Resubmissions

05/06/2025, 19:12

250605-xwxn2ax1c1 10

04/06/2025, 16:38

250604-t5e9kagj9w 10

Analysis

  • max time kernel
    20s
  • max time network
    30s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/06/2025, 19:12

General

  • Target

    NewTextDocument.exe

  • Size

    4KB

  • MD5

    a239a27c2169af388d4f5be6b52f272c

  • SHA1

    0feb9a0cd8c25f01d071e9b2cfc2ae7bd430318c

  • SHA256

    98e895f711226a32bfab152e224279d859799243845c46e550c2d32153c619fc

  • SHA512

    f30e1ff506cc4d729f7e24aa46e832938a5e21497f1f82f1b300d47f45dae7f1caef032237ef1f5ae9001195c43c0103e3ab787f9196c8397846c1dea8f351da

  • SSDEEP

    48:6r1huik0xzYGJZZJOQOulbfSqXSfbNtm:IIxcLpf6zNt

Malware Config

Extracted

Family

lumma

C2

https://t.me/vstalnasral555

https://runtnwq.run/gajh

https://narrathfpt.top/tekq

https://escczlv.top/bufi

https://localixbiw.top/zlpa

https://korxddl.top/qidz

https://stochalyqp.xyz/alfp

https://diecam.top/laur/api

https://citellcagt.top/gjtu

https://peppinqikp.xyz/xaow

Extracted

Family

xworm

Version

5.0

C2

154.53.41.5:1144

Mutex

tHwBSicFuDZAqRPQ

Attributes
  • install_file

    USB.exe

aes.plain

Signatures

  • Detect Xworm Payload 2 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file 5 IoCs
  • Executes dropped EXE 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NewTextDocument.exe
    "C:\Users\Admin\AppData\Local\Temp\NewTextDocument.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5420
    • C:\Users\Admin\AppData\Local\Temp\a\1UGwDFF.exe
      "C:\Users\Admin\AppData\Local\Temp\a\1UGwDFF.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5492
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4588
    • C:\Users\Admin\AppData\Local\Temp\a\t3u2Imz.exe
      "C:\Users\Admin\AppData\Local\Temp\a\t3u2Imz.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        3⤵
          PID:3472
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5552
      • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe
        "C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4108
      • C:\Users\Admin\AppData\Local\Temp\a\94mG4Ak.exe
        "C:\Users\Admin\AppData\Local\Temp\a\94mG4Ak.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:684
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4100
      • C:\Users\Admin\AppData\Local\Temp\a\XClient.exe
        "C:\Users\Admin\AppData\Local\Temp\a\XClient.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4768

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o4gthjps.2w3.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\a\1UGwDFF.exe

            Filesize

            2.8MB

            MD5

            a4800db4a176fdba6d86bde9e21d7d4b

            SHA1

            c927378fd0aff61a865860b81ea49182ad3fc896

            SHA256

            4738fee480de92666fc5cb7e6c9a4b0d97cd3d3b7ff9d642288e0cc604d407ae

            SHA512

            cbcecf64126f92844858213e7050942c63cbdf23522e1e8ac0887c655c615239bdf4111475a7ebffa4bf700ec59b6a8125fed46201ff2238eb9d8e4c8e4236c6

          • C:\Users\Admin\AppData\Local\Temp\a\94mG4Ak.exe

            Filesize

            946KB

            MD5

            bee498bb6818e1eec3f96ed8c371e4c3

            SHA1

            5cd9f249cb2e4888b6ff488e2b3795ead65460f9

            SHA256

            5dcd18a45f245b8f03ee330afd54014c3dcd6e96b0f9fa0d9b2c98498fd11306

            SHA512

            0821397200c422f1c912a11babb17da7c0fad61ad7fd1e66950fdf80217d87e17b571713b83b66bdbc63996dd01637437296fd186bb205e5665f0965d599bca1

          • C:\Users\Admin\AppData\Local\Temp\a\XClient.exe

            Filesize

            32KB

            MD5

            ae20c32d0b9e8699756e93f9372972fa

            SHA1

            0a80ba47f8175b177ff7f507906e376f0b1a3db3

            SHA256

            5054d87f5429374c958f4ee191993b826be2568307c5b53067c0ee771690591d

            SHA512

            a37cb8de74b593304985d896c1bf86cd6dd144f72d24cd3796308ea04c218c09dc3716a3e66fe3c1455b61a3b8a96e1c942c67ef291e9da15e4a662ac4669f1a

          • C:\Users\Admin\AppData\Local\Temp\a\hJ5bmFj.exe

            Filesize

            4.2MB

            MD5

            f7f9ed55e782f4d2d43fb0703dd1273f

            SHA1

            8bb98c59bb35055ccf1b52ef12db24cca50b58b0

            SHA256

            ad044817d9a6c1b798001fbf0f769c0ac1d8486afb9dede03543b934be6df3c6

            SHA512

            1126c63648b573b01bcffc1ac037c3ed29074834f1716e54352a1679a4c9d5d393068b22e3820c62e398ab81d127fc242f306e158bf393e58742995df7896ce7

          • C:\Users\Admin\AppData\Local\Temp\a\t3u2Imz.exe

            Filesize

            925KB

            MD5

            45445e04eeaaab44456e4296c25ddb1b

            SHA1

            75f242422d7329a0a3f9a1230cf694443601717e

            SHA256

            82f77e79a0052160d388738a17a60e3733e439dd6beb53c88232e075ccef7d6e

            SHA512

            ffde7a5727e67998e09cfa90b8db7ac11f17b815a3c846a0a52cf98962049bdb7da94aa0a74f26977a2797309835fd4638c636a6e9412ddc22746fe39af776a6

          • memory/4108-43-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-66-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-42-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-45-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-40-0x0000000000B50000-0x0000000000F8C000-memory.dmp

            Filesize

            4.2MB

          • memory/4108-41-0x00000000059F0000-0x0000000005D68000-memory.dmp

            Filesize

            3.5MB

          • memory/4108-47-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-51-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-59-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-74-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-86-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-84-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-100-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-113-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-111-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-109-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-49-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-107-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-53-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-55-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-105-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-57-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-89-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-82-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-80-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-102-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-78-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-76-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-72-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-70-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-68-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-61-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4108-63-0x00000000059F0000-0x0000000005D61000-memory.dmp

            Filesize

            3.4MB

          • memory/4588-2397-0x000001EF1D250000-0x000001EF1D272000-memory.dmp

            Filesize

            136KB

          • memory/4768-157-0x0000000000930000-0x000000000093E000-memory.dmp

            Filesize

            56KB

          • memory/5420-2-0x00007FF92E830000-0x00007FF92F2F2000-memory.dmp

            Filesize

            10.8MB

          • memory/5420-143-0x00007FF92E833000-0x00007FF92E835000-memory.dmp

            Filesize

            8KB

          • memory/5420-0-0x00007FF92E833000-0x00007FF92E835000-memory.dmp

            Filesize

            8KB

          • memory/5420-253-0x00007FF92E830000-0x00007FF92F2F2000-memory.dmp

            Filesize

            10.8MB

          • memory/5420-1-0x0000000000A30000-0x0000000000A38000-memory.dmp

            Filesize

            32KB

          • memory/5552-27-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB

          • memory/5552-24-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB

          • memory/5552-36-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB

          • memory/5552-26-0x0000000000400000-0x000000000045F000-memory.dmp

            Filesize

            380KB