Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
14s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
22/08/2024, 15:57
General
-
Target
LummaC2.exe
-
Size
258KB
-
MD5
331edec4ca18b834e722b8ac3620cf79
-
SHA1
e74a91cf4790c62cda4eaec89a0028e42e960e84
-
SHA256
fb57b0586b9e513111f50b9d8623364ee15b2f8e0e49052163ddd31df64e27fe
-
SHA512
fb08959b26c122d1be73e167c19e7498fb7aca850529e26f2b025d35c035aa526be2c946231e6f17f3188ef7979ff4913813f5cfa55cb4b41a0d4804e8536a86
-
SSDEEP
6144:oNQRN4ApoymSc82PitnBpAl5LEqG3/VCqcC2XD1a8ES2+N:oSuymSc8xtBWHBGcBEO
Score
10/10
Malware Config
Extracted
Family
lumma
C2
https://torubleeodsmzo.shop/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LummaC2.exe"C:\Users\Admin\AppData\Local\Temp\LummaC2.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 11122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1916 -ip 19161⤵