Overview

overview

10

Static

static

1

sample.html

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    sample

  • Size

    31KB

  • Sample

    240521-ynezpagf56

  • MD5

    e27e172a8e80e62005a29cdc12d71c5a

  • SHA1

    d9c361abfaec30bff360f6c4a3fc2af70f01e2f8

  • SHA256

    40654752138655a2f2fc6c9107fefb2f840d89b5d2d2f59941d21ea119cecbcf

  • SHA512

    ffe236fbca3f537b3a81861332620aa523b039111c49730b1ef23f1920e07cac4f9e8046b6b87ba23246628d9de036bf5e1c1c4e7ee52858132708365a8a5bcd

  • SSDEEP

    384:nH0edPP0ucjdey1YKfPn5TP3QQBtiUEzVjWWAoP6J94XyTKbPV6+xxdPP0ucjdeO:nGZv3xBtiUERjWt4mqyTKRzqZbmXml

Score
10/10
lummarhadamanthysexecutionstealer

Malware Config

Extracted

Family

lumma

C2

https://babycandidateoswp.shop/api

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

https://roomabolishsnifftwk.shop/api

Targets

    • Target

      sample

    • Size

      31KB

    • MD5

      e27e172a8e80e62005a29cdc12d71c5a

    • SHA1

      d9c361abfaec30bff360f6c4a3fc2af70f01e2f8

    • SHA256

      40654752138655a2f2fc6c9107fefb2f840d89b5d2d2f59941d21ea119cecbcf

    • SHA512

      ffe236fbca3f537b3a81861332620aa523b039111c49730b1ef23f1920e07cac4f9e8046b6b87ba23246628d9de036bf5e1c1c4e7ee52858132708365a8a5bcd

    • SSDEEP

      384:nH0edPP0ucjdey1YKfPn5TP3QQBtiUEzVjWWAoP6J94XyTKbPV6+xxdPP0ucjdeO:nGZv3xBtiUERjWt4mqyTKRzqZbmXml

    Score
    10/10
    lummarhadamanthysexecutionstealer

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks