General

  • Target

    f03f2e2f46e8a4bdb7f89ff51177e76b5adc860bc8a9a5f9fb614d68093d3e8e.exe

  • Size

    1.8MB

  • Sample

    241117-rgl14a1gpb

  • MD5

    94aac30065fe1780afe1a0cb1bc107da

  • SHA1

    8cc8b365f75cb569d6943eb99a6f287d794ebe43

  • SHA256

    f03f2e2f46e8a4bdb7f89ff51177e76b5adc860bc8a9a5f9fb614d68093d3e8e

  • SHA512

    1fd830e985d07fa7011cc7ad9bf60a6e1a5cb59f5d4b3ac8fced9d9cc9ce08b03d40d1a02fc03649364902bdc3b40363d96855c30f754bb54e610d01ad424a21

  • SSDEEP

    49152:QoDhMbY3Gkn4sWbcgeN0J045/ynxqDozPm0WzmKzyrd2n:bDr4Bb/5u4FyjmzmdY

Malware Config

Extracted

Family

lumma

C2

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Targets

    • Target

      f03f2e2f46e8a4bdb7f89ff51177e76b5adc860bc8a9a5f9fb614d68093d3e8e.exe

    • Size

      1.8MB

    • MD5

      94aac30065fe1780afe1a0cb1bc107da

    • SHA1

      8cc8b365f75cb569d6943eb99a6f287d794ebe43

    • SHA256

      f03f2e2f46e8a4bdb7f89ff51177e76b5adc860bc8a9a5f9fb614d68093d3e8e

    • SHA512

      1fd830e985d07fa7011cc7ad9bf60a6e1a5cb59f5d4b3ac8fced9d9cc9ce08b03d40d1a02fc03649364902bdc3b40363d96855c30f754bb54e610d01ad424a21

    • SSDEEP

      49152:QoDhMbY3Gkn4sWbcgeN0J045/ynxqDozPm0WzmKzyrd2n:bDr4Bb/5u4FyjmzmdY

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks