJKQ0lTF0D3+kyOdsa1:hZE/HQM4ohxXz95IJKlJ0ypOdR
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Signatures
-
Lumma family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 1336 created 3228 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 53 PID 444 created 3228 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 53 -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1336 set thread context of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 444 set thread context of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Token: SeDebugPrivilege 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Token: SeDebugPrivilege 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Token: SeDebugPrivilege 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1336 wrote to memory of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 1336 wrote to memory of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 1336 wrote to memory of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 1336 wrote to memory of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 1336 wrote to memory of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 1336 wrote to memory of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 1336 wrote to memory of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 1336 wrote to memory of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 1336 wrote to memory of 2964 1336 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 78 PID 444 wrote to memory of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84 PID 444 wrote to memory of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84 PID 444 wrote to memory of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84 PID 444 wrote to memory of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84 PID 444 wrote to memory of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84 PID 444 wrote to memory of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84 PID 444 wrote to memory of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84 PID 444 wrote to memory of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84 PID 444 wrote to memory of 7304 444 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336
-
-
C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:444
-
-
C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"2⤵
- System Location Discovery: System Language Discovery
PID:7304
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3048
Network
-
Remote address:8.8.8.8:53Requestimbibelubmbe.clickIN AResponseimbibelubmbe.clickIN A172.67.165.144imbibelubmbe.clickIN A104.21.42.198
-
Remote address:8.8.8.8:53Requestnearycrepso.shopIN AResponse
-
Remote address:8.8.8.8:53Requestabruptyopsn.shopIN AResponseabruptyopsn.shopIN A104.21.64.1abruptyopsn.shopIN A104.21.48.1abruptyopsn.shopIN A104.21.96.1abruptyopsn.shopIN A104.21.80.1abruptyopsn.shopIN A104.21.32.1abruptyopsn.shopIN A104.21.112.1abruptyopsn.shopIN A104.21.16.1
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Requestwholersorie.shopIN AResponsewholersorie.shopIN A172.67.160.114wholersorie.shopIN A104.21.41.51
-
Remote address:8.8.8.8:53Requesttirepublicerj.shopIN AResponsetirepublicerj.shopIN A104.21.64.1tirepublicerj.shopIN A104.21.80.1tirepublicerj.shopIN A104.21.112.1tirepublicerj.shopIN A104.21.16.1tirepublicerj.shopIN A104.21.96.1tirepublicerj.shopIN A104.21.48.1tirepublicerj.shopIN A104.21.32.1
-
DNS114.160.67.172.in-addr.arpa14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exeRemote address:8.8.8.8:53Request114.160.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestcloudewahsj.shopIN AResponsecloudewahsj.shopIN A104.21.96.1cloudewahsj.shopIN A104.21.32.1cloudewahsj.shopIN A104.21.112.1cloudewahsj.shopIN A104.21.48.1cloudewahsj.shopIN A104.21.64.1cloudewahsj.shopIN A104.21.80.1cloudewahsj.shopIN A104.21.16.1
-
DNS127.156.67.172.in-addr.arpa14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exeRemote address:8.8.8.8:53Request127.156.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.66.21.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttirepublicerj.shopIN AResponsetirepublicerj.shopIN A104.21.96.1tirepublicerj.shopIN A104.21.112.1tirepublicerj.shopIN A104.21.80.1tirepublicerj.shopIN A104.21.32.1tirepublicerj.shopIN A104.21.16.1tirepublicerj.shopIN A104.21.48.1tirepublicerj.shopIN A104.21.64.1
-
Remote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A104.82.131.75
-
Remote address:8.8.8.8:53Request144.165.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestframekgirus.shopIN AResponseframekgirus.shopIN A104.21.18.19framekgirus.shopIN A172.67.179.160
-
Remote address:8.8.8.8:53Request1.64.21.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestnoisycuttej.shopIN AResponsenoisycuttej.shopIN A104.21.71.146noisycuttej.shopIN A172.67.170.178
-
Remote address:8.8.8.8:53Request146.71.21.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request1.96.21.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request136.63.122.92.in-addr.arpaIN PTRResponse136.63.122.92.in-addr.arpaIN PTRa92-122-63-136deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestframekgirus.shopIN AResponseframekgirus.shopIN A172.67.179.160framekgirus.shopIN A104.21.18.19
-
Remote address:8.8.8.8:53Requestnoisycuttej.shopIN AResponsenoisycuttej.shopIN A172.67.170.178noisycuttej.shopIN A104.21.71.146
-
Remote address:8.8.8.8:53Request75.131.82.104.in-addr.arpaIN PTRResponse75.131.82.104.in-addr.arpaIN PTRa104-82-131-75deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request19.18.21.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestrabidcowse.shopIN AResponserabidcowse.shopIN A172.67.156.127rabidcowse.shopIN A104.21.7.224
-
Remote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A92.122.63.136
-
Remote address:8.8.8.8:53Requestlev-tolstoi.comIN AResponselev-tolstoi.comIN A104.21.66.86lev-tolstoi.comIN A172.67.157.254
-
Remote address:8.8.8.8:53Requestnearycrepso.shopIN AResponse
-
Remote address:8.8.8.8:53Request160.179.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request178.170.67.172.in-addr.arpaIN PTRResponse
-
172.67.165.144:443imbibelubmbe.clicktls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 9
-
104.21.64.1:443abruptyopsn.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.4kB 10 10
-
172.67.160.114:443wholersorie.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 10
-
104.21.18.19:443framekgirus.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 9
-
104.21.64.1:443tirepublicerj.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 9
-
104.21.71.146:443noisycuttej.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.1kB 10 9
-
172.67.156.127:443rabidcowse.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 10
-
104.21.96.1:443cloudewahsj.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 10
-
92.122.63.136:443steamcommunity.comtls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.6kB 43.6kB 22 37
-
104.21.66.86:443lev-tolstoi.comtls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 9 10
-
172.67.165.144:443imbibelubmbe.clicktls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 9
-
104.21.64.1:443abruptyopsn.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.2kB 5.4kB 11 10
-
172.67.160.114:443wholersorie.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 10
-
172.67.179.160:443framekgirus.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 10
-
104.21.96.1:443tirepublicerj.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 9
-
172.67.170.178:443noisycuttej.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.2kB 10 10
-
172.67.156.127:443rabidcowse.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.1kB 10 9
-
104.21.96.1:443cloudewahsj.shoptls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.1kB 10 9
-
104.82.131.75:443steamcommunity.comtls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.6kB 43.6kB 23 37
-
104.21.66.86:443lev-tolstoi.comtls14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe1.1kB 5.1kB 9 9
-
8.8.8.8:53imbibelubmbe.clickdns14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe787 B 1.6kB 12 12
DNS Request
imbibelubmbe.click
DNS Response
172.67.165.144104.21.42.198
DNS Request
nearycrepso.shop
DNS Request
abruptyopsn.shop
DNS Response
104.21.64.1104.21.48.1104.21.96.1104.21.80.1104.21.32.1104.21.112.1104.21.16.1
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
wholersorie.shop
DNS Response
172.67.160.114104.21.41.51
DNS Request
tirepublicerj.shop
DNS Response
104.21.64.1104.21.80.1104.21.112.1104.21.16.1104.21.96.1104.21.48.1104.21.32.1
DNS Request
114.160.67.172.in-addr.arpa
DNS Request
cloudewahsj.shop
DNS Response
104.21.96.1104.21.32.1104.21.112.1104.21.48.1104.21.64.1104.21.80.1104.21.16.1
DNS Request
127.156.67.172.in-addr.arpa
DNS Request
86.66.21.104.in-addr.arpa
DNS Request
tirepublicerj.shop
DNS Response
104.21.96.1104.21.112.1104.21.80.1104.21.32.1104.21.16.1104.21.48.1104.21.64.1
DNS Request
steamcommunity.com
DNS Response
104.82.131.75
-
677 B 1.2kB 10 10
DNS Request
144.165.67.172.in-addr.arpa
DNS Request
framekgirus.shop
DNS Response
104.21.18.19172.67.179.160
DNS Request
1.64.21.104.in-addr.arpa
DNS Request
noisycuttej.shop
DNS Response
104.21.71.146172.67.170.178
DNS Request
146.71.21.104.in-addr.arpa
DNS Request
1.96.21.104.in-addr.arpa
DNS Request
136.63.122.92.in-addr.arpa
DNS Request
framekgirus.shop
DNS Response
172.67.179.160104.21.18.19
DNS Request
noisycuttej.shop
DNS Response
172.67.170.178104.21.71.146
DNS Request
75.131.82.104.in-addr.arpa
-
465 B 788 B 7 7
DNS Request
19.18.21.104.in-addr.arpa
DNS Request
rabidcowse.shop
DNS Response
172.67.156.127104.21.7.224
DNS Request
steamcommunity.com
DNS Response
92.122.63.136
DNS Request
lev-tolstoi.com
DNS Response
104.21.66.86172.67.157.254
DNS Request
nearycrepso.shop
DNS Request
160.179.67.172.in-addr.arpa
DNS Request
178.170.67.172.in-addr.arpa