General

  • Target

    PASS-1234.exe

  • Size

    1.6MB

  • Sample

    240801-ztgwxa1ajh

  • MD5

    84a9c6ce9bba17f0f6687555c73bebb8

  • SHA1

    59240c3b11b160067a02400b0d484ff0fe33aa4d

  • SHA256

    bc634b24b95a01a85984c55d7f37a2e1be6242bbc750a8f5c6cb4b7979f3cd2b

  • SHA512

    1add11137bb3da3a1953fad137e02e29f04b43b5a8ac5adef595291e368565a4903e9a3d9450ddd08207db9df200bfcfac9fdc6127345c009c06f29df9c4e5ab

  • SSDEEP

    12288:kDACg5dh75plVRAtugzZ766KcMuFad9kq42CWc50UqICLadUNH6i9MbglKt0096o:kDg7EM6/qsxvgEx9q/

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://deadpannsjzvn.shop/api

https://empiredzmwnx.shop/api

https://boattyownerwrv.shop/api

https://rainbowmynsjn.shop/api

https://definitonizmnx.shop/api

https://creepydxzoxmj.shop/api

https://budgetttysnzm.shop/api

https://chippyfroggsyhz.shop/api

https://assumedtribsosp.shop/api

Extracted

Family

lumma

C2

https://deadpannsjzvn.shop/api

https://empiredzmwnx.shop/api

https://boattyownerwrv.shop/api

https://rainbowmynsjn.shop/api

https://definitonizmnx.shop/api

https://creepydxzoxmj.shop/api

https://budgetttysnzm.shop/api

https://chippyfroggsyhz.shop/api

https://assumedtribsosp.shop/api

https://tenntysjuxmz.shop/api

Targets

    • Target

      PASS-1234.exe

    • Size

      1.6MB

    • MD5

      84a9c6ce9bba17f0f6687555c73bebb8

    • SHA1

      59240c3b11b160067a02400b0d484ff0fe33aa4d

    • SHA256

      bc634b24b95a01a85984c55d7f37a2e1be6242bbc750a8f5c6cb4b7979f3cd2b

    • SHA512

      1add11137bb3da3a1953fad137e02e29f04b43b5a8ac5adef595291e368565a4903e9a3d9450ddd08207db9df200bfcfac9fdc6127345c009c06f29df9c4e5ab

    • SSDEEP

      12288:kDACg5dh75plVRAtugzZ766KcMuFad9kq42CWc50UqICLadUNH6i9MbglKt0096o:kDg7EM6/qsxvgEx9q/

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks