Resubmissions

10/04/2024, 12:56

240410-p6qpgagd791

10/04/2024, 12:39

240410-pv43qaba8s7

08/04/2024, 16:21

240408-ttseradf781

06/04/2024, 08:39

240406-kkr8ysfc556

06/04/2024, 08:38

240406-kjv88aee2y

06/04/2024, 08:14

240406-j4467aeb4x10

06/04/2024, 08:05

240406-jyx6paeg548

General

  • Target
    https://bing.com
  • Sample240406-j4467aeb4x

Malware Config

Extracted

Family
  • lumma

C2
  • https://handbreeadretwaiw.shop/api

  • https://birdpenallitysydw.shop/api

  • https://cinemaclinicttanwk.shop/api

  • https://disagreemenywyws.shop/api

  • https://speedparticipatewo.shop/api

  • https://fixturewordbakewos.shop/api

  • https://colorprioritytubbew.shop/api

  • https://abuselinenaidwjuew.shop/api

  • https://methodgreenglassdatw.shop/api

Targets

    • Target
      https://bing.com
    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks