Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-08-2024 20:50

General

  • Target

    injectorV2.4.exe

  • Size

    495KB

  • MD5

    cc50342a5e8ec23330b0864fb94ea4e7

  • SHA1

    d029c92b6fb6dc38a4cdd35554ca0b7e1b8f8123

  • SHA256

    f0af63b4468d4369d5abd59fba594685f424a136332b358bfac9b76ea201be6a

  • SHA512

    161e80e888aad08b2ba02c0fe7fa68856387e17942514daf5bde70190ef5567c995cca38936f0b18691af95f8c30bb9f4f4568a344ded7d10650a5db6054054d

  • SSDEEP

    12288:9azuzEtDcRUKgz4IHgR95DO5pkMPLgoQB2Rtv5hS:9VzEC64IHo9VkNgVBGX

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://demandlinzei.shop/api

https://applyzxcksdia.shop/api

https://replacedoxcjzp.shop/api

https://declaredczxi.shop/api

https://catchddkxozvp.shop/api

https://arriveoxpzxo.shop/api

https://contemplateodszsv.shop/api

https://bindceasdiwozx.shop/api

https://conformfucdioz.shop/api

Extracted

Family

lumma

C2

https://tenntysjuxmz.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\injectorV2.4.exe
    "C:\Users\Admin\AppData\Local\Temp\injectorV2.4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2008
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:800

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/800-0-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/800-3-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/800-4-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/800-5-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/1960-1-0x00000000025A0000-0x00000000025A1000-memory.dmp

      Filesize

      4KB