Analysis
-
max time kernel
93s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-01-2025 23:22
General
-
Target
2025-01-06_0647798657b80cdfa9dd34701fe78a86_frostygoop_snatch.exe
-
Size
3.8MB
-
MD5
0647798657b80cdfa9dd34701fe78a86
-
SHA1
14ed01812346728cd77ae058bf3ac5c8d66f7c09
-
SHA256
60b1993f4ea7fbefe0431d94b0f1794d83259333d1aab7d0f83af852727d2e20
-
SHA512
07c980222541acbad98c10af73cee763fb62419674fbdab448991a4b4831d858367bf9120aedf62e459ebfc44da5a6a0b4a17d788e66392c7801667bb96b9456
-
SSDEEP
49152:3R/W9yhKrDPtTbvMr2aQPF7Ifxzce3qLz+LZwNhVwZotmdmjcE68l1nF19B7:3R/jitHEraLz9CqtmQ
Malware Config
Extracted
lumma
https://hummskitnj.buzz/api
https://cashfuzysao.buzz/api
https://appliacnesot.buzz/api
https://screwamusresz.buzz/api
https://inherineau.buzz/api
https://scentniej.buzz/api
https://rebuildeso.buzz/api
https://prisonyfork.buzz/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-06_0647798657b80cdfa9dd34701fe78a86_frostygoop_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-06_0647798657b80cdfa9dd34701fe78a86_frostygoop_snatch.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB