Analysis
-
max time kernel
213s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28-06-2024 18:58
General
-
Target
β οΈππππππΏ ππΌπππΌππβ οΈ.exe
-
Size
10.7MB
-
MD5
52b105f53cba19ed897bc7d08f2373c3
-
SHA1
983a8f9b34441ed6e062842bab4b7137b29cc721
-
SHA256
9fab6244c65eab9863d45c1908f8dc64116c5a18e7680b00e9b6646ec91b440f
-
SHA512
786fa01b73163b6dad1cb3a14216c674fa47c40ec3dc2e464ca2a65f2e8b7423649032a508aba6b0b289080a6151e6846d02a04903a2a4586f22155f4104a789
-
SSDEEP
98304:M/zCs0T3+6x1DkITYkn9dD11lXfceCEoZYVb0PJaxrIjioPT0:Syu6x1DkOYkn93Xp7lrJ
Score
10/10
Malware Config
Extracted
Family
lumma
C2
https://citizencenturygoodwk.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
Suspicious use of SetThreadContext 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\β οΈππππππΏ ππΌπππΌππβ οΈ.exe"C:\Users\Admin\AppData\Local\Temp\β οΈππππππΏ ππΌπππΌππβ οΈ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
-
C:\Windows\system32\launchtm.exelaunchtm.exe /21⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /22⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\β οΈππππππΏ ππΌπππΌππβ οΈ.exe"C:\Users\Admin\AppData\Local\Temp\β οΈππππππΏ ππΌπππΌππβ οΈ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\β οΈππππππΏ ππΌπππΌππβ οΈ.exe"C:\Users\Admin\AppData\Local\Temp\β οΈππππππΏ ππΌπππΌππβ οΈ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\β οΈππππππΏ ππΌπππΌππβ οΈ.exe"C:\Users\Admin\AppData\Local\Temp\β οΈππππππΏ ππΌπππΌππβ οΈ.exe"1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1715164888.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/116-40-0x00000000001A0000-0x00000000001F6000-memory.dmpFilesize
344KB
-
memory/116-38-0x00000000001A0000-0x00000000001F6000-memory.dmpFilesize
344KB
-
memory/400-35-0x00007FF75A7A0000-0x00007FF75B2BC000-memory.dmpFilesize
11.1MB
-
memory/400-39-0x00007FF75A7A0000-0x00007FF75B2BC000-memory.dmpFilesize
11.1MB
-
memory/1776-26-0x00007FF75A7A0000-0x00007FF75B2BC000-memory.dmpFilesize
11.1MB
-
memory/1776-30-0x00007FF75A7A0000-0x00007FF75B2BC000-memory.dmpFilesize
11.1MB
-
memory/2488-29-0x0000000000D60000-0x0000000000DB6000-memory.dmpFilesize
344KB
-
memory/2488-31-0x0000000000D60000-0x0000000000DB6000-memory.dmpFilesize
344KB
-
memory/2852-9-0x00000000010C0000-0x0000000001116000-memory.dmpFilesize
344KB
-
memory/2852-8-0x00000000010C0000-0x0000000001116000-memory.dmpFilesize
344KB
-
memory/2852-5-0x00000000010C0000-0x0000000001116000-memory.dmpFilesize
344KB
-
memory/4384-43-0x00007FF75A7A0000-0x00007FF75B2BC000-memory.dmpFilesize
11.1MB
-
memory/4472-2-0x00007FF75A7A0000-0x00007FF75B2BC000-memory.dmpFilesize
11.1MB
-
memory/4472-6-0x00007FF75A7A0000-0x00007FF75B2BC000-memory.dmpFilesize
11.1MB
-
memory/4768-11-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB
-
memory/4768-16-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB
-
memory/4768-17-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB
-
memory/4768-18-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB
-
memory/4768-19-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB
-
memory/4768-20-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB
-
memory/4768-21-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB
-
memory/4768-22-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB
-
memory/4768-12-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB
-
memory/4768-10-0x000001AAF58D0000-0x000001AAF58D1000-memory.dmpFilesize
4KB