Overview
overview
10Static
static
9Released/B...UI.exe
windows7-x64
10Released/B...UI.exe
windows10-2004-x64
10Released/a...in.dll
windows7-x64
3Released/a...in.dll
windows10-2004-x64
3Released/l...ng.dll
windows7-x64
1Released/l...ng.dll
windows10-2004-x64
1Released/l...ng.dll
windows7-x64
1Released/l...ng.dll
windows10-2004-x64
1Released/l...ng.dll
windows7-x64
1Released/l...ng.dll
windows10-2004-x64
1Released/l...er.dll
windows7-x64
1Released/l...er.dll
windows10-2004-x64
1Released/l...-1.dll
windows7-x64
1Released/l...-1.dll
windows10-2004-x64
1Released/r...er.dll
windows7-x64
1Released/r...er.dll
windows10-2004-x64
1Released/r...er.dll
windows7-x64
1Released/r...er.dll
windows10-2004-x64
1Released/r...er.dll
windows7-x64
3Released/r...er.dll
windows10-2004-x64
3Released/s...Dex.js
windows7-x64
3Released/s...Dex.js
windows10-2004-x64
3Released/s...eld.js
windows7-x64
3Released/s...eld.js
windows10-2004-x64
3Released/s...Env.js
windows7-x64
3Released/s...Env.js
windows10-2004-x64
3Released/w...re.dll
windows7-x64
1Released/w...re.dll
windows10-2004-x64
1Released/w...pet.js
windows7-x64
3Released/w...pet.js
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 08:52
Behavioral task
behavioral1
Sample
Released/BootstrapperUI.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Released/BootstrapperUI.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Released/autoexec/bin.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Released/autoexec/bin.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Released/locales/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Released/locales/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Released/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Released/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Released/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
Released/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Released/locales/resources/vk_swiftshader.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Released/locales/resources/vk_swiftshader.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Released/locales/resources/vulkan-1.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Released/locales/resources/vulkan-1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Released/runtimes/win-arm64/native/WebView2Loader.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Released/runtimes/win-arm64/native/WebView2Loader.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Released/runtimes/win-x64/native/WebView2Loader.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Released/runtimes/win-x64/native/WebView2Loader.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Released/runtimes/win-x86/native/WebView2Loader.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
Released/runtimes/win-x86/native/WebView2Loader.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Released/scripts/Dex.js
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Released/scripts/Dex.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Released/scripts/Infinite Yield.js
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Released/scripts/Infinite Yield.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Released/scripts/UNCCheckEnv.js
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Released/scripts/UNCCheckEnv.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Released/workspace/Xeno.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Released/workspace/Xeno.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Released/workspace/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.57/adblock_snippet.js
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Released/workspace/Xeno.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.57/adblock_snippet.js
Resource
win10v2004-20241007-en
General
-
Target
Released/BootstrapperUI.exe
-
Size
292KB
-
MD5
b0a74e83add05a9c0860e95c7c4a568b
-
SHA1
7d2dc67ce9131589072528f8ae8c8e0be4bf0dea
-
SHA256
74570a5fadda2982eb8aa481b04677382f04d24c78b8dce3dca4bc526b85cc37
-
SHA512
adcdbad014c11988d6382f481759031b3744e79a9a03068040df6f21cde1f435098aae9dc8f7a442588c699ec3fbaae10fd866efc4d3ad58cc0b52c4dc25cb50
-
SSDEEP
6144:tvKu90jCF+IPsir88THYrBBoJvEV1i9q9F5fN:dKu90jAUi1THyMszi9qL
Malware Config
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://spellshagey.biz/api
Extracted
lumma
https://spellshagey.biz/api
Signatures
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BootstrapperUI.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b