Overview

overview

10

Static

static

3

ff9c2ce33f...18.exe

windows7-x64

10

ff9c2ce33f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff9c2ce33fce1585aa1ff20145555761_JaffaCakes118

  • Size

    227KB

  • Sample

    240421-s3lswsec93

  • MD5

    ff9c2ce33fce1585aa1ff20145555761

  • SHA1

    0a69962fd393fb450a81b557af000bcc9d8b1e25

  • SHA256

    8c9f417cc07060056a707d847258a7a6a98e0ef6a16cb1243222c235d79c86bf

  • SHA512

    7572f57ee2ed16996df52c8c70d7e01cfdac1cca15e86334a7f78d370fc6fb5ac3efca4e082e82a5073fcbd4acf116d0e619a3a3d090129e5eeee328ddd0338a

  • SSDEEP

    6144:qoEdkmu85Dq+3qM3W7tfQN5/inEaMadDKNa1aILk71:gkmDN6M3atfQunka1KNaTgJ

Score
10/10
lummabootkitevasionpersistencestealer

Malware Config

Targets

    • Target

      ff9c2ce33fce1585aa1ff20145555761_JaffaCakes118

    • Size

      227KB

    • MD5

      ff9c2ce33fce1585aa1ff20145555761

    • SHA1

      0a69962fd393fb450a81b557af000bcc9d8b1e25

    • SHA256

      8c9f417cc07060056a707d847258a7a6a98e0ef6a16cb1243222c235d79c86bf

    • SHA512

      7572f57ee2ed16996df52c8c70d7e01cfdac1cca15e86334a7f78d370fc6fb5ac3efca4e082e82a5073fcbd4acf116d0e619a3a3d090129e5eeee328ddd0338a

    • SSDEEP

      6144:qoEdkmu85Dq+3qM3W7tfQN5/inEaMadDKNa1aILk71:gkmDN6M3atfQunka1KNaTgJ

    Score
    10/10
    lummabootkitevasionpersistencestealer

    • Detect Lumma Stealer payload V4

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Modifies security service

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Modify Registry

1
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks