Analysis
-
max time kernel
195s -
max time network
286s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
29-04-2024 04:04
General
-
Target
7812fd299ceae45beb91439f791a32626dfaed04f75a0c1a68e37c86b7c7bdae.exe
-
Size
5.5MB
-
MD5
e54a8705978717ebfdc017906a3c8396
-
SHA1
c77055a955b210f5b7c64e0a54c876838a77a072
-
SHA256
7812fd299ceae45beb91439f791a32626dfaed04f75a0c1a68e37c86b7c7bdae
-
SHA512
580f7e24a3f15150e8763d3ea00f892516848217c520fc18993cb960e3f6380897263aa7496b7490f98990c7770637cc0e5250aff7b7bbc9100ed845a3e8958e
-
SSDEEP
98304:ITD+zH0PAJ+UDJ9fKaxPIw6uM+aP3XTZIYplRPOPQGtNzGd:ITtMYaxOuMpP3X9IYp/OPQgO
Malware Config
Extracted
lumma
https://appliedgrandyjuiw.shop/api
https://birdpenallitysydw.shop/api
https://cinemaclinicttanwk.shop/api
https://disagreemenywyws.shop/api
https://speedparticipatewo.shop/api
https://fixturewordbakewos.shop/api
https://colorprioritytubbew.shop/api
https://abuselinenaidwjuew.shop/api
https://methodgreenglassdatw.shop/api
Signatures
-
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7812fd299ceae45beb91439f791a32626dfaed04f75a0c1a68e37c86b7c7bdae.exe"C:\Users\Admin\AppData\Local\Temp\7812fd299ceae45beb91439f791a32626dfaed04f75a0c1a68e37c86b7c7bdae.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
8.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
8.9MB