Analysis
-
max time kernel
43s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 06:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Decosetup.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
Decosetup.exe
-
Size
2.8MB
-
MD5
e7aa98e85cff480516f02ab74971fd18
-
SHA1
2e8dc8ad64ab4af7c41d71157c711865b86727d8
-
SHA256
75d40fca89f26be2b5dba12776714514104135cb5d6fc252df766c1f3fa739fe
-
SHA512
03420b91b69f1acf366036de18b61b175d3f3634e66cb94122499bf853e21af045c2aaa2d123520b4decf391d87124081e79abfc8a1dba412dfb31dc289cad6c
-
SSDEEP
24576:KYA6YargW43oPQdrxJnobG25Rt1LdJtgVA1KN8mLgdAtin9Abg03:dMx/25Rzio6in9j03
Malware Config
Extracted
Family
lumma
C2
https://toppyneedus.biz/api
Signatures
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Decosetup.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 924 Decosetup.exe 924 Decosetup.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4924 taskmgr.exe Token: SeSystemProfilePrivilege 4924 taskmgr.exe Token: SeCreateGlobalPrivilege 4924 taskmgr.exe Token: 33 4924 taskmgr.exe Token: SeIncBasePriorityPrivilege 4924 taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe 4924 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Decosetup.exe"C:\Users\Admin\AppData\Local\Temp\Decosetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:924
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4924