Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 23:28
Behavioral task
behavioral1
Sample
2548-1008-0x0000000000CD0000-0x0000000000FD9000-memory.exe
Resource
win7-20240729-en
General
-
Target
2548-1008-0x0000000000CD0000-0x0000000000FD9000-memory.exe
-
Size
3.0MB
-
MD5
4c476a78e35c295dccda9501fdb03f98
-
SHA1
5c82480637c8796e1804ccf63c44c4dc8fd8d015
-
SHA256
4472b4764c5f3928e70f9fd96c955522ac0a9f2b94c894f32bedf8e8709f44a9
-
SHA512
fb301bd1be683b4d26b67d429e226d50a09e2760bb12c6d51a47a757f91883561c26c5093565eccb93b4999b1f77750fa8054c5123cb7a5c6e0c17dcc2083003
-
SSDEEP
49152:H/65tmDyXog2Owhgh/CxCi/OVbfbBf7u14E4Qw:HIR4/LS/CxCi/ebZ7uGE
Malware Config
Extracted
lumma
https://scriptyprefej.store
https://navygenerayk.store
https://founpiuer.store
https://necklacedmny.store
https://thumbystriw.store
https://fadehairucw.store
https://crisiwarny.store
https://presticitpo.store
https://opinieni.store
Signatures
-
Lumma family
-
Program crash 1 IoCs
pid pid_target Process procid_target 4848 2424 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2548-1008-0x0000000000CD0000-0x0000000000FD9000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2548-1008-0x0000000000CD0000-0x0000000000FD9000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2548-1008-0x0000000000CD0000-0x0000000000FD9000-memory.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 2162⤵
- Program crash
PID:4848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2424 -ip 24241⤵PID:4896