Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    99s
  • max time network
    140s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    02/01/2025, 23:52

General

  • Target

    FivemExternalCheat-main/Loader.exe

  • Size

    393KB

  • MD5

    3c4161be295e9e9d019ce68dae82d60a

  • SHA1

    36447fc6418e209dff1bb8a5e576f4d46e3b3296

  • SHA256

    0f6481dabf7871823f259eb95f3b85c37d1de8a7d1884ac77a97d887cf96f75d

  • SHA512

    cfa2d491a5d28beb8eb908d5af61254ac4c4c88e74c53d5d00ae15ef0731df1654304199996545d1074814c0ea8a032957b28d70774f05347616428e667f70e6

  • SSDEEP

    12288:ndoOphZgRZGJZzu/aeZjl5FeBTCVpgTfR:ndl/QZGTuHhjFe1C3gt

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FivemExternalCheat-main\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\FivemExternalCheat-main\Loader.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Users\Admin\AppData\Local\Temp\FivemExternalCheat-main\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\FivemExternalCheat-main\Loader.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2028-0-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2028-3-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

  • memory/2028-4-0x00007FFAECFB0000-0x00007FFAED1A8000-memory.dmp

    Filesize

    2.0MB

  • memory/2028-5-0x00007FFAECFB0000-0x00007FFAED1A8000-memory.dmp

    Filesize

    2.0MB

  • memory/2672-1-0x00007FFAECFB0000-0x00007FFAED1A8000-memory.dmp

    Filesize

    2.0MB