Overview

overview

10

Static

static

1

setup.exe

windows7-x64

10

setup.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-01-2025 13:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup.exe

  • Size

    71.1MB

  • MD5

    76f2e89ace5c9b36679ce13b57c8b752

  • SHA1

    736b004b46dfb5d0fef7758406883a22f15b1649

  • SHA256

    16c3793c3deafcfb489b2347d08bfd0a420ce0f8c27dd4afeea05d9d9a99f413

  • SHA512

    b7f872efbae47b45e72e4f05ef46d17506f117019b2fabd78e0a672f3ebc3ce924986ddceaae900afbb85382041d8bc8cf50f8cb5ef798796b89c768b6283a3a

  • SSDEEP

    24576:2+QSkqgnQNDa5lZeGvyErqPW+UHx+/uxVrwiFx7ssa+7:27XqdG7qw3VrTFpsP

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://fairiespar.cyou/api

Extracted

Family

lumma

C2

https://fairiespar.cyou/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:5012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5012-0-0x00000000006D0000-0x00000000006D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5012-2-0x0000000003280000-0x00000000032D5000-memory.dmp

    Filesize

    340KB

    Download

  • memory/5012-5-0x0000000000400000-0x0000000000513000-memory.dmp

    Filesize

    1.1MB

    Download