Resubmissions
17-10-2024 00:08
241017-ae5a8avalj 1017-10-2024 00:04
241017-ac1v1s1bph 1016-10-2024 23:52
241016-3w4p8szgmc 1016-10-2024 23:50
241016-3v4c3szgja 1016-10-2024 22:52
241016-2tp9ds1dkk 10Analysis
-
max time kernel
32s -
max time network
40s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
16-10-2024 22:52
General
-
Target
XWorm-5.6-main/XwormLoader.exe
-
Size
490KB
-
MD5
9c9245810bad661af3d6efec543d34fd
-
SHA1
93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d
-
SHA256
f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
-
SHA512
90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767
-
SSDEEP
6144:3PkcFUUUQHs5TlOhDuy4VjmSO6/tU4j06xeJyCjvhsXZ4m05d0qCsfBLuWWCV/rr:3McWUUysz/NhKjJPhM4/5bV/rvgE3
Malware Config
Extracted
lumma
https://pillowbrocccolipe.shop/api
https://communicationgenerwo.shop/api
https://diskretainvigorousiw.shop/api
https://affordcharmcropwo.shop/api
https://dismissalcylinderhostw.shop/api
https://enthusiasimtitleow.shop/api
https://worryfillvolcawoi.shop/api
https://cleartotalfisherwo.shop/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main\XwormLoader.exe"C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main\XwormLoader.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
300KB