General

  • Target

    file.exe

  • Size

    1.8MB

  • Sample

    241117-k2p5xs1jdm

  • MD5

    c3384cbcfd7f594f40fe489f5f67a36f

  • SHA1

    37f8f298e7ef281a821e38cc08abb72d679c9b2d

  • SHA256

    dbaa65c338340985131358f76f903a03045da28aaaa6297f37bf8f5123defcf2

  • SHA512

    e68fc70a6bd04045e13712f95bee04070eeb2fc99cd02703eb15a583dfa49e0ee1e70a08b294072e0a6676cdaeb9e4dbd10fc06e6f3d8d7cf6ded951afc215ea

  • SSDEEP

    49152:AHJ/HR69tKztupUL4o3VUJiAr8kZKfQBoypZmu8w2A:iJ/Hy3UkolfArDQfyoypX

Malware Config

Extracted

Family

lumma

C2

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Targets

    • Target

      file.exe

    • Size

      1.8MB

    • MD5

      c3384cbcfd7f594f40fe489f5f67a36f

    • SHA1

      37f8f298e7ef281a821e38cc08abb72d679c9b2d

    • SHA256

      dbaa65c338340985131358f76f903a03045da28aaaa6297f37bf8f5123defcf2

    • SHA512

      e68fc70a6bd04045e13712f95bee04070eeb2fc99cd02703eb15a583dfa49e0ee1e70a08b294072e0a6676cdaeb9e4dbd10fc06e6f3d8d7cf6ded951afc215ea

    • SSDEEP

      49152:AHJ/HR69tKztupUL4o3VUJiAr8kZKfQBoypZmu8w2A:iJ/Hy3UkolfArDQfyoypX

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks