Overview
overview
10Static
static
10Wave.exe
windows7-x64
10Wave.exe
windows10-2004-x64
10d3d9.dll
windows10-2004-x64
1d3dx9_24.dll
windows7-x64
1d3dx9_24.dll
windows10-2004-x64
1vcruntime140_1.dll
windows7-x64
1vcruntime140_1.dll
windows10-2004-x64
1Wave-Execu...se.apk
android-9-x86
Wave-Execu...se.apk
android-10-x64
Wave-Execu...se.apk
android-11-x64
Wave-Execu...er.jar
windows7-x64
1Wave-Execu...er.jar
windows10-2004-x64
1Wave-Execu...radlew
ubuntu-18.04-amd64
1Wave-Execu...radlew
debian-9-armhf
1Wave-Execu...radlew
debian-9-mips
1Wave-Execu...radlew
debian-9-mipsel
1Wave-Execu...ew.bat
windows7-x64
1Wave-Execu...ew.bat
windows10-2004-x64
7Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05-01-2025 16:06
Behavioral task
behavioral1
Sample
Wave.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Wave.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
d3d9.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
d3dx9_24.dll
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
d3dx9_24.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
vcruntime140_1.dll
Resource
win7-20241010-en
Behavioral task
behavioral7
Sample
vcruntime140_1.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
Wave-Executor-master/app/release/app-release.apk
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral9
Sample
Wave-Executor-master/app/release/app-release.apk
Resource
android-x64-20240624-en
Behavioral task
behavioral10
Sample
Wave-Executor-master/app/release/app-release.apk
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral11
Sample
Wave-Executor-master/gradle/wrapper/gradle-wrapper.jar
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Wave-Executor-master/gradle/wrapper/gradle-wrapper.jar
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Wave-Executor-master/gradlew
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral14
Sample
Wave-Executor-master/gradlew
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral15
Sample
Wave-Executor-master/gradlew
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral16
Sample
Wave-Executor-master/gradlew
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral17
Sample
Wave-Executor-master/gradlew.bat
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Wave-Executor-master/gradlew.bat
Resource
win10v2004-20241007-en
General
-
Target
Wave.exe
-
Size
513KB
-
MD5
75ed57737c412920b83115a7f83ab080
-
SHA1
b0c063d5a3ce591344a3e75b0d6684831e4dd5be
-
SHA256
465a5e75e0dc8f8ea267e50b10ad2500004351ab9de751a559845a33eb776174
-
SHA512
856b7d3bb38c8549cacfffcd4ab2bcc850b42fdac6c17ec5169cdd9ee037b04f57aab165590302706d8d70ef022737af9a707646656b8e89bc34e7e3d4a9bc71
-
SSDEEP
12288:pCNPcUlbc0Lc9bJOqEyBngvKDqcmUPnwYXLFNKScYr:pCWUlbc0LcFJOqEJSD4UPwYXL
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://fancywaxxers.shop/api
Signatures
-
Lumma family
-
Loads dropped DLL 1 IoCs
pid Process 2340 Wave.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Wave.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
454KB
MD5d21c3f41ef9c6edbda37fffd0118e8fa
SHA12517d28e67e8ae3bc786d40a706b5b3a94cb8eac
SHA256d185706d8f5f370c07e7ed12483919a6c68193a54728878dde2a019d4cf65755
SHA512e4f829d4c41e4c149f20b08526806c3e76825f73de28043029134d46f9deede9ad03f2f131535bf807501c838ca4f4858f4d9e24d7e587b8577b528157d61050