General
-
Target
4dbf3891ef5bb0e734b67630fe2b5210035d56307ad663f3867d9ebcdd00497a.exe
-
Size
70.0MB
-
Sample
250106-c2ncbstjgz
-
MD5
8139ecd1163d5fcc41821dbb61ddc2ff
-
SHA1
707f18cc33e9ba8f7ada11b202b44876d375cecf
-
SHA256
4dbf3891ef5bb0e734b67630fe2b5210035d56307ad663f3867d9ebcdd00497a
-
SHA512
fdadbf19f27dc1c53b06834b1e5e196044cef456fe00a192d33c7fe3fab9ad990768133d006e41e43c2c727e7a2991f1fc5e279d315740a81240c66871ba44ec
-
SSDEEP
24576:TetiuQ3DguTjn4J5h5CGo9K2Y9iQ0pUIfH5Bk4+aKb7jb7j:qAB3Mcn4JrAVVQ0pVk4+7
Static task
static1
Behavioral task
behavioral1
Sample
4dbf3891ef5bb0e734b67630fe2b5210035d56307ad663f3867d9ebcdd00497a.exe
Resource
win7-20240903-en
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Targets
-
-
Target
4dbf3891ef5bb0e734b67630fe2b5210035d56307ad663f3867d9ebcdd00497a.exe
-
Size
70.0MB
-
MD5
8139ecd1163d5fcc41821dbb61ddc2ff
-
SHA1
707f18cc33e9ba8f7ada11b202b44876d375cecf
-
SHA256
4dbf3891ef5bb0e734b67630fe2b5210035d56307ad663f3867d9ebcdd00497a
-
SHA512
fdadbf19f27dc1c53b06834b1e5e196044cef456fe00a192d33c7fe3fab9ad990768133d006e41e43c2c727e7a2991f1fc5e279d315740a81240c66871ba44ec
-
SSDEEP
24576:TetiuQ3DguTjn4J5h5CGo9K2Y9iQ0pUIfH5Bk4+aKb7jb7j:qAB3Mcn4JrAVVQ0pVk4+7
-
Lumma family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-