Resubmissions

10-01-2025 20:32

250110-zbg4yswlht 10

10-01-2025 18:08

250110-wqvf2s1pfz 10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-01-2025 20:32

General

  • Target

    DogusignReader1.26g.msi

  • Size

    10.5MB

  • MD5

    35f774e65e57f419fff8d8f74945ea51

  • SHA1

    c3e1d2d50a9bbca445576e0d71c6984cc1dc60bb

  • SHA256

    d00a3e22e53210acbd5c3e39b85332e3d47c8ec001d2bbf7a13abb07427bbba2

  • SHA512

    34db08df1751754159ca37249dd8a66a811150e2a0bbdc020858f5ee55f9fb8ef763bb74bbb723633f79ea9fde8dd0feeb0c79e0c442ca6f15a8c6d8ffa58a26

  • SSDEEP

    196608:xaZKIcPtwQbOmV7SPjZJrtiXPFsKASDdybmR67JU6OpkKM1sQT9nAJDPMRAl6q7r:Y3cPt30JrtiXdsKAcrR67J0kR1syAtMU

Malware Config

Extracted

Family

lumma

C2

https://robinsharez.shop/api

https://handscreamny.shop/api

https://chipdonkeruz.shop/api

https://versersleep.shop/api

https://crowdwarek.shop/api

https://apporholis.shop/api

https://femalsabler.shop/api

https://soundtappysk.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 16 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\DogusignReader1.26g.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3920
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4176
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4576
      • C:\Users\Admin\AppData\Local\Yarrow\RttHlp.exe
        "C:\Users\Admin\AppData\Local\Yarrow\RttHlp.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Users\Admin\AppData\Roaming\configRemote_PZ4\RttHlp.exe
          C:\Users\Admin\AppData\Roaming\configRemote_PZ4\RttHlp.exe
          3⤵
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:4260
          • C:\Users\Admin\AppData\Roaming\configRemote_PZ4\OBWZNIMQKWP\RttHlp.exe
            C:\Users\Admin\AppData\Roaming\configRemote_PZ4\OBWZNIMQKWP\RttHlp.exe
            4⤵
            • Suspicious use of SetThreadContext
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1624
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\SysWOW64\cmd.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2284
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4852
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:4552
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              5⤵
              • System Location Discovery: System Language Discovery
              PID:904
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4476

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e579991.rbs

      Filesize

      8KB

      MD5

      2ed809e31f495b248deaedf543347faa

      SHA1

      65096801f9fbed4807bfd5a7763654cc58749510

      SHA256

      bbbc983eb5442971ad8dddd8a41b90e282f9b65e92334fad6d54f837e77e494a

      SHA512

      bdc3b85107a454de965158c968e1cc2613fb5e5cc7c0f380a9b589a0b0fe842c9ae0f69ec838ea5d03a75fc7455ff617416dc06b88c23ac353d0dbdf2e8f81fd

    • C:\Users\Admin\AppData\Local\Temp\1d2f3feb

      Filesize

      12.9MB

      MD5

      292e1de184fa9ca75e51655a6b4f6a29

      SHA1

      f77a35c6ee97fde2db7ec907429ce3a3c1253779

      SHA256

      3f79bd84af57b8e9d4b563009e0757e5b874680154b1d99ff766378280c5ffd7

      SHA512

      e38bc37622bb393971da43c186e7649aa6e1d1f767e66f4cd9137385d2b5def64a047a1ca3ac7bf911bd8958f609555ba6e2c52b2327edef1d3c738a8585100e

    • C:\Users\Admin\AppData\Local\Temp\218fc9d9

      Filesize

      1.0MB

      MD5

      1baaf964219fb1ba94f0cc0f42f0db98

      SHA1

      4606493dc4830bbbd9f1ca62e3868ce00c143974

      SHA256

      f69e8e44c00bbb583900f9218e859589fbeca65b14bf540b5f16906322d421f2

      SHA512

      3a4c9f8c394fa915f115aacaefca6adb69b5d911741f0535f3c8d0ac8107894162e98cf6330847e611fb87f492efd184114f66b9996464f092b6f96ba197e997

    • C:\Users\Admin\AppData\Local\Yarrow\Register.dll

      Filesize

      1.0MB

      MD5

      40b9628354ef4e6ef3c87934575545f4

      SHA1

      8fb5da182dea64c842953bf72fc573a74adaa155

      SHA256

      372b14fce2eb35b264f6d4aeef7987da56d951d3a09ef866cf55ed72763caa12

      SHA512

      02b0ea82efbfbe2e7308f86bfbec7a5109f3fe91d42731812d2e46aebedce50aabc565d2da9d3fbcd0f46febbff49c534419d1a91e0c14d5a80f06b74888c641

    • C:\Users\Admin\AppData\Local\Yarrow\RttHlp.exe

      Filesize

      135KB

      MD5

      a2d70fbab5181a509369d96b682fc641

      SHA1

      22afcdc180400c4d2b9e5a6db2b8a26bff54dd38

      SHA256

      8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473

      SHA512

      219c6e7e88004fad9f4392be9a852c58fc43b7f6900e40370991427f37eaea5c18f48d2954f9479dde8bcb787345f4e292d5620add8224aec4d93d7968820b83

    • C:\Users\Admin\AppData\Local\Yarrow\burro.ini

      Filesize

      10.5MB

      MD5

      95a61e7f85bc8b48e6e52992d39eefc6

      SHA1

      df90ab3e50a7e566948ff56dde540139d23934c0

      SHA256

      0cea6a8a1b71eaaf329b70552ebe353d1a468ae2da5ac9c018d1927b55406bf5

      SHA512

      7a2ebb2caebe5efed73b701ee96a7880dea32301776a16beb288ab008531b396d06e36f6d0c4e60590c02355b4e1fc206e1468bc181042900fc18bc7b9f20086

    • C:\Users\Admin\AppData\Local\Yarrow\magnesium.csv

      Filesize

      52KB

      MD5

      038c02b1cdce1b2738c09d9d2b8bbd74

      SHA1

      0f20d6c4a1cb65ca8a33c613b0f297148f9a39b2

      SHA256

      ff5f5110ca6ca5d57db34ec4ea566d28d4b2535d71540331448711a25a89b3f4

      SHA512

      afb692a8bddf29feb352a3129165c045187c5a41ac134515d5d5ff884b26f24789113929e9c49f0277b8e509755566f5725be05d15a268fd07f03771ab004717

    • C:\Users\Admin\AppData\Local\Yarrow\rtl120.bpl

      Filesize

      1.1MB

      MD5

      adf82ed333fb5567f8097c7235b0e17f

      SHA1

      e6ccaf016fc45edcdadeb40da64c207ddb33859f

      SHA256

      d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50

      SHA512

      2253c7b51317a3b5734025b6c7639105dbc81c340703718d679a00c13d40dd74ccaba1f6d04b21ee440f19e82ba680aa4b2a6a75c618aed91bd85a132be9fc92

    • C:\Users\Admin\AppData\Local\Yarrow\vcl120.bpl

      Filesize

      1.9MB

      MD5

      37c89f8997af129d230837c87997b737

      SHA1

      5031df412eaf09cc72688e7865e4604cda6c2fbd

      SHA256

      f3ea5d6457089b4c4ab207f0b96dd5f321cdc7b3360ca27cd6ed273ec25d807e

      SHA512

      3ede7277cb8d16c83e65bb6e6626f30b124ff9cb1579cfc8fbea7358489f9520d416238e998707219b4b0debb6cc1fc2634133f2fe9457a840d8b2bc76ddb3bf

    • C:\Users\Admin\AppData\Roaming\configRemote_PZ4\OBWZNIMQKWP\burro.ini

      Filesize

      791KB

      MD5

      28431839e39dffad0485cc51b34c705f

      SHA1

      0b63857ea0abe841fdae8fd8b9f9b3ef0af881a0

      SHA256

      d832c2fd66e09b3eb829901fa6e7a2b610a398d8e007d6352edf4763ea3ce363

      SHA512

      cca16a18f52f2d059308214897673acd48cfca144a5075fba372ad33b8c645d202ebf32576d9d299d95e37e059d78dfdf70f7e844c479bd8c8484dc06bfe9d03

    • C:\Windows\Installer\e579990.msi

      Filesize

      10.5MB

      MD5

      35f774e65e57f419fff8d8f74945ea51

      SHA1

      c3e1d2d50a9bbca445576e0d71c6984cc1dc60bb

      SHA256

      d00a3e22e53210acbd5c3e39b85332e3d47c8ec001d2bbf7a13abb07427bbba2

      SHA512

      34db08df1751754159ca37249dd8a66a811150e2a0bbdc020858f5ee55f9fb8ef763bb74bbb723633f79ea9fde8dd0feeb0c79e0c442ca6f15a8c6d8ffa58a26

