Resubmissions
09-09-2024 19:47
240909-yhlkaawgqp 316-08-2024 15:24
240816-stchvswbkk 319-07-2024 09:10
240719-k46wfswhja 119-07-2024 09:10
240719-k41z7stalq 109-07-2024 04:19
240709-exzwnswbnr 808-07-2024 07:13
240708-h2an5azgkg 607-07-2024 10:00
240707-l1l8ba1gqb 1007-07-2024 09:59
240707-l1e41a1gpc 106-07-2024 07:41
240706-jjdhqstcpg 406-07-2024 06:14
240706-gzq3na1blh 1Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
lumma
C2
https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api
Targets
-
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext