Resubmissions
07-01-2024 18:26
240107-w3ameabffn 10Analysis
-
max time kernel
141s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07-01-2024 18:26
General
-
Target
Samples 6/c76d7f244175880387474af937c59ad2cbfec2f4bdfdefdf0a9d1def029faa31.exe
-
Size
3.2MB
-
MD5
af1d425db05520962f4a587ab397f188
-
SHA1
51d4246fe8af0eeedd6e53da017a77ca265e9033
-
SHA256
c76d7f244175880387474af937c59ad2cbfec2f4bdfdefdf0a9d1def029faa31
-
SHA512
00de0b42fef04aa38664bc085130d0aa6e15ec456a566ad6bfbf295563507ff9d41d6864b2876db2334437a538149fbb25e6938c8912e57e38267cfd5f85325c
-
SSDEEP
98304:/d4Y8CE49/sE8ZGPTJFLehalsqqXlGbaWaE0QMf9410wD:/l8fYsj8THLnGqcl7NZQMl4Sw
Score
10/10
Malware Config
Extracted
Family
lumma
C2
http://zamesblack.fun/api
Signatures
-
Detect Lumma Stealer payload V4 3 IoCs
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Samples 6\c76d7f244175880387474af937c59ad2cbfec2f4bdfdefdf0a9d1def029faa31.exe"C:\Users\Admin\AppData\Local\Temp\Samples 6\c76d7f244175880387474af937c59ad2cbfec2f4bdfdefdf0a9d1def029faa31.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 13002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4140 -ip 41401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.5MB
-
Filesize
5.5MB