Analysis
-
max time kernel
32s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-01-2025 18:16
Static task
static1
Behavioral task
behavioral1
Sample
!Ǵe𝔱-Set_𝓤p--3315__Pǎ$$w0ɾD#!!.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
!Ǵe𝔱-Set_𝓤p--3315__Pǎ$$w0ɾD#!!.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
#Sat-Up__3315--!K𝕖yP𝓪S$!##.7z
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
#Sat-Up__3315--!K𝕖yP𝓪S$!##.7z
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Data.txt
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Data.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Pa$$-_- 3315.jpg
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
Pa$$-_- 3315.jpg
Resource
win10v2004-20241007-en
General
-
Target
!Ǵe𝔱-Set_𝓤p--3315__Pǎ$$w0ɾD#!!.zip
-
Size
3.6MB
-
MD5
22ce8403d9dda64c32726d38c4287690
-
SHA1
dfb32356742e28f6265db932b602055e35e8d146
-
SHA256
ea29144184f05acc5f0ce350e624e3ef8d1edc5954dede3e208105de5b700f41
-
SHA512
61c79b9b8ab25c7caa6cb97c861d512c427d44216f4af69b0cb4129d231563c4c41cd2d37ed1292628e741f689493fcdfc3d211c762169ae3a095e2245a87827
-
SSDEEP
49152:jntmRkWYcofo3dpWRLXOtvtWF6rFE+UdJ:j2ufoNpWRrMB1U7
Malware Config
Extracted
lumma
https://stewkickyuope.shop/api
Signatures
-
Lumma family
-
Executes dropped EXE 1 IoCs
pid Process 2136 setup.exe -
Loads dropped DLL 3 IoCs
pid Process 2136 setup.exe 2136 setup.exe 2136 setup.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2136 setup.exe 2340 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2340 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2340 7zFM.exe Token: 35 2340 7zFM.exe Token: SeSecurityPrivilege 2340 7zFM.exe Token: SeSecurityPrivilege 2340 7zFM.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2340 7zFM.exe 2340 7zFM.exe 2340 7zFM.exe 2340 7zFM.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2136 2340 7zFM.exe 31 PID 2340 wrote to memory of 2136 2340 7zFM.exe 31 PID 2340 wrote to memory of 2136 2340 7zFM.exe 31 PID 2340 wrote to memory of 2136 2340 7zFM.exe 31 PID 2340 wrote to memory of 2136 2340 7zFM.exe 31 PID 2340 wrote to memory of 2136 2340 7zFM.exe 31 PID 2340 wrote to memory of 2136 2340 7zFM.exe 31
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\!Ǵe𝔱-Set_𝓤p--3315__Pǎ$$w0ɾD#!!.zip"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\7zO429E80C6\setup.exe"C:\Users\Admin\AppData\Local\Temp\7zO429E80C6\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2136
-
Network
-
Remote address:8.8.8.8:53Requeststewkickyuope.shopIN AResponsestewkickyuope.shopIN A172.67.200.189stewkickyuope.shopIN A104.21.50.43
-
Remote address:172.67.200.189:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: stewkickyuope.shop
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=no6g6o0dsb7ueq71odpp9q15em; expires=Wed, 14 May 2025 12:03:45 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ih23Ifak4KJl24%2FNjWD2HwfHxL%2FC9Ei%2ByihU2TX3Hlbag%2B5k7DoI%2F5rgxomChZcIKoVNcvju%2Fn%2FAfE6qTygt9fDRN7vBt8ESF%2BS%2F6ly24y%2FoSJxjvvSxWJCT0XerhXBeqAbOMzU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 90409475390163b1-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=60016&min_rtt=51696&rtt_var=25278&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2862&recv_bytes=586&delivery_rate=51745&cwnd=253&unsent_bytes=0&cid=9d579319b1b5d081&ts=360&x=0"
-
Remote address:8.8.8.8:53Requeststrivehelpeu.bondIN AResponse
-
Remote address:8.8.8.8:53Requestcrookedfoshe.bondIN AResponse
-
Remote address:8.8.8.8:53Requestimmolatechallen.bondIN AResponse
-
Remote address:8.8.8.8:53Requeststripedre-lot.bondIN AResponse
-
Remote address:8.8.8.8:53Requestgrowthselec.bondIN AResponse
-
Remote address:8.8.8.8:53Requestjarry-deatile.bondIN AResponse
-
Remote address:8.8.8.8:53Requestpain-temper.bondIN AResponse
-
Remote address:8.8.8.8:53Requestjarry-fixxer.bondIN AResponse
-
Remote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A2.22.99.85
-
Remote address:2.22.99.85:443RequestGET /profiles/76561199724331900 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: steamcommunity.com
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Sat, 18 Jan 2025 18:17:07 GMT
Content-Length: 25984
Connection: keep-alive
Set-Cookie: sessionid=ef30e15efe2b158e71b8c9e9; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
-
982 B 4.5kB 9 9
HTTP Request
POST https://stewkickyuope.shop/apiHTTP Response
200 -
1.5kB 33.1kB 21 31
HTTP Request
GET https://steamcommunity.com/profiles/76561199724331900HTTP Response
200
-
64 B 96 B 1 1
DNS Request
stewkickyuope.shop
DNS Response
172.67.200.189104.21.50.43
-
63 B 128 B 1 1
DNS Request
strivehelpeu.bond
-
63 B 128 B 1 1
DNS Request
crookedfoshe.bond
-
66 B 131 B 1 1
DNS Request
immolatechallen.bond
-
64 B 129 B 1 1
DNS Request
stripedre-lot.bond
-
62 B 127 B 1 1
DNS Request
growthselec.bond
-
64 B 129 B 1 1
DNS Request
jarry-deatile.bond
-
62 B 127 B 1 1
DNS Request
pain-temper.bond
-
63 B 128 B 1 1
DNS Request
jarry-fixxer.bond
-
64 B 80 B 1 1
DNS Request
steamcommunity.com
DNS Response
2.22.99.85
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b