Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2025, 06:17
Static task
static1
Behavioral task
behavioral1
Sample
0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe
Resource
win7-20241023-en
General
-
Target
0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe
-
Size
639.7MB
-
MD5
6ee335bab5d56ee573caa2c3daf659a6
-
SHA1
bde5744100faa5ca58fbe49c894cf8815c928dec
-
SHA256
0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577
-
SHA512
bc03e8da6cda348e3c9c436c612c35382ec5dd49ba605f19e67950d865e688f79d192eeb6fa2e5b574d65954aa3b9d93f25b4542e26f211e728f81b6b0a3f177
-
SSDEEP
98304:bnb95THK/RTSOvdhwpUPTzcAgqAk5Frd1/BpeAM:bx5THKhpvdhwc/cNBk3rdoAM
Malware Config
Extracted
lumma
https://toppyneedus.biz/api
Signatures
-
Lumma family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp -
Executes dropped EXE 3 IoCs
pid Process 4376 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 2688 RegAlyzer.exe -
Loads dropped DLL 4 IoCs
pid Process 4376 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 4376 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp -
Enumerates processes with tasklist 1 TTPs 6 IoCs
pid Process 4692 tasklist.exe 4468 tasklist.exe 4516 tasklist.exe 2280 tasklist.exe 4932 tasklist.exe 1256 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAlyzer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 2688 RegAlyzer.exe 2688 RegAlyzer.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2280 tasklist.exe Token: SeDebugPrivilege 4932 tasklist.exe Token: SeDebugPrivilege 1256 tasklist.exe Token: SeDebugPrivilege 4692 tasklist.exe Token: SeDebugPrivilege 4468 tasklist.exe Token: SeDebugPrivilege 4516 tasklist.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 4376 1640 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe 81 PID 1640 wrote to memory of 4376 1640 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe 81 PID 1640 wrote to memory of 4376 1640 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe 81 PID 4376 wrote to memory of 4156 4376 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 82 PID 4376 wrote to memory of 4156 4376 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 82 PID 4376 wrote to memory of 4156 4376 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 82 PID 4156 wrote to memory of 4508 4156 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe 83 PID 4156 wrote to memory of 4508 4156 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe 83 PID 4156 wrote to memory of 4508 4156 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe 83 PID 4508 wrote to memory of 1620 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 86 PID 4508 wrote to memory of 1620 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 86 PID 4508 wrote to memory of 1620 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 86 PID 1620 wrote to memory of 2280 1620 cmd.exe 88 PID 1620 wrote to memory of 2280 1620 cmd.exe 88 PID 1620 wrote to memory of 2280 1620 cmd.exe 88 PID 1620 wrote to memory of 2264 1620 cmd.exe 89 PID 1620 wrote to memory of 2264 1620 cmd.exe 89 PID 1620 wrote to memory of 2264 1620 cmd.exe 89 PID 4508 wrote to memory of 3360 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 91 PID 4508 wrote to memory of 3360 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 91 PID 4508 wrote to memory of 3360 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 91 PID 3360 wrote to memory of 4932 3360 cmd.exe 93 PID 3360 wrote to memory of 4932 3360 cmd.exe 93 PID 3360 wrote to memory of 4932 3360 cmd.exe 93 PID 3360 wrote to memory of 1772 3360 cmd.exe 94 PID 3360 wrote to memory of 1772 3360 cmd.exe 94 PID 3360 wrote to memory of 1772 3360 cmd.exe 94 PID 4508 wrote to memory of 4192 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 96 PID 4508 wrote to memory of 4192 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 96 PID 4508 wrote to memory of 4192 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 96 PID 4192 wrote to memory of 1256 4192 cmd.exe 98 PID 4192 wrote to memory of 1256 4192 cmd.exe 98 PID 4192 wrote to memory of 1256 4192 cmd.exe 98 PID 4192 wrote to memory of 5084 4192 cmd.exe 99 PID 4192 wrote to memory of 5084 4192 cmd.exe 99 PID 4192 wrote to memory of 5084 4192 cmd.exe 99 PID 4508 wrote to memory of 1860 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 100 PID 4508 wrote to memory of 1860 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 100 PID 4508 wrote to memory of 1860 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 100 PID 1860 wrote to memory of 4692 1860 cmd.exe 102 PID 1860 wrote to memory of 4692 1860 cmd.exe 102 PID 1860 wrote to memory of 4692 1860 cmd.exe 102 PID 1860 wrote to memory of 1376 1860 cmd.exe 103 PID 1860 wrote to memory of 1376 1860 cmd.exe 103 PID 1860 wrote to memory of 1376 1860 cmd.exe 103 PID 4508 wrote to memory of 4540 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 104 PID 4508 wrote to memory of 4540 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 104 PID 4508 wrote to memory of 4540 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 104 PID 4540 wrote to memory of 4468 4540 cmd.exe 106 PID 4540 wrote to memory of 4468 4540 cmd.exe 106 PID 4540 wrote to memory of 4468 4540 cmd.exe 106 PID 4540 wrote to memory of 4952 4540 cmd.exe 107 PID 4540 wrote to memory of 4952 4540 cmd.exe 107 PID 4540 wrote to memory of 4952 4540 cmd.exe 107 PID 4508 wrote to memory of 3448 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 108 PID 4508 wrote to memory of 3448 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 108 PID 4508 wrote to memory of 3448 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 108 PID 3448 wrote to memory of 4516 3448 cmd.exe 110 PID 3448 wrote to memory of 4516 3448 cmd.exe 110 PID 3448 wrote to memory of 4516 3448 cmd.exe 110 PID 3448 wrote to memory of 2252 3448 cmd.exe 111 PID 3448 wrote to memory of 2252 3448 cmd.exe 111 PID 3448 wrote to memory of 2252 3448 cmd.exe 111 PID 4508 wrote to memory of 2688 4508 0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe"C:\Users\Admin\AppData\Local\Temp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\is-UD0QS.tmp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp"C:\Users\Admin\AppData\Local\Temp\is-UD0QS.tmp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp" /SL5="$B0066,2550238,121344,C:\Users\Admin\AppData\Local\Temp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe"C:\Users\Admin\AppData\Local\Temp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe" /VERYSILENT3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\is-1N9E3.tmp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp"C:\Users\Admin\AppData\Local\Temp\is-1N9E3.tmp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp" /SL5="$F0052,2550238,121344,C:\Users\Admin\AppData\Local\Temp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.exe" /VERYSILENT4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\SysWOW64\find.exefind /I "wrsa.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2264
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
C:\Windows\SysWOW64\find.exefind /I "opssvc.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1772
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
-
C:\Windows\SysWOW64\find.exefind /I "avastui.exe"6⤵
- System Location Discovery: System Language Discovery
PID:5084
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Windows\SysWOW64\find.exefind /I "avgui.exe"6⤵
- System Location Discovery: System Language Discovery
PID:1376
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\SysWOW64\find.exefind /I "nswscsvc.exe"6⤵
- System Location Discovery: System Language Discovery
PID:4952
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH6⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
-
C:\Windows\SysWOW64\find.exefind /I "sophoshealth.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2252
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-DQQQU.tmp\RegAlyzer.exe"C:\Users\Admin\AppData\Local\Temp\is-DQQQU.tmp\RegAlyzer.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2688
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5fd4743e2a51dd8e0d44f96eae1853226
SHA1646cef384e949aaf61e6d0b243d8d84ab04e79b7
SHA2566535ba91fcca7174c3974b19d9ab471f322c2bf49506ef03424517310080be1b
SHA5124587c853871624414e957f083713ec62d50c46b7041f83faa45dbf99b99b8399fc08d586d240e4bccee5eb0d09e1cdcb3fd013f07878adf4defcc312712e468d
-
C:\Users\Admin\AppData\Local\Temp\is-UD0QS.tmp\0eb44447fe01d942d8972c146a7196f157985e49f780187545bc867992c13577.tmp
Filesize1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c