General
-
Target
d8c2dbe1dc35a7cdac6842d48fecb333.exe
-
Size
1.7MB
-
Sample
241216-k23e9avkep
-
MD5
d8c2dbe1dc35a7cdac6842d48fecb333
-
SHA1
e2c05c1cd61c9085f23f1462acdc10444c52dc0a
-
SHA256
b42e54290ed4aad3ce47fee33a85c5438736e76c26f85a6e422a9da60203f219
-
SHA512
b90e0dbc88945aa4c75cfe4c9b6b8e9046a363eaca6797a8fe44b27e9c9224e06b1380465cb61439256f64fce05f8d5006bb932101b3d42970cb5db6a0ae5dc7
-
SSDEEP
49152:KVGfuwDAsjKlaPIfyJsEQgRT4+Agta6x:IGfj9PIyWEfRTUw
Static task
static1
Behavioral task
behavioral1
Sample
d8c2dbe1dc35a7cdac6842d48fecb333.exe
Resource
win7-20241023-en
Malware Config
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://tacitglibbr.biz/api
Extracted
stealc
stok
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Extracted
lumma
https://tacitglibbr.biz/api
Targets
-
-
Target
d8c2dbe1dc35a7cdac6842d48fecb333.exe
-
Size
1.7MB
-
MD5
d8c2dbe1dc35a7cdac6842d48fecb333
-
SHA1
e2c05c1cd61c9085f23f1462acdc10444c52dc0a
-
SHA256
b42e54290ed4aad3ce47fee33a85c5438736e76c26f85a6e422a9da60203f219
-
SHA512
b90e0dbc88945aa4c75cfe4c9b6b8e9046a363eaca6797a8fe44b27e9c9224e06b1380465cb61439256f64fce05f8d5006bb932101b3d42970cb5db6a0ae5dc7
-
SSDEEP
49152:KVGfuwDAsjKlaPIfyJsEQgRT4+Agta6x:IGfj9PIyWEfRTUw
-
Lumma family
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
2Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3