Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-01-2025 09:48
Static task
static1
Behavioral task
behavioral1
Sample
Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe
Resource
win7-20240903-en
General
-
Target
Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe
-
Size
2.8MB
-
MD5
43c3b035b78100db8e5920dd16a55fe7
-
SHA1
34625bce2d101a28b434bdabcf3a63e1ee9a65cf
-
SHA256
87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3
-
SHA512
ffb80a41b9d6f5ea941b9ca3b7c98ed5382c43341470a7176a9961efb7581a509252a0e93565861ce9e8bc11a29b6dc3c57080bbee56e72f8597c490b0cbc03c
-
SSDEEP
49152:QDFgUO8t8YRy93MUPCt6+zevPxD7JxMaOPROG7:QqUOMtM93MuRfMaOPROG
Malware Config
Extracted
lumma
https://hummskitnj.buzz/api
https://cashfuzysao.buzz/api
https://appliacnesot.buzz/api
https://screwamusresz.buzz/api
https://inherineau.buzz/api
https://scentniej.buzz/api
https://rebuildeso.buzz/api
https://prisonyfork.buzz/api
https://mindhandru.buzz/api
Signatures
-
Lumma family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1968 Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1968 Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe"C:\Users\Admin\AppData\Local\Temp\Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1968
Network
-
Remote address:8.8.8.8:53Requestmindhandru.buzzIN AResponse
-
Remote address:8.8.8.8:53Requestprisonyfork.buzzIN AResponse
-
Remote address:8.8.8.8:53Requestrebuildeso.buzzIN AResponse
-
Remote address:8.8.8.8:53Requestscentniej.buzzIN AResponse
-
Remote address:8.8.8.8:53Requestinherineau.buzzIN AResponse
-
DNSscrewamusresz.buzzSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exeRemote address:8.8.8.8:53Requestscrewamusresz.buzzIN AResponse
-
Remote address:8.8.8.8:53Requestappliacnesot.buzzIN AResponse
-
Remote address:8.8.8.8:53Requestcashfuzysao.buzzIN AResponse
-
Remote address:8.8.8.8:53Requesthummskitnj.buzzIN AResponse
-
DNSsteamcommunity.comSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exeRemote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A104.85.37.68
-
GEThttps://steamcommunity.com/profiles/76561199724331900Sigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exeRemote address:104.85.37.68:443RequestGET /profiles/76561199724331900 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: steamcommunity.com
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Sun, 05 Jan 2025 09:48:33 GMT
Content-Length: 35588
Connection: keep-alive
Set-Cookie: sessionid=d766f7c70e1aef38b0243683; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
-
Remote address:8.8.8.8:53Requestlev-tolstoi.comIN AResponse
-
104.85.37.68:443https://steamcommunity.com/profiles/76561199724331900tls, httpSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe1.6kB 42.9kB 24 37
HTTP Request
GET https://steamcommunity.com/profiles/76561199724331900HTTP Response
200
-
8.8.8.8:53mindhandru.buzzdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe61 B 128 B 1 1
DNS Request
mindhandru.buzz
-
8.8.8.8:53prisonyfork.buzzdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe62 B 129 B 1 1
DNS Request
prisonyfork.buzz
-
8.8.8.8:53rebuildeso.buzzdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe61 B 128 B 1 1
DNS Request
rebuildeso.buzz
-
8.8.8.8:53scentniej.buzzdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe60 B 127 B 1 1
DNS Request
scentniej.buzz
-
8.8.8.8:53inherineau.buzzdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe61 B 128 B 1 1
DNS Request
inherineau.buzz
-
8.8.8.8:53screwamusresz.buzzdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe64 B 131 B 1 1
DNS Request
screwamusresz.buzz
-
8.8.8.8:53appliacnesot.buzzdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe63 B 130 B 1 1
DNS Request
appliacnesot.buzz
-
8.8.8.8:53cashfuzysao.buzzdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe62 B 129 B 1 1
DNS Request
cashfuzysao.buzz
-
8.8.8.8:53hummskitnj.buzzdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe61 B 128 B 1 1
DNS Request
hummskitnj.buzz
-
8.8.8.8:53steamcommunity.comdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe64 B 80 B 1 1
DNS Request
steamcommunity.com
DNS Response
104.85.37.68
-
8.8.8.8:53lev-tolstoi.comdnsSigmanly_87a558691f4f69e0865bc74b8f19e4f138c033e285f0015a816cd0d975fff7b3.exe61 B 134 B 1 1
DNS Request
lev-tolstoi.com
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b