Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2025, 13:21

General

  • Target

    43917446f022a9526e726ef8f1b80f8076118c789be40246f3b2b6f644f6e077N.exe

  • Size

    1.8MB

  • MD5

    f0b8cca9834c699f7d68a7e4596e8d70

  • SHA1

    b90fe174a6df530f8975b5ae2b3bc44e0260b013

  • SHA256

    43917446f022a9526e726ef8f1b80f8076118c789be40246f3b2b6f644f6e077

  • SHA512

    a09ecdd671ab44cbccf0b915c3c3067067e9c124b1a1a33439c3e07af74381ea28cdbd1dc80c6a5d2001afd682e3d30e3b925e7efe0a7a2226e9ee894ee32c13

  • SSDEEP

    49152:01TGnIEL6UJrBhTWiv3rOPjbl3egrmbXgZg2+Jc:cTAIEL6UJ1hTWiaPjbl3ebb6F

Malware Config

Extracted

Family

lumma

C2

https://pollution-raker.cyou/api

https://hosue-billowy.cyou/api

https://ripe-blade.cyou/api

https://smash-boiling.cyou/api

https://supporse-comment.cyou/api

https://greywe-snotty.cyou/api

https://steppriflej.xyz/api

https://sendypaster.xyz/api

https://cuddlyready.xyz/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43917446f022a9526e726ef8f1b80f8076118c789be40246f3b2b6f644f6e077N.exe
    "C:\Users\Admin\AppData\Local\Temp\43917446f022a9526e726ef8f1b80f8076118c789be40246f3b2b6f644f6e077N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1224-0-0x0000000000B90000-0x0000000001045000-memory.dmp

    Filesize

    4.7MB

  • memory/1224-1-0x0000000077E14000-0x0000000077E16000-memory.dmp

    Filesize

    8KB

  • memory/1224-2-0x0000000000B91000-0x0000000000BB6000-memory.dmp

    Filesize

    148KB

  • memory/1224-3-0x0000000000B90000-0x0000000001045000-memory.dmp

    Filesize

    4.7MB

  • memory/1224-4-0x0000000000B90000-0x0000000001045000-memory.dmp

    Filesize

    4.7MB

  • memory/1224-5-0x0000000000B90000-0x0000000001045000-memory.dmp

    Filesize

    4.7MB