General

  • Target

    PASS-1234.exe

  • Size

    744KB

  • Sample

    241231-ty6g6s1mhn

  • MD5

    cf15f3e3576d512cf0696d4035212451

  • SHA1

    b9d2ae2405dbd77d4d6c226589990872319f98ce

  • SHA256

    3114e7c13f6545c7cb73343fbcb4ec4b0648751091d796f7923b17818603fb36

  • SHA512

    2b1d8a5a5f24768c6a733af9393376e533958719de452f34d88496f98cc600efc7ab94e57a23e57326d4106e978a5a24721ee633d1e498dedc6c9e949a0a83c8

  • SSDEEP

    12288:J8t1vT9z4WJ7lM3us92O7naDBKKnTur1AOy56/NlbFLJkG3Oa4j3cEsjp2LMVmAL:J45zzBi96Djo1QU/rFLS4Src

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Targets

    • Target

      PASS-1234.exe

    • Size

      744KB

    • MD5

      cf15f3e3576d512cf0696d4035212451

    • SHA1

      b9d2ae2405dbd77d4d6c226589990872319f98ce

    • SHA256

      3114e7c13f6545c7cb73343fbcb4ec4b0648751091d796f7923b17818603fb36

    • SHA512

      2b1d8a5a5f24768c6a733af9393376e533958719de452f34d88496f98cc600efc7ab94e57a23e57326d4106e978a5a24721ee633d1e498dedc6c9e949a0a83c8

    • SSDEEP

      12288:J8t1vT9z4WJ7lM3us92O7naDBKKnTur1AOy56/NlbFLJkG3Oa4j3cEsjp2LMVmAL:J45zzBi96Djo1QU/rFLS4Src

    Score
    10/10
    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks