Overview

overview

10

Static

static

1

Echelon.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    32s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2024, 22:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Echelon.exe

  • Size

    6.4MB

  • MD5

    cbdef49d32cf66bfa4c8a86d225b11bd

  • SHA1

    bc2ce52834c6a615a8bd5d3b6aafd25239d03b44

  • SHA256

    4e6c7876342928a4ca103e27e2a0823c0e8df2457ba32e5d62fcf94cb111a477

  • SHA512

    84c6a436250dc12c2055c75abd318c07408c314388ac3c3209d22985955cb2d1cc9e916f29fb10d9257cb3d995a72cf91be83258e3151b6a0eda36125b831adb

  • SSDEEP

    196608:YkywgD6ytCV8NxxKQP8v0ojDIg9Cbk/V8e:pyp621P8vXDd

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Echelon.exe
    "C:\Users\Admin\AppData\Local\Temp\Echelon.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:3772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3772-0-0x0000000001250000-0x00000000012A1000-memory.dmp

    Filesize

    324KB

    Download

  • memory/3772-1-0x0000000001250000-0x00000000012A1000-memory.dmp

    Filesize

    324KB

    Download

  • memory/3772-3-0x0000000001250000-0x00000000012A1000-memory.dmp

    Filesize

    324KB

    Download