Analysis

  • max time kernel
    94s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 22:52

General

  • Target

    Loader.exe

  • Size

    550KB

  • MD5

    ee6be1648866b63fd7f860fa0114f368

  • SHA1

    42cab62fff29eb98851b33986b637514fc904f4b

  • SHA256

    e17bf83e09457d8cecd1f3e903fa4c9770e17e823731650a453bc479591ac511

  • SHA512

    d6492d3b3c1d94d6c87b77a9a248e8c46b889d2e23938ddb8a8e242caccb23e8cd1a1fbeffee6b140cf6fd3ea7e8da89190286a912032ce4a671257bd8e3e28a

  • SSDEEP

    12288:SQ5vTleU6iA6AiJ/uJxZjUXUxYcuORWETWOORGzbZr4QClJJRJAr6Ok:SQ5pexaALoXe4

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://covvercilverow.shop/api

https://surroundeocw.shop/api

https://abortinoiwiam.shop/api

https://pumpkinkwquo.shop/api

https://priooozekw.shop/api

https://deallyharvenw.shop/api

https://defenddsouneuw.shop/api

https://racedsuitreow.shop/api

https://roaddrermncomplai.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\msvcp110.dll

    Filesize

    642KB

    MD5

    9bc424be13dca227268ab018dca9ef0c

    SHA1

    f6f42e926f511d57ef298613634f3a186ec25ddc

    SHA256

    59d3999d0989c9c91dae93c26499f5a14b837a0fe56e6fc29f57456f54a1f8a2

    SHA512

    70a1abb35bd95efc40af6653d5db2e155fab9a8575b7ae5b69ab3fbcd60925c66a675dac6cba57564a430e9b92f1a2ea9e912c4d7f356b82696ed77e92b52715

  • memory/1476-0-0x00000000744CE000-0x00000000744CF000-memory.dmp

    Filesize

    4KB

  • memory/1476-1-0x00000000008B0000-0x0000000000940000-memory.dmp

    Filesize

    576KB

  • memory/1476-4-0x00000000744C0000-0x0000000074C70000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-13-0x00000000744C0000-0x0000000074C70000-memory.dmp

    Filesize

    7.7MB

  • memory/1476-15-0x00000000744C0000-0x0000000074C70000-memory.dmp

    Filesize

    7.7MB

  • memory/4828-9-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

  • memory/4828-12-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB

  • memory/4828-14-0x0000000000400000-0x0000000000465000-memory.dmp

    Filesize

    404KB