Analysis

  • max time kernel
    94s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 01:06

General

  • Target

    cf8db7212e45eb2db7593efdb294069ea6bfee32dc77f551b9cfcb5ee9ec069a.exe

  • Size

    362KB

  • MD5

    1b3c135d4e0f20b67ef9014623891ea5

  • SHA1

    04fd278709f419ac13d260e2a1abe689ac5b5579

  • SHA256

    cf8db7212e45eb2db7593efdb294069ea6bfee32dc77f551b9cfcb5ee9ec069a

  • SHA512

    b2252bf27c3071a44771189f6b2ae4a4ef05615cc01964ed33188b9a2a9890812b8150d8f3c30257ebebfeb0b8150ff838b65a4687363ef4a54fdbe842b3ec6c

  • SSDEEP

    6144:6zCUWZNi1IRsSdwqqo3lkpF7p3PHHQ21wIxyEqlnVj19OAqyN2CVLJj2vpw3qmNu:oC8MKqfVkT7aIxyEqpV9NkkqmNIxhc

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://commisionipwn.shop/api

https://stitchmiscpaew.shop/api

https://ignoracndwko.shop/api

https://grassemenwji.shop/api

https://charistmatwio.shop/api

https://basedsymsotp.shop/api

https://complainnykso.shop/api

https://preachstrwnwjw.shop/api

https://glassestacwop.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf8db7212e45eb2db7593efdb294069ea6bfee32dc77f551b9cfcb5ee9ec069a.exe
    "C:\Users\Admin\AppData\Local\Temp\cf8db7212e45eb2db7593efdb294069ea6bfee32dc77f551b9cfcb5ee9ec069a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\msvcp110.dll

    Filesize

    566KB

    MD5

    35b0cd8a1a641b9b2e2b0d3ca1cc92f7

    SHA1

    dc46156005c99d5b4151e06c35264fe3905838dd

    SHA256

    013b2d6a316aaa2da34212505403e4d558933e39b0d56a1ca9e4ddbffe1cc356

    SHA512

    156756971bb732fe5e7f34ba441ed783740dad697927a0fee959e13b3b89a6c11afe7103e0d03ceb4775719185f6ee00deead458f95d6d351a73d9e21b04e96e

  • memory/1336-10-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/1336-13-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/1336-15-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/2640-0-0x000000007526E000-0x000000007526F000-memory.dmp

    Filesize

    4KB

  • memory/2640-1-0x00000000000E0000-0x0000000000142000-memory.dmp

    Filesize

    392KB

  • memory/2640-2-0x0000000004A30000-0x0000000004A36000-memory.dmp

    Filesize

    24KB

  • memory/2640-9-0x0000000075260000-0x0000000075A10000-memory.dmp

    Filesize

    7.7MB

  • memory/2640-14-0x0000000075260000-0x0000000075A10000-memory.dmp

    Filesize

    7.7MB

  • memory/2640-16-0x0000000075260000-0x0000000075A10000-memory.dmp

    Filesize

    7.7MB