Resubmissions

06-01-2025 21:28

250106-1bpz8sykez 10

06-01-2025 21:25

250106-z9lvssyjft 4

General

  • Target

    https://github.com/git62025/movie/releases/download/movie2/blueredgreen.mp4

  • Sample

    250106-1bpz8sykez

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

https://github.com/git62025/movie/releases/download/movie2/blueredgreen.mp4

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://klipdohesoo.shop/ruwin.png

Extracted

Language
hta
Source
URLs
hta.dropper

https://github.com/git62025/movie/releases/download/movie2/blueredgreen.mp4/1

Extracted

Family

lumma

C2

https://rainywearyrs.cyou/api

Targets

    • Target

      https://github.com/git62025/movie/releases/download/movie2/blueredgreen.mp4

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks