Resubmissions

19-11-2024 10:42

241119-mrxs5avbkd 10

19-11-2024 10:11

241119-l79besyrap 10

General

  • Target

    secrator.txt

  • Size

    493B

  • Sample

    241119-l79besyrap

  • MD5

    7cc08429b87f9aba8606e95114957b82

  • SHA1

    2ba425be1fe0f12fa419bc93c22e7a2079b0c6b7

  • SHA256

    856be8a4d18a57d625d371054956b9ff1b9824e05894530bcf843629dce33cac

  • SHA512

    91bf2f2c4090505e0606802aa64c1220729f08f1f3087cd5d4d81923d4d838a8459686a33fa60c2291398560aa47b19f697a29d067bd4cfbc4ff018c909bc4c9

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://storageinstance.oss-ap-southeast-1.aliyuncs.com/cincinati.zip

Extracted

Family

lumma

C2

https://processhol.sbs/api

https://p10tgrace.sbs/api

https://peepburry828.sbs/api

https://3xp3cts1aim.sbs/api

https://p3ar11fter.sbs/api

Targets

    • Target

      secrator.txt

    • Size

      493B

    • MD5

      7cc08429b87f9aba8606e95114957b82

    • SHA1

      2ba425be1fe0f12fa419bc93c22e7a2079b0c6b7

    • SHA256

      856be8a4d18a57d625d371054956b9ff1b9824e05894530bcf843629dce33cac

    • SHA512

      91bf2f2c4090505e0606802aa64c1220729f08f1f3087cd5d4d81923d4d838a8459686a33fa60c2291398560aa47b19f697a29d067bd4cfbc4ff018c909bc4c9

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks