Analysis
-
max time kernel
0s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 22:52
General
-
Target
1463b4f295186260be7b70898e81f673926a7eea22cc4ca340ec3464b36f022e.exe
-
Size
3.1MB
-
MD5
2f926994dcd9945ffed390e302aa8cbb
-
SHA1
4a8b9df036ad770333df6223dfd6c81d37a246b7
-
SHA256
1463b4f295186260be7b70898e81f673926a7eea22cc4ca340ec3464b36f022e
-
SHA512
ee3d8b225f1f176e6f05c538f4d04072780ebaa6e7c80faa69d7f3d101898ac3ac03c83148047de07b1b98511e992b8be44f8f47b28d1010a4447516ace1714c
-
SSDEEP
49152:RNzrSSSSSSSSSS0SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSkSSSVSa:RYzIZPRM55EgyoscaZ42ee1lN8
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://fancywaxxers.shop/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1463b4f295186260be7b70898e81f673926a7eea22cc4ca340ec3464b36f022e.exe"C:\Users\Admin\AppData\Local\Temp\1463b4f295186260be7b70898e81f673926a7eea22cc4ca340ec3464b36f022e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
344KB
-
Filesize
16.7MB
-
Filesize
3.1MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
344KB
-
Filesize
16.7MB