Analysis

  • max time kernel
    90s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2024, 02:52

General

  • Target

    ae6bd3b195dd0a5adc6629bae4cd297bb33ae118f8de11b4f885068829de0f7b.dll

  • Size

    438KB

  • MD5

    a1f9933f151e127f4fc7ff82ad38d2a7

  • SHA1

    135f68fc2c89cca9a3d3027c3975d841e4d62323

  • SHA256

    ae6bd3b195dd0a5adc6629bae4cd297bb33ae118f8de11b4f885068829de0f7b

  • SHA512

    25320a2c3425be6deda37597ceb0e46e4f6875a006179fa04279c3d869844de1e073874499da14ba3260bcea5ec3d6f5c0919986a2242445a7d9f1bd71c91d05

  • SSDEEP

    12288:Ys9eQagJtAld4MknEv7gUz05CD1IsHPBdmrv:TeMJtAldRz05oGMdO

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://barebrilliancedkoso.shop/api

https://parallelmercywksoffw.shop/api

https://ohfantasyproclaiwlo.shop/api

https://landdumpycolorwskfw.shop/api

https://flourhishdiscovrw.shop/api

https://conferencefreckewl.shop/api

https://notoriousdcellkw.shop/api

https://liabiliytshareodlkv.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6bd3b195dd0a5adc6629bae4cd297bb33ae118f8de11b4f885068829de0f7b.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6bd3b195dd0a5adc6629bae4cd297bb33ae118f8de11b4f885068829de0f7b.dll,#1
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2456-3-0x0000000077541000-0x0000000077661000-memory.dmp

    Filesize

    1.1MB

  • memory/3584-1-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3584-5-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3584-4-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB

  • memory/3584-6-0x0000000000400000-0x0000000000459000-memory.dmp

    Filesize

    356KB