Overview

overview

10

Static

static

3

#!~#0PeN_5...re.dll

windows7-x64

1

#!~#0PeN_5...re.dll

windows10-2004-x64

1

#!~#0PeN_5...rk.dll

windows7-x64

1

#!~#0PeN_5...rk.dll

windows10-2004-x64

1

#!~#0PeN_5...up.exe

windows7-x64

7

#!~#0PeN_5...up.exe

windows10-2004-x64

10

#!~#0PeN_5...te.ppt

windows7-x64

1

#!~#0PeN_5...te.ppt

windows10-2004-x64

1

#!~#0PeN_5...64.dll

windows7-x64

1

#!~#0PeN_5...64.dll

windows10-2004-x64

1

#!~#0PeN_5...64.dll

windows7-x64

1

#!~#0PeN_5...64.dll

windows10-2004-x64

1

#!~#0PeN_5...40.dll

windows7-x64

1

#!~#0PeN_5...40.dll

windows10-2004-x64

1

#!~#0PeN_5..._1.dll

windows7-x64

1

#!~#0PeN_5..._1.dll

windows10-2004-x64

1

#!~#0PeN_5...se.htm

windows7-x64

1

#!~#0PeN_5...se.htm

windows10-2004-x64

1

#!~#0PeN_5...64.dll

windows7-x64

1

#!~#0PeN_5...64.dll

windows10-2004-x64

1

#!~#0PeN_5...40.dll

windows7-x64

1

#!~#0PeN_5...40.dll

windows10-2004-x64

1

#!~#0PeN_5..._1.dll

windows7-x64

1

#!~#0PeN_5..._1.dll

windows10-2004-x64

1

#!~#0PeN_5...ib.dll

windows7-x64

1

#!~#0PeN_5...ib.dll

windows10-2004-x64

1

#!~#0PeN_5...er.exe

windows7-x64

1

#!~#0PeN_5...er.exe

windows10-2004-x64

1

#!~#0PeN_5...or.exe

windows7-x64

1

#!~#0PeN_5...or.exe

windows10-2004-x64

1

#!~#0PeN_5...1].exe

windows7-x64

1

#!~#0PeN_5...1].exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    4881666efcfd26c9ebbde22d7d6fde1edad147bf1df0a2d2534a3a4163a49028
  • Size 10.4MB
  • Sample240603-1pcxtsab71
  • SHA256 4881666efcfd26c9ebbde22d7d6fde1edad147bf1df0a2d2534a3a4163a49028
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lummastealer

Malware Config

Extracted

Family

  • lumma

C2

  • https://palacetilecomplew.shop/api

  • https://museumtespaceorsp.shop/api

  • https://buttockdecarderwiso.shop/api

  • https://averageaattractiionsl.shop/api

  • https://femininiespywageg.shop/api

  • https://employhabragaomlsp.shop/api

  • https://stalfbaclcalorieeis.shop/api

  • https://civilianurinedtsraov.shop/api

  • https://roomabolishsnifftwk.shop/api

Targets

    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/Qt5Core.dll
    • Size 6.0MB
    • SHA256 8f4c72e3c7de1ab5d894ec7813f65c5298ecafc183f31924b44a427433ffca42
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/Qt5Network.dll
    • Size 1.3MB
    • SHA256 739bedcfc8eb860927eb2057474be5b39518aaaa6703f9f85307a432fa1f236e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/Setup.exe
    • Size 5.4MB
    • SHA256 4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lummastealer

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral5behavioral6
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/borate.ppt
    • Size 1.3MB
    • SHA256 4044cab1945fd206ff889f2faabca43bf34dfa6601a9c46e09b7635f7ba49ad5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/libcrypto-1_1-x64.dll
    • Size 2.7MB
    • SHA256 3513c42b1ce52efa42d521854b3858961e0de345ab627852de6882f408880819
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral9
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/libssl-1_1-x64.dll
    • Size 669KB
    • SHA256 a0e43cbc4a2d8d39f225abd91980001b7b2b5001e8b2b8292537ae39b17b85d1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/msvcp140.dll
    • Size 564KB
    • SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/msvcp140_1.dll
    • Size 34KB
    • SHA256 a3a1199de32bbbc8318ec33e2e1ce556247d012851e4b367fe853a51e74ce4ee
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/peptidase.htm
    • Size 78KB
    • SHA256 c8d313b1c520714895de27beff9100c783d6eed0f1a9e3d5f1ff8443d919a520
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/steam_api64.dll
    • Size 291KB
    • SHA256 1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/vcruntime140.dll
    • Size 106KB
    • SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21behavioral22
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/vcruntime140_1.dll
    • Size 48KB
    • SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/x64/AzureKeyVaultDgssLib.dll
    • Size 373KB
    • SHA256 3eee708fdcc68fe76ac4cc7adba90201912c63cd815717f91a5eabba1170af0d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25behavioral26
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/x64/BugReporter
    • Size 521KB
    • SHA256 b8b06487ee2c2f2a4ae25d1e7a08a9ce831539a529fe2ed0e8841e5f7c42de90
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/x64/ComExtractor
    • Size 618KB
    • SHA256 d66ee1d1e44feb03d7821062ce27e92da0fa78f7e47a451b7b1d4b94860dd309
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      #!~#0PeN_5098_Pa$$WOrd~!$/x64/HDHelper_[0MB]_[1].exe
    • Size 566KB
    • SHA256 72ece91f65a461c5023695bf5f31b5b6b5bd629dba8407524e8144f6d1e160e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks