Resubmissions

10-04-2024 12:56

240410-p6qpgagd79 1

10-04-2024 12:39

240410-pv43qaba8s 7

08-04-2024 16:21

240408-ttseradf78 1

06-04-2024 08:39

240406-kkr8ysfc55 6

06-04-2024 08:14

240406-j4467aeb4x 10

06-04-2024 08:05

240406-jyx6paeg54 8

General

  • Target

    https://bing.com

  • Sample

    240406-j4467aeb4x

Malware Config

Extracted

Family

lumma

C2

https://handbreeadretwaiw.shop/api

https://birdpenallitysydw.shop/api

https://cinemaclinicttanwk.shop/api

https://disagreemenywyws.shop/api

https://speedparticipatewo.shop/api

https://fixturewordbakewos.shop/api

https://colorprioritytubbew.shop/api

https://abuselinenaidwjuew.shop/api

https://methodgreenglassdatw.shop/api

Targets

    • Target

      https://bing.com

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks