Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
02/06/2024, 16:13
General
- Target 23ee9b04a38f49940963a0b69e839aba76e4e64a13aa919fe2d23604a18aaf01.exe
- Size 422KB
- Sample240602-tpcthagc8x
- SHA256 23ee9b04a38f49940963a0b69e839aba76e4e64a13aa919fe2d23604a18aaf01
Score
10/10
Malware Config
Extracted
Family
-
lumma
C2
-
https://fragmentyperspowp.shop/api
-
https://horsedwollfedrwos.shop/api
-
https://patternapplauderw.shop/api
-
https://understanndtytonyguw.shop/api
-
https://considerrycurrentyws.shop/api
-
https://messtimetabledkolvk.shop/api
-
https://detailbaconroollyws.shop/api
-
https://deprivedrinkyfaiir.shop/api
-
https://relaxtionflouwerwi.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23ee9b04a38f49940963a0b69e839aba76e4e64a13aa919fe2d23604a18aaf01.exe"C:\Users\Admin\AppData\Local\Temp\23ee9b04a38f49940963a0b69e839aba76e4e64a13aa919fe2d23604a18aaf01.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 11282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4112 -ip 41121⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4112-1-0x0000000001FC0000-0x00000000020C0000-memory.dmp
memory/4112-2-0x0000000003860000-0x00000000038AD000-memory.dmp
memory/4112-3-0x0000000000400000-0x0000000000456000-memory.dmp
memory/4112-5-0x0000000000400000-0x0000000000456000-memory.dmp
memory/4112-4-0x0000000000400000-0x0000000001BE4000-memory.dmp