Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    42b62e1e747b64a54a3f6896df2128d5.exe

  • Size

    1.8MB

  • Sample

    241216-kvjpkatqhn

  • MD5

    42b62e1e747b64a54a3f6896df2128d5

  • SHA1

    4b0d19351ed7eb44908eae3020b8298ed221d100

  • SHA256

    b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7

  • SHA512

    dca1b52076478cb15bded75a98ea7d689e548d87c1117c33bf303750b6495d396deb9de30711fc1eabfa0e47af20460c0bc1c15b2c85b683401c40c7e101e229

  • SSDEEP

    49152:CtR8X2NBoIch/r5dAYs8fbx6XBM15lyMUqPd/R:CTWYc/w4xExExR

Malware Config

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://tacitglibbr.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://tacitglibbr.biz/api

Targets

    • Target

      42b62e1e747b64a54a3f6896df2128d5.exe

    • Size

      1.8MB

    • MD5

      42b62e1e747b64a54a3f6896df2128d5

    • SHA1

      4b0d19351ed7eb44908eae3020b8298ed221d100

    • SHA256

      b6046ae1bd10e5aa4bb9280b48cd846482d5122de8bbe54998800e734bddd7f7

    • SHA512

      dca1b52076478cb15bded75a98ea7d689e548d87c1117c33bf303750b6495d396deb9de30711fc1eabfa0e47af20460c0bc1c15b2c85b683401c40c7e101e229

    • SSDEEP

      49152:CtR8X2NBoIch/r5dAYs8fbx6XBM15lyMUqPd/R:CTWYc/w4xExExR

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Modifies Windows Defender Real-time Protection settings

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.