General

  • Target

    levelcomputer.exe

  • Size

    192.4MB

  • Sample

    230825-tma7wsfc8y

  • MD5

    760e4dfcad56f67f80ec4b2def63de69

  • SHA1

    0af7b525ac681f37e6e2d80864a5884d1ff76711

  • SHA256

    86a046300c03712f3d07e9c0e50369937b77a7e8183f3e40574da5de7fc5ce6e

  • SHA512

    bdfeb7e1ce7dc861c853708675024f16ef301081f1cb1e8dc31d7f772d8950984b13e973fbbf1d5ca9b10a28b3e8d6de4da5ef33a6f729be462d2d7119acc705

  • SSDEEP

    6291456:RwNK18un4nZCbavGsedutVPsHdPa1UlcF:6NK6tZ6avyutVmd0U

Malware Config

Targets

    • Target

      levelcomputer.exe

    • Size

      192.4MB

    • MD5

      760e4dfcad56f67f80ec4b2def63de69

    • SHA1

      0af7b525ac681f37e6e2d80864a5884d1ff76711

    • SHA256

      86a046300c03712f3d07e9c0e50369937b77a7e8183f3e40574da5de7fc5ce6e

    • SHA512

      bdfeb7e1ce7dc861c853708675024f16ef301081f1cb1e8dc31d7f772d8950984b13e973fbbf1d5ca9b10a28b3e8d6de4da5ef33a6f729be462d2d7119acc705

    • SSDEEP

      6291456:RwNK18un4nZCbavGsedutVPsHdPa1UlcF:6NK6tZ6avyutVmd0U

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Tasks