General
-
Target
https://r.search.yahoo.com/_ylt=AwrFFw5l1yJmAmUehRsPxQt.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1713588197/RO=10/RU=https%3a%2f%2fwww.yuumijungle.com%2fpost%2fmetroid-dread-xci-descarga-sin-anuncios-ryujinx-gratis-para-pc/RK=2/RS=SgrgBYz2uCVDEW8p.B5HwyIA8f8-
-
Sample
240419-zk7qzafh9v
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://r.search.yahoo.com/_ylt=AwrFFw5l1yJmAmUehRsPxQt.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1713588197/RO=10/RU=https%3a%2f%2fwww.yuumijungle.com%2fpost%2fmetroid-dread-xci-descarga-sin-anuncios-ryujinx-gratis-para-pc/RK=2/RS=SgrgBYz2uCVDEW8p.B5HwyIA8f8-
Resource
win10v2004-20240412-en
Malware Config
Extracted
lumma
https://preachbusstyoiwo.shop/api
https://entitlementappwo.shop/api
https://economicscreateojsu.shop/api
https://pushjellysingeywus.shop/api
https://absentconvicsjawun.shop/api
https://suitcaseacanehalk.shop/api
https://bordersoarmanusjuw.shop/api
https://mealplayerpreceodsju.shop/api
https://wifeplasterbakewis.shop/api
Targets
-
-
Target
https://r.search.yahoo.com/_ylt=AwrFFw5l1yJmAmUehRsPxQt.;_ylu=Y29sbwNiZjEEcG9zAzEEdnRpZAMEc2VjA3Ny/RV=2/RE=1713588197/RO=10/RU=https%3a%2f%2fwww.yuumijungle.com%2fpost%2fmetroid-dread-xci-descarga-sin-anuncios-ryujinx-gratis-para-pc/RK=2/RS=SgrgBYz2uCVDEW8p.B5HwyIA8f8-
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-