Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/01/2025, 09:36

General

  • Target

    vcpkgsrv.exe

  • Size

    1.4MB

  • MD5

    38901633c833cba7f682472ced0dbe4b

  • SHA1

    0c11a1ac834d2b270ba60f3605109933ca11a7f0

  • SHA256

    a5c5487194f761dac90e178c9c1753c0f47b041f3168b5c23a587f33f69e5089

  • SHA512

    70d71197c68c9a92883c482aee76978e2a01e785be6fb3b6082369e25d991d3e03d8467e11d87493e54f5a3dc4bcd59fa588f0fabe5f6fdcf3361de95cb471c1

  • SSDEEP

    24576:gLikjHtEvSKi9Q8K8Nj99HxJ+EbUUbnI11f4wuTLoYHTkPQ4JD7eK:gukT+SpRKaJb0f4wrCSP

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://babbebange.cyou/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vcpkgsrv.exe
    "C:\Users\Admin\AppData\Local\Temp\vcpkgsrv.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Users\Admin\AppData\Roaming\debugclientFBJ_test\vcpkgsrv.exe
      C:\Users\Admin\AppData\Roaming\debugclientFBJ_test\vcpkgsrv.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4428
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e5c3c49a

    Filesize

    1.0MB

    MD5

    98ba52d12b959601a09d2a21ff80846e

    SHA1

    c34c84c3a5a970fffe7f56ce23448f2db07fed3c

    SHA256

    e739f29a9b6708d248664f80305617cf6f17a36bffa02da32aa350b5c4effbfd

    SHA512

    faf35ce7b4da6cd37798d50ab4a792f191f5ed57d2f3b2a8b61ec54c33b009ab0cd846ed7929446476ee8351a9c60aca8b9886a0539fcc95268f893e01d77de6

  • C:\Users\Admin\AppData\Roaming\debugclientFBJ_test\ambrosia.ini

    Filesize

    42KB

    MD5

    15ac4906fc1a97ee9a7e7cb9d7cf6ead

    SHA1

    56b35e83890c288cecdc5602ddbc092c535dfbc2

    SHA256

    0a50686aaf89b1c3a2f14e1a8add5cb4022056f1157ff12cc108346052d37436

    SHA512

    66922e9e2afe919769d0e7ae2ae48998bf2f66fb52bb140849344b34a7d86335d17b85f6cde0aa0ff104925fa243e9cbcf0a8bff153024dd93f2616bf35c8700

  • C:\Users\Admin\AppData\Roaming\debugclientFBJ_test\chibouk.7z

    Filesize

    799KB

    MD5

    c261816b33c925edce9e6d823fdf3625

    SHA1

    2ffd098a3ecfb06236087985403b47e0c652d65a

    SHA256

    9cf23899670946140169dcfaaa93513f995290f9e7cb761f782947d1991b4c2a

    SHA512

    010c9c68f3f596c2604218ddb1096c862098e8b72badad387951188631b7516f688edf6daa4d3ccec077a837155bdce560192dffc8de2764f1a4a74d8984f310

  • C:\Users\Admin\AppData\Roaming\debugclientFBJ_test\concrt140.dll

    Filesize

    254KB

    MD5

    f36dae6ea00f102b60a5011af0732123

    SHA1

    06fabdbf1fa14b5a637716f9f7a28c95ea4a8661

    SHA256

    0a3894dd420ed6b4c7ebbde463dbbde69cdb032e290b1c86c21ccdaa4da95526

    SHA512

    c585e25ac9d733ca82d36d4cee0fa5f7d34a0455c359e010c501d1474c612bc73429093ba302ae14222d7e3a89d5b11777529b3005c7c0966aff06c92c7cce12

  • C:\Users\Admin\AppData\Roaming\debugclientFBJ_test\cpfe.dll

    Filesize

    4.9MB

    MD5

    eda3dbb0f36ecd094b7e11a8a3eba68f

    SHA1

    4ac9722cdf74dc609935c1e450e242aa5b2301da

    SHA256

    a57f3db4c4c489fc743960915dd4319c4d2e55046dab1813fbf3b2fe4e133ae5

    SHA512

    2e59fbee929a8452e201fab5661b6b46ed994b9c47405732062ab1719c41c5709b7c78f42ea764576194d9a72b23456de8ac2b5d5cb0aa7af89db4f5ecc3fd4a

  • C:\Users\Admin\AppData\Roaming\debugclientFBJ_test\msvcp140.dll

    Filesize

    437KB

    MD5

    dc739066c9d0ca961cba2f320cade28e

    SHA1

    81ed5f7861e748b90c7ae2d18da80d1409d1fa05

    SHA256

    74e9268a68118bb1ac5154f8f327887715960ccc37ba9dabbe31ecd82dcbaa55

    SHA512

    4eb181984d989156b8703fd8bb8963d7a5a3b7f981fe747c6992993b7a1395a21f45dbedf08c1483d523e772bdf41330753e1771243b53da36d2539c01171cf1

  • C:\Users\Admin\AppData\Roaming\debugclientFBJ_test\vcpkgsrv.exe

    Filesize

    1.4MB

    MD5

    38901633c833cba7f682472ced0dbe4b

    SHA1

    0c11a1ac834d2b270ba60f3605109933ca11a7f0

    SHA256

    a5c5487194f761dac90e178c9c1753c0f47b041f3168b5c23a587f33f69e5089

    SHA512

    70d71197c68c9a92883c482aee76978e2a01e785be6fb3b6082369e25d991d3e03d8467e11d87493e54f5a3dc4bcd59fa588f0fabe5f6fdcf3361de95cb471c1

  • C:\Users\Admin\AppData\Roaming\debugclientFBJ_test\vcruntime140.dll

    Filesize

    88KB

    MD5

    1d4ff3cf64ab08c66ae9a4013c89a3ac

    SHA1

    f9ee15d0e9b0b7e04ff4c8a5de5afcffe8b2527b

    SHA256

    65f620bc588d95fe2ed236d1602e49f89077b434c83102549eed137c7fdc7220

    SHA512

    65fbd68843280e933620c470e524fba993ab4c48ede4bc0917b4ebe25da0408d02daec3f5afcd44a3ff8aba676d2eff2dda3f354029d27932ef39c9fdea51c26

  • memory/1072-37-0x0000000000910000-0x000000000096C000-memory.dmp

    Filesize

    368KB

  • memory/1072-39-0x0000000000910000-0x000000000096C000-memory.dmp

    Filesize

    368KB

  • memory/1072-38-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

    Filesize

    2.0MB

  • memory/1476-31-0x0000000074D20000-0x0000000074E9B000-memory.dmp

    Filesize

    1.5MB

  • memory/1476-28-0x0000000074D20000-0x0000000074E9B000-memory.dmp

    Filesize

    1.5MB

  • memory/1476-30-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

    Filesize

    2.0MB

  • memory/1476-32-0x0000000074D20000-0x0000000074E9B000-memory.dmp

    Filesize

    1.5MB

  • memory/1476-36-0x0000000074D20000-0x0000000074E9B000-memory.dmp

    Filesize

    1.5MB

  • memory/4428-25-0x0000000074D20000-0x0000000074E9B000-memory.dmp

    Filesize

    1.5MB

  • memory/4428-26-0x0000000074D20000-0x0000000074E9B000-memory.dmp

    Filesize

    1.5MB

  • memory/4428-24-0x0000000074D33000-0x0000000074D35000-memory.dmp

    Filesize

    8KB

  • memory/4428-23-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

    Filesize

    2.0MB

  • memory/4428-22-0x0000000074D20000-0x0000000074E9B000-memory.dmp

    Filesize

    1.5MB

  • memory/4728-1-0x00007FFF06A70000-0x00007FFF06C65000-memory.dmp

    Filesize

    2.0MB

  • memory/4728-0-0x0000000074D20000-0x0000000074E9B000-memory.dmp

    Filesize

    1.5MB