General

  • Target

    2024-10-10_32f3fc40a78d5839c065e23990a01820_poet-rat_snatch

  • Size

    7.5MB

  • Sample

    241010-llgdhsydrq

  • MD5

    32f3fc40a78d5839c065e23990a01820

  • SHA1

    16ae351043266a1923e1bcf8f68a23fde8cdd796

  • SHA256

    a0ff69955bc8a6f67e015218a5abc3e8b93d60f557901ac20a5be378150084de

  • SHA512

    4a506aeae34bd2e9ee9f7b9beb2394333e302247782d9440bce88af9b03cd4f32a6074cb1a70d26bb43ddcbc8382d98829234d619f58013e28615191b7143093

  • SSDEEP

    98304:xgt1C/hHnXjE0XimKK/f7NW5Sc5VM3Byg93wwm6lUF1:xT/hHngMfcs4VCnWwm3

Malware Config

Extracted

Family

lumma

C2

https://drawwyobstacw.sbs

https://condifendteu.sbs

https://ehticsprocw.sbs

https://vennurviot.sbs

https://resinedyw.sbs

https://enlargkiw.sbs

https://allocatinow.sbs

https://mathcucom.sbs

Extracted

Family

stealc

Botnet

mainteam

C2

http://95.182.96.50

Attributes
  • url_path

    /2aced82320799c96.php

Targets

    • Target

      2024-10-10_32f3fc40a78d5839c065e23990a01820_poet-rat_snatch

    • Size

      7.5MB

    • MD5

      32f3fc40a78d5839c065e23990a01820

    • SHA1

      16ae351043266a1923e1bcf8f68a23fde8cdd796

    • SHA256

      a0ff69955bc8a6f67e015218a5abc3e8b93d60f557901ac20a5be378150084de

    • SHA512

      4a506aeae34bd2e9ee9f7b9beb2394333e302247782d9440bce88af9b03cd4f32a6074cb1a70d26bb43ddcbc8382d98829234d619f58013e28615191b7143093

    • SSDEEP

      98304:xgt1C/hHnXjE0XimKK/f7NW5Sc5VM3Byg93wwm6lUF1:xT/hHngMfcs4VCnWwm3

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Stealc

      Stealc is an infostealer written in C++.

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks