Overview

overview

10

Static

static

10

1b17680574...42.exe

windows7-x64

9

1b17680574...42.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-04-2024 01:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1b17680574d595b6211da1ca0664113f78cfb0e678c209dd61664d0f99841942.exe

  • Size

    5.5MB

  • MD5

    c91f9c9ffa73cd9d586d34f73beee0cd

  • SHA1

    0c6c645322b236944142fdffacbb610906177ee3

  • SHA256

    1b17680574d595b6211da1ca0664113f78cfb0e678c209dd61664d0f99841942

  • SHA512

    403eb2e3f09aacbaf06496d8e727d4a1c7d9fbff3b7437e14ab65cd142216189c0eb9d2ddc775f800a678b53ba7948c4704b48cd10de6b04a53d989dbfdc4286

  • SSDEEP

    98304:Guha6IiuJPovwGz5z0TWmakZv/Rjg3ozLRKdcB4S/BDTRm:nIiullGzOTNa+pjg3on0dwnJD9m

Score
10/10
lummastealervmprotect

Malware Config

Extracted

Family

lumma

C2

https://greetclassifytalk.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Detects executables packed with VMProtect. 3 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b17680574d595b6211da1ca0664113f78cfb0e678c209dd61664d0f99841942.exe
    "C:\Users\Admin\AppData\Local\Temp\1b17680574d595b6211da1ca0664113f78cfb0e678c209dd61664d0f99841942.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:5012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5012-1-0x00000000000F0000-0x00000000009E4000-memory.dmp

    Filesize

    9.0MB

    Download

  • memory/5012-2-0x00000000000F0000-0x00000000009E4000-memory.dmp

    Filesize

    9.0MB

    Download

  • memory/5012-0-0x0000000001040000-0x0000000001041000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5012-4-0x00000000000F0000-0x00000000009E4000-memory.dmp

    Filesize

    9.0MB

    Download