General
-
Target
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
-
Size
1.1MB
-
Sample
250103-z2cl6atlfy
-
MD5
79972f296cb418a20b17d2440850d790
-
SHA1
3a096f7084a15176a30bb69126468059846c30ed
-
SHA256
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0
-
SHA512
9d0632eeb7c6907b70fe2dce984b20b0e83c1c4c9b0a2cc17c01f7b2be53171c5beb5c9fb5994ba51ebd2e83d3d8579e732535097b85681a3305914c3d89d38e
-
SSDEEP
24576:Rz/BfKdNZHQMtptCohxX+8Fn90yIJKQ0lTF0D3+kyOdsa1:hZE/HQM4ohxXz95IJKlJ0ypOdR
Static task
static1
Behavioral task
behavioral1
Sample
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
-
Size
1.1MB
-
MD5
79972f296cb418a20b17d2440850d790
-
SHA1
3a096f7084a15176a30bb69126468059846c30ed
-
SHA256
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0
-
SHA512
9d0632eeb7c6907b70fe2dce984b20b0e83c1c4c9b0a2cc17c01f7b2be53171c5beb5c9fb5994ba51ebd2e83d3d8579e732535097b85681a3305914c3d89d38e
-
SSDEEP
24576:Rz/BfKdNZHQMtptCohxX+8Fn90yIJKQ0lTF0D3+kyOdsa1:hZE/HQM4ohxXz95IJKlJ0ypOdR
-
Lumma family
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Suspicious use of SetThreadContext
-