Overview

overview

10

Static

static

7

GOG_Galaxy...II.exe

windows7-x64

10

GOG_Galaxy...II.exe

windows10-2004-x64

10

out.exe

windows7-x64

out.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    GOG_Galaxy_Crusader_Kings_II.exe

  • Size

    495KB

  • Sample

    230615-y2f4xaah7s

  • MD5

    519020bb4341ffa2b1ee1e64217518f6

  • SHA1

    b8c040c7ecbe2e1602d5adcd187bb36f8fcfac0c

  • SHA256

    84537b3be0537542f894d4885cc18e7cc284c6ecce239ed0337ced63f83699e0

  • SHA512

    5450c3610bb67009bff5c8dc3f3568242555aed7de62f11b4e9af2384a6efae453536b664a0621d4837166c0d3fc43d4e65901af940d5551a4414702674dc0cd

  • SSDEEP

    12288:EVJ0MMxVAwKu36IwU+VLM8zuW7NPX2+r5E:oOMMxj/x+lLiW5f5ru

Score
10/10
lummadiscoveryevasionpersistencestealertrojanupx

Malware Config

Targets

    • Target

      GOG_Galaxy_Crusader_Kings_II.exe

    • Size

      495KB

    • MD5

      519020bb4341ffa2b1ee1e64217518f6

    • SHA1

      b8c040c7ecbe2e1602d5adcd187bb36f8fcfac0c

    • SHA256

      84537b3be0537542f894d4885cc18e7cc284c6ecce239ed0337ced63f83699e0

    • SHA512

      5450c3610bb67009bff5c8dc3f3568242555aed7de62f11b4e9af2384a6efae453536b664a0621d4837166c0d3fc43d4e65901af940d5551a4414702674dc0cd

    • SSDEEP

      12288:EVJ0MMxVAwKu36IwU+VLM8zuW7NPX2+r5E:oOMMxj/x+lLiW5f5ru

    Score
    10/10
    lummadiscoveryevasionpersistencestealertrojanupx

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

    • Target

      out.upx

    • Size

      973KB

    • MD5

      f028828edbb205114fe841dd54468938

    • SHA1

      008d56d71deee5f2c43214d53dee3b7561a78a37

    • SHA256

      b0231e8fc0fb95a26372da2c690249be2947738e252cec0d746f456532431578

    • SHA512

      b2f6434ba488a723321e34a5423ec8a97db137634261041cb2afaeb2494ee728a81a1836fc4183efe81bbe2a6ad29460960a63de4700ddf8fb9bf96fac962ebb

    • SSDEEP

      24576:ana6hN7a3KpChGFyZThAoNHip0xm1LEcw1Df5ruHDY2aS:a7a3KpChGFyZFbwpr1Clf5rNS

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v6

Tasks