Analysis
-
max time kernel
131s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 13:16
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240611-en
General
-
Target
Setup.exe
-
Size
5.8MB
-
MD5
c34e8f27e5e41acc13f476298be901f5
-
SHA1
1857dfcf2bbb4e91fed3595395cc6ea1b6e5e425
-
SHA256
8c09b0520cd0a587ccdab5f16b202ef013d9bf3b4fc7653b5afdf480417d33f1
-
SHA512
ccc416d96d36b792c59bdfd23c5e2e3b2c08c3498e43af7e0e5b873e0828c23fb30c1f21428fb8f984df99255d232e718422ce95acc8bba888da082f465c6709
-
SSDEEP
98304:vsMDHDRm8rcgEqQQ5izvWtb2ZaQ9kclxrg/bYzO6TEYJYEHjHO:RHDRLrcgEq55izvWtDaxbBOLYJYmu
Malware Config
Extracted
lumma
https://prettilikeopwp.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://reinforcedirectorywd.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Setup.exedescription pid process target process PID 4276 set thread context of 2260 4276 Setup.exe more.com -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Setup.exemore.compid process 4276 Setup.exe 4276 Setup.exe 2260 more.com 2260 more.com -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Setup.exemore.compid process 4276 Setup.exe 2260 more.com -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Setup.exemore.comdescription pid process target process PID 4276 wrote to memory of 2260 4276 Setup.exe more.com PID 4276 wrote to memory of 2260 4276 Setup.exe more.com PID 4276 wrote to memory of 2260 4276 Setup.exe more.com PID 4276 wrote to memory of 2260 4276 Setup.exe more.com PID 2260 wrote to memory of 4380 2260 more.com SearchIndexer.exe PID 2260 wrote to memory of 4380 2260 more.com SearchIndexer.exe PID 2260 wrote to memory of 4380 2260 more.com SearchIndexer.exe PID 2260 wrote to memory of 4380 2260 more.com SearchIndexer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchIndexer.exeC:\Windows\SysWOW64\SearchIndexer.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4280,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7748f7d0Filesize
1.2MB
MD5d85456bc93bc20de97041fb8f7f79247
SHA1d155e82d273925a86ef370c9f3fda0a0cb1112ef
SHA2569046bbd0bcb00410590ff77db0766c8c26f26afa4eb6431b4fb7d5e5aa8d00bf
SHA512c6ca930fe9f95058c05ec1c2852645c4c2c967e9423bb058633503541e09bd59bdd42b8eb4a1c11892adf73e2774ce11e90303b01f1f31798d56e5ae23f9de7c
-
C:\Users\Admin\AppData\Local\Temp\7a98c61bFilesize
1016KB
MD5bc259af6a074f0dc1421a82983cba7dc
SHA1b3dd3b558fa68857f86a44134fb8048dd80a80fc
SHA256dca6a4e962eec78c1b7c14a30b6b2730773a0c669681e56df7b6abff60a778cf
SHA5122cd434b4bc20de8fc1fd00c1c7a9834e7a975f45d68d2bef0538047691b9c2f3cba590cd1e5e69b50b9e6ca8ce6e882efb058c069b8baa91e6badd0e3938f616
-
memory/2260-18-0x0000000074560000-0x00000000745B2000-memory.dmpFilesize
328KB
-
memory/2260-12-0x0000000074560000-0x00000000745B2000-memory.dmpFilesize
328KB
-
memory/2260-16-0x0000000074560000-0x00000000745B2000-memory.dmpFilesize
328KB
-
memory/2260-15-0x0000000074560000-0x00000000745B2000-memory.dmpFilesize
328KB
-
memory/2260-14-0x00007FFF1EE30000-0x00007FFF1F025000-memory.dmpFilesize
2.0MB
-
memory/4276-10-0x0000000074560000-0x00000000745B2000-memory.dmpFilesize
328KB
-
memory/4276-6-0x0000000074560000-0x00000000745B2000-memory.dmpFilesize
328KB
-
memory/4276-7-0x00007FFF1EE30000-0x00007FFF1F025000-memory.dmpFilesize
2.0MB
-
memory/4276-8-0x0000000074572000-0x0000000074574000-memory.dmpFilesize
8KB
-
memory/4276-9-0x0000000074560000-0x00000000745B2000-memory.dmpFilesize
328KB
-
memory/4276-0-0x0000000000480000-0x0000000000A5B000-memory.dmpFilesize
5.9MB
-
memory/4380-19-0x00007FFF1EE30000-0x00007FFF1F025000-memory.dmpFilesize
2.0MB
-
memory/4380-20-0x0000000000AE0000-0x0000000000B3A000-memory.dmpFilesize
360KB
-
memory/4380-21-0x0000000000AE0000-0x0000000000B3A000-memory.dmpFilesize
360KB
-
memory/4380-22-0x0000000000D1B000-0x0000000000D22000-memory.dmpFilesize
28KB