General

  • Target

    30f2d18a347941d704d5644eb563910d7a77e1a7e64ad0855dcbf36176d8fd55.exe

  • Size

    1.8MB

  • Sample

    241117-jxazrszjfl

  • MD5

    bdc56948ae92968dd03685f176d82952

  • SHA1

    68d97b5441573567ff1b2361d14f167d2f759232

  • SHA256

    30f2d18a347941d704d5644eb563910d7a77e1a7e64ad0855dcbf36176d8fd55

  • SHA512

    3606ef9656ec7e65b3b5f9486ca364536368af3126c604a48621092a131f032ba2623ce9c84d3fcf733d2d10ad1f0c8dbe93cccc8d095f924cc735bccf1e55eb

  • SSDEEP

    49152:n72Kiu5J6gOj+r2Ju32ZJ/nlrq7T9mra/:n7Piu5vOj+rYjJ/Cs

Malware Config

Extracted

Family

lumma

C2

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Targets

    • Target

      30f2d18a347941d704d5644eb563910d7a77e1a7e64ad0855dcbf36176d8fd55.exe

    • Size

      1.8MB

    • MD5

      bdc56948ae92968dd03685f176d82952

    • SHA1

      68d97b5441573567ff1b2361d14f167d2f759232

    • SHA256

      30f2d18a347941d704d5644eb563910d7a77e1a7e64ad0855dcbf36176d8fd55

    • SHA512

      3606ef9656ec7e65b3b5f9486ca364536368af3126c604a48621092a131f032ba2623ce9c84d3fcf733d2d10ad1f0c8dbe93cccc8d095f924cc735bccf1e55eb

    • SSDEEP

      49152:n72Kiu5J6gOj+r2Ju32ZJ/nlrq7T9mra/:n7Piu5vOj+rYjJ/Cs

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks