Analysis
-
max time kernel
81s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2025 13:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
General
-
Target
Bootstrapper.exe
-
Size
2.2MB
-
MD5
8ad45fd72a78fb731a2ba19df0149cae
-
SHA1
a0614e43edaa61ee50f750c95e5a9361ee76fc3d
-
SHA256
5612aad58f43e1beb974deda0f1f678e1a4b5f74dbb07a94db5b9558f2814426
-
SHA512
f94c257a90526a86fb93f0d2fbae87fa4326a3c35aac62c0cc46ee2b2b5f94faefd8d6535594e2d0e317b4c3e4ee468bf3b2b0876ee59440f7a2270d45adacea
-
SSDEEP
49152:XH4x4BZeJlzHKRiqhT2WqNUiF4rc1XbDc:Ix4BZeJlzHK
Malware Config
Extracted
Family
lumma
C2
https://uprootquincju.shop/api
Signatures
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bootstrapper.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3256 taskmgr.exe Token: SeSystemProfilePrivilege 3256 taskmgr.exe Token: SeCreateGlobalPrivilege 3256 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe 3256 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4792
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3256
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4764