Analysis

  • max time kernel
    95s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2024 02:18

General

  • Target

    34df64b26f3c69ef710eb56dd0204eaf3c4e083c74c038265a81700e7d07e459.exe

  • Size

    1.8MB

  • MD5

    eebcc9dcc7640b92a0939d1cc2449160

  • SHA1

    2993ca642310a1c6b4f72fef7093aae28eafed53

  • SHA256

    34df64b26f3c69ef710eb56dd0204eaf3c4e083c74c038265a81700e7d07e459

  • SHA512

    1dc304eee1204367af8e33e5338758ac397a015a6eb8a77d9731b20017a7b08c63058281e08d4dcdab7e5ea0984ec7cdc1d4f3bd5a08d46e2c8ae97b9ef99e08

  • SSDEEP

    49152:GYToCYGH+14UyrNOt/HfSFqtyS0DcnUcWeXi:GC7JYt3SfS0YTWey

Malware Config

Extracted

Family

lumma

C2

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://property-imper.sbs

Extracted

Family

lumma

C2

https://blade-govern.sbs/api

https://story-tense-faz.sbs/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34df64b26f3c69ef710eb56dd0204eaf3c4e083c74c038265a81700e7d07e459.exe
    "C:\Users\Admin\AppData\Local\Temp\34df64b26f3c69ef710eb56dd0204eaf3c4e083c74c038265a81700e7d07e459.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4184
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 1600
      2⤵
      • Program crash
      PID:3336
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 1580
      2⤵
      • Program crash
      PID:3408
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4184 -ip 4184
    1⤵
      PID:2804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4184 -ip 4184
      1⤵
        PID:5064

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4184-0-0x0000000000F70000-0x0000000001404000-memory.dmp

        Filesize

        4.6MB

      • memory/4184-1-0x0000000077444000-0x0000000077446000-memory.dmp

        Filesize

        8KB

      • memory/4184-2-0x0000000000F71000-0x0000000000F97000-memory.dmp

        Filesize

        152KB

      • memory/4184-3-0x0000000000F70000-0x0000000001404000-memory.dmp

        Filesize

        4.6MB

      • memory/4184-4-0x0000000000F70000-0x0000000001404000-memory.dmp

        Filesize

        4.6MB

      • memory/4184-5-0x0000000000F70000-0x0000000001404000-memory.dmp

        Filesize

        4.6MB