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

      Filesize

      24.6MB

      MD5

      a59f38d3ec31b2529727a4b34a44ce23

      SHA1

      de98c8b9d657b01288639c29824b8b95e9f3c59d

      SHA256

      7d4aa517f0db2fa9cf41279dfb7e9fdd47a4e526663e31fa743310d266f55e34

      SHA512

      2c563bc64148b3a3122812a24281f3cafa75eb4fcea57f4dd7584cf2a22b8e7d4cd4054b918c65a6d23cfeb25a99c4ec2643def30dc18beea8842dc7a2a32513

    • \??\Volume{78425248-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d4c2de6e-9473-49df-abf5-8c896920768b}_OnDiskSnapshotProp

      Filesize

      6KB

      MD5

      b6cbd825b6bc559a64f1553bc899c565

      SHA1

      5ed83198450abafe9203c3b9d3dd10db9dfb584f

      SHA256

      fa065210c39a3223b8d8617a864522820847f78fda72e0ab6f22e53023bbe65f

      SHA512

      8ccb9ba91c0343f097a34f45d148a4c8f598224e7355244bc4b891b0c128c6a1d87a83113320bec528a375b2ec45939ceb85a2ac34d8491a000bd7e4e88e8cc5

    • memory/904-119-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/904-117-0x00007FF85AE40000-0x00007FF85B049000-memory.dmp

      Filesize

      2.0MB

    • memory/904-140-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/904-139-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/904-138-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/904-137-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/904-135-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/904-134-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/904-133-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/904-132-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/904-128-0x0000000001600000-0x0000000001D74000-memory.dmp

      Filesize

      7.5MB

    • memory/1624-96-0x0000000050000000-0x0000000050116000-memory.dmp

      Filesize

      1.1MB

    • memory/1624-93-0x0000000074DA0000-0x0000000074F1D000-memory.dmp

      Filesize

      1.5MB

    • memory/1624-90-0x0000000074DA0000-0x0000000074F1D000-memory.dmp

      Filesize

      1.5MB

    • memory/1624-91-0x00007FF85AE40000-0x00007FF85B049000-memory.dmp

      Filesize

      2.0MB

    • memory/2284-104-0x00007FF85AE40000-0x00007FF85B049000-memory.dmp

      Filesize

      2.0MB

    • memory/2284-112-0x0000000074DA0000-0x0000000074F1D000-memory.dmp

      Filesize

      1.5MB

    • memory/2640-40-0x0000000074DA0000-0x0000000074F1D000-memory.dmp

      Filesize

      1.5MB

    • memory/2640-53-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2640-57-0x0000000050120000-0x000000005030D000-memory.dmp

      Filesize

      1.9MB

    • memory/2640-54-0x0000000050000000-0x0000000050116000-memory.dmp

      Filesize

      1.1MB

    • memory/2640-41-0x00007FF85AE40000-0x00007FF85B049000-memory.dmp

      Filesize

      2.0MB

    • memory/4260-64-0x0000000074DA0000-0x0000000074F1D000-memory.dmp

      Filesize

      1.5MB

    • memory/4260-102-0x0000000050000000-0x0000000050116000-memory.dmp

      Filesize

      1.1MB

    • memory/4260-61-0x0000000074DA0000-0x0000000074F1D000-memory.dmp

      Filesize

      1.5MB

    • memory/4260-62-0x00007FF85AE40000-0x00007FF85B049000-memory.dmp

      Filesize

      2.0MB

    • memory/4260-92-0x0000000074DA0000-0x0000000074F1D000-memory.dmp

      Filesize

      1.5MB

    • memory/4552-111-0x00007FF85AE40000-0x00007FF85B049000-memory.dmp

      Filesize

      2.0MB

    • memory/4852-116-0x00007FF85AE40000-0x00007FF85B049000-memory.dmp

      Filesize

      2.0MB

    • memory/4852-126-0x0000000000C30000-0x0000000000C8A000-memory.dmp

      Filesize

      360KB

    • memory/4852-118-0x0000000000C30000-0x0000000000C8A000-memory.dmp

      Filesize

      360KB