Overview

overview

10

Static

static

3

2024-11-02...ch.exe

windows7-x64

1

2024-11-02...ch.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2024-11-02_02d7d805194a09eb7bf1ff2bf9f5e22b_poet-rat_snatch
  • Size 6.8MB
  • Sample241102-xf2caaseqq
  • SHA256 4f151dc21cd5eb4d5f545722b1d4597e18c88efcb44221acca0056d5c7c46cb1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lummastealc7122819010defense_evasiondiscoverystealer

Malware Config

Extracted

Family

  • stealc

Botnet

  • 7122819010

C2

  • http://83.217.209.11

Attributes
  • url_path

    /fd2453cf4b7dd4a4.php

Extracted

Family

  • lumma

C2

  • https://forbidstow.site/api

  • https://goalyfeastz.site/api

  • https://contemteny.site/api

  • https://dilemmadu.site/api

  • https://authorisev.site/api

Targets

    • Target
      2024-11-02_02d7d805194a09eb7bf1ff2bf9f5e22b_poet-rat_snatch
    • Size 6.8MB
    • SHA256 4f151dc21cd5eb4d5f545722b1d4597e18c88efcb44221acca0056d5c7c46cb1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    lummastealc7122819010defense_evasiondiscoverystealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Stealc

      Stealc is an infostealer written in C++.

      stealerstealc

    • Stealc family

      stealc

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • System Binary Proxy Execution: Rundll32

      Abuse Rundll32 to proxy execution of malicious code.

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks