cryptbot | 2959ff0bf986bddeb56abf2f54d30ecdc8a645311bba6c674f0aedaaa7594912

General

Target

furra.exe
Size

8.0MB
MD5

05f42a351356393179165a84086f8c07
SHA1

71093fd05686d6202bf4144f94920deefe551f96
SHA256

2959ff0bf986bddeb56abf2f54d30ecdc8a645311bba6c674f0aedaaa7594912
SHA512

b6fe9334bbd7dcd55f9b997e502839dd8c26d058ada49a3b804d7e41ee335abb2ab4e5ab0974da5fed3532a0beb8ca9e57b1cb5e416a94803a52a5f4ba9d4c08
SSDEEP

98304:s4IeiLEkjp/ABP9X6OmtVtNjgpiM+txC1xcTP8cY1JusPWBGu7oBCN7c4J+Rt+x9:s4tCpwJcY1JufL7oBH2IQxLLiU6

Score

10^/10

cryptbot lumma defense_evasion discovery spyware stealer

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://berserkyfir.click/api

Extracted

Family

cryptbot

C2

http://home.twelveff20pn.top/HfqvZFTxgmZzemQbMMGA1736773805

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	start-this-724.exe

Executes dropped EXE 2 IoCs

pid	Process
2980	LummaC2.exe
2924	start-this-724.exe

Loads dropped DLL 7 IoCs

pid	Process
816	furra.exe
816	furra.exe
816	furra.exe
816	furra.exe
1488	WerFault.exe
1488	WerFault.exe
1488	WerFault.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0009000000016ccc-13.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	2924	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	furra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	start-this-724.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2924	start-this-724.exe
2924	start-this-724.exe
2924	start-this-724.exe
2924	start-this-724.exe
2924	start-this-724.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2980	816	furra.exe	30
PID 816 wrote to memory of 2980	816	furra.exe	30
PID 816 wrote to memory of 2980	816	furra.exe	30
PID 816 wrote to memory of 2980	816	furra.exe	30
PID 816 wrote to memory of 2924	816	furra.exe	31
PID 816 wrote to memory of 2924	816	furra.exe	31
PID 816 wrote to memory of 2924	816	furra.exe	31
PID 816 wrote to memory of 2924	816	furra.exe	31
PID 2924 wrote to memory of 1488	2924	start-this-724.exe	32
PID 2924 wrote to memory of 1488	2924	start-this-724.exe	32
PID 2924 wrote to memory of 1488	2924	start-this-724.exe	32
PID 2924 wrote to memory of 1488	2924	start-this-724.exe	32

C:\Users\Admin\AppData\Local\Temp\furra.exe
"C:\Users\Admin\AppData\Local\Temp\furra.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\LummaC2.exe
  "C:\Users\Admin\AppData\Local\Temp\LummaC2.exe"
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\start-this-724.exe
  "C:\Users\Admin\AppData\Local\Temp\start-this-724.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 464
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\LummaC2.exe

Filesize
320KB

MD5
8da89b163d506be4a73b987517a1b9e4

SHA1
2e110cf5160c511fa3d5843e890b8e9316754f34

SHA256
ea56e7f640355598346fa0b356699298314e25d809f3aa7cfce1804a3d1964e5

SHA512
a85969bcda0b31caf0cec79f45bec068a498c7ac190fe17d7b7c03f88f5c91f5f6221fcc4fcb46604695d5b95e9047dfc1d2cf31207540c23e929fcca08d14f5

Download Submit
\Users\Admin\AppData\Local\Temp\start-this-724.exe

Filesize
7.7MB

MD5
c411bef822305589785b18bd83a3cb89

SHA1
890b2bdd6e88a45192d3552879afbed9955e9b8c

SHA256
b60b783764d2c193eec80661e43a512fad2ffc56a56ee1a190b6aac0cad33b8e

SHA512
b2503b11b0ffc28118c45490b6c7c148ea034d3fa82805fe4aa3f986ddd9c473dd1cc323afa19cea39319f75dec5bf6e39bdc97fed4d9f4c7cef48a55363d1a6

Download Submit
memory/816-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

Filesize
4KB

Download
memory/816-1-0x00000000011C0000-0x00000000019C8000-memory.dmp

Filesize
8.0MB

Download
memory/2924-20-0x0000000000E70000-0x0000000001628000-memory.dmp

Filesize
7.7MB

Download
memory/2924-23-0x0000000000E70000-0x0000000001628000-memory.dmp

Filesize
7.7MB

Download
memory/2924-29-0x0000000000E70000-0x0000000001628000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads