General

  • Target

    ff9d2a6132e95cd78fffb1fe0badf1219adc2d1cf0f695f0f3ad0ec98c73a393.exe

  • Size

    1.8MB

  • Sample

    241117-rj4zpa1hkb

  • MD5

    f373903154200ae4d75d16954e1dc2c1

  • SHA1

    9672a2e737961ff0e8ea3383c8fd3b41b673f706

  • SHA256

    ff9d2a6132e95cd78fffb1fe0badf1219adc2d1cf0f695f0f3ad0ec98c73a393

  • SHA512

    d045fdb4bdbbf274b527235d53c50deff2a145a0b47722dbc746019f5103acd0e18e983ef552763790b123720214eecc2980788f3599bd9d2f9172c6471c41f9

  • SSDEEP

    24576:+MILAOL37KIgzU5Ffb29AeR4JPaU2jtcRQcpghi35rb6i9mUt1cJ0GpXmLlHzbXi:+lLZQUpXv2O+i35rb/HDbNt

Malware Config

Extracted

Family

lumma

C2

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Targets

    • Target

      ff9d2a6132e95cd78fffb1fe0badf1219adc2d1cf0f695f0f3ad0ec98c73a393.exe

    • Size

      1.8MB

    • MD5

      f373903154200ae4d75d16954e1dc2c1

    • SHA1

      9672a2e737961ff0e8ea3383c8fd3b41b673f706

    • SHA256

      ff9d2a6132e95cd78fffb1fe0badf1219adc2d1cf0f695f0f3ad0ec98c73a393

    • SHA512

      d045fdb4bdbbf274b527235d53c50deff2a145a0b47722dbc746019f5103acd0e18e983ef552763790b123720214eecc2980788f3599bd9d2f9172c6471c41f9

    • SSDEEP

      24576:+MILAOL37KIgzU5Ffb29AeR4JPaU2jtcRQcpghi35rb6i9mUt1cJ0GpXmLlHzbXi:+lLZQUpXv2O+i35rb/HDbNt

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks