Analysis
-
max time kernel
95s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2025 19:42
Static task
static1
Behavioral task
behavioral1
Sample
8d1058166d3845c6d3858d7dd080d95268356c95e3d64de6825c21a688a9fda4N.dll
Resource
win7-20240903-en
General
-
Target
8d1058166d3845c6d3858d7dd080d95268356c95e3d64de6825c21a688a9fda4N.dll
-
Size
440KB
-
MD5
558a7b52e960079037b02363d58729c0
-
SHA1
a692f6560cd0f6f1fc2b4e8aa4c3683c150af80a
-
SHA256
8d1058166d3845c6d3858d7dd080d95268356c95e3d64de6825c21a688a9fda4
-
SHA512
4def6b88e4a4a39478192c96abdd9521740cf9fef1c11716ef1b7ef38c60d40ff19e81d4d22c71ed934a2f20d51c22d9728fe72f9f65e9e67b926207b0a779b1
-
SSDEEP
6144:eeTlgNrF2F8WgbDzY2JqMPhU+j4tzVZ1YrsldGcGg3Z9m3Kaq/e35aKWMP52:l8kWzY2lhUBzV34eTjeBqG3t52
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2928 set thread context of 3752 2928 rundll32.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_regiis.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4656 wrote to memory of 2928 4656 rundll32.exe 82 PID 4656 wrote to memory of 2928 4656 rundll32.exe 82 PID 4656 wrote to memory of 2928 4656 rundll32.exe 82 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83 PID 2928 wrote to memory of 3752 2928 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1058166d3845c6d3858d7dd080d95268356c95e3d64de6825c21a688a9fda4N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1058166d3845c6d3858d7dd080d95268356c95e3d64de6825c21a688a9fda4N.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3752
-
-