Resubmissions
03-01-2025 19:53
250103-ymf6cszrbw 1003-01-2025 05:06
250103-frq71szrdy 1003-01-2025 05:00
250103-fm1kwstjgq 1003-01-2025 04:45
250103-fdjk1ssqar 1003-01-2025 04:35
250103-e7skcasmfr 1003-01-2025 03:28
250103-d1dbeazrfl 10Analysis
-
max time kernel
2s -
max time network
4s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
03-01-2025 04:45
General
-
Target
36c05fed693856403b0e8aa36b032d350424ec12a657cb9a98f974f218db3884.exe
-
Size
310KB
-
MD5
2ea329cf21fe95c260ea3b956b6fbb75
-
SHA1
4c8a6dfe97d33ada86c65298ad91ab46eddc8454
-
SHA256
36c05fed693856403b0e8aa36b032d350424ec12a657cb9a98f974f218db3884
-
SHA512
9ba7c26d15f6a116489e69c364f51484fa028dc92cf76a15e7c49095707bc4d499e6da31e9c79e1c5d2b3047dcb0518e10fd01f163b9c6e71282fffb2e8eac90
-
SSDEEP
6144:N0ytx8RRzYd1mH+CkaPSdpzybQiwRF/yCQaOn39cm4W8+:NpeRRzQ0BkFd40bbqC8Wms+
Malware Config
Extracted
lumma
https://enterwahsh.biz/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\36c05fed693856403b0e8aa36b032d350424ec12a657cb9a98f974f218db3884.exe"C:\Users\Admin\AppData\Local\Temp\36c05fed693856403b0e8aa36b032d350424ec12a657cb9a98f974f218db3884.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 13202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3908 -ip 39081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
-
Filesize
304KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
304KB
-
Filesize
176KB