Analysis
-
max time kernel
140s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 05:19
General
-
Target
20b5dab72aa47a89255bb1e8afa6cb0b655ce19f3667089dcb28c438fe38dfbd.exe
-
Size
258KB
-
MD5
8abd6729f24fd18e53b53276907ac07a
-
SHA1
3fa7f4812d34a57494504f8d31953ff9a0e741c4
-
SHA256
20b5dab72aa47a89255bb1e8afa6cb0b655ce19f3667089dcb28c438fe38dfbd
-
SHA512
a98fc8a41aad31468b3e36e07502f76b145aa597e148a25014e301675f4883a952e85157090ec58f1a625b0ea874ee95ddefe6baaaf292f56a2a5681aa6dcf24
-
SSDEEP
6144:oNQRN4ApoymSc82PitnBpAl5LEqG3/VCqcC2XD1a8ESaB+N:oSuymSc8xtBWHBGcBEc
Malware Config
Extracted
lumma
https://torubleeodsmzo.shop/api
https://potentioallykeos.shop/api
https://interactiedovspm.shop/api
https://charecteristicdxp.shop/api
https://cagedwifedsozm.shop/api
https://deicedosmzj.shop/api
https://southedhiscuso.shop/api
https://consciousourwi.shop/api
https://tenntysjuxmz.shop/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\20b5dab72aa47a89255bb1e8afa6cb0b655ce19f3667089dcb28c438fe38dfbd.exe"C:\Users\Admin\AppData\Local\Temp\20b5dab72aa47a89255bb1e8afa6cb0b655ce19f3667089dcb28c438fe38dfbd.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4156,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:81⤵