Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
06-12-2024 06:03
General
-
Target
lummastealer.7z
-
Size
20.9MB
-
MD5
df9957243afdd11725b5f7e454b179aa
-
SHA1
bd856ebe241d3f0514b16d0a7fa1c9ab0cd47f53
-
SHA256
826e787cd4449d9814fa273d34c701390baa7deff4d472c9e6487170e8567d1e
-
SHA512
1e755334095fc60a1f3f5185a102e55cef32e8a096097e5ed0a991d97137f159d782ac2b8e541351a8e79686f2dc23a7ba6de8b1389174059f6f4f1a86000885
-
SSDEEP
393216:2Yvlm/SBCPubqLpP/iFAC+DyGNu9jIjGjlFb43369OBR2u8es7mdNYq4MXqfamrs:k6B2uuLpiVJkSjbH4euZs7mbqwf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\lummastealer.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\lummastealer\Setup.exe"C:\Users\Admin\Desktop\lummastealer\Setup.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.0MB
MD5480632d4f827ff83a62b2d11def0a8b0
SHA12be22b2f102eaa760c5ce055c7aad84ab749ce6d
SHA2564bd463ee8d69f9ac3defa5be9cd0ea2a4530dc6148da159940c10999748d9a55
SHA5128d06ee88c08f30618c2a646e47de758a58159e9a64d36458c56097aad25088f732fd0a83cb0517515eb5b892053e71627c33f227cce9f8b8ae9b762d557f9776
-
Filesize
130KB
MD5f189cc7f7c13a42480d9b58504156c28
SHA12526566ce83ad4d7678ac75167c16913b9248530
SHA25611a37192b44942fa6b1238f3b7b27fddc35bdf638747425b474109d08c947fd0
SHA512da7fe55a30117196404545dd86a640ad42dc1a0e78d912a8629fe50caa947b0ec08935d82d9e3f8089c76bff89f20acdb148a212bb299a584205a752ae2ce63a
-
Filesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
Filesize
2.4MB
MD55c73f8ec5f4f05e458a05bb23c8e8321
SHA1e05c2a197d915ecb0ddf10c2beebd607cc9b1b86
SHA2569cef91c5c100b6b616330df4763bc428fe3dd535e0efbd8c3311500fcac7d04f
SHA5128bf825f773307daeccff21d555f5e09a8a4406c52b95b1886151ed172dcfa8af374667819e570ab658e7706b75a4e8c803cf5ab2271a839f57d895e681e8c1aa
-
Filesize
51KB
MD514e7d17cc0ae65fe4064e8bc82b79899
SHA1b97356f114b70ae7e271903883e3bf32240c2097
SHA256de027d07419afdded302c691560f44f897fdae4ddb8bb27d75871d25b842ba15
SHA5125ac60f6db33e9915aab4bd5da3d18adc8dd7034e0b6ff5ff696305ff688f4d9fcc39c7c5236355ba082c1916f1989ab82b51dfd02c9742890608c25f33c9ed8b
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
15.5MB
-
Filesize
12.3MB
-
Filesize
1.7MB