Overview
overview
10Static
static
10Exloader/7zxa.dll
windows7-x64
1Exloader/7zxa.dll
windows10-2004-x64
1Exloader/D...it.dll
windows7-x64
1Exloader/D...it.dll
windows10-2004-x64
1Exloader/D...rs.dll
windows7-x64
1Exloader/D...rs.dll
windows10-2004-x64
1Exloader/RarExt.dll
windows7-x64
3Exloader/RarExt.dll
windows10-2004-x64
3Exloader/e...v3.exe
windows7-x64
10Exloader/e...v3.exe
windows10-2004-x64
10Exloader/p...rm.dll
windows7-x64
1Exloader/p...rm.dll
windows10-2004-x64
1Analysis
-
max time kernel
53s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-01-2025 21:25
Behavioral task
behavioral1
Sample
Exloader/7zxa.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
Exloader/7zxa.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Exloader/Data/MimeKit.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Exloader/Data/MimeKit.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Exloader/Data/System.Buffers.dll
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral6
Sample
Exloader/Data/System.Buffers.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Exloader/RarExt.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Exloader/RarExt.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Exloader/exland_setup_v3.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
Exloader/exland_setup_v3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Exloader/psmachine_arm.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Exloader/psmachine_arm.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Exloader/exland_setup_v3.exe
-
Size
519KB
-
MD5
e65b9d796febfbf98d7887a2c50a11cc
-
SHA1
b3f0697389f8c58838db281f23f1740053e5416b
-
SHA256
12fe4165742c6d9020723d6abb9a1c10c3fa738e52ac353690780615af7f895c
-
SHA512
c09f291e374c5f2b001ec657881b3206a902a3eaa15564dc47be8d9acebe709f4b4ee1278e4f38d1ece31f4657f7b440444ffbb228b8fdf58d1dfcf13ad08aff
-
SSDEEP
12288:buYx6vQBHZi+4dD/aCXRYdAIo6QTcutL547S:bFsYBHZi+4dD/aChYdAIohTDL
Malware Config
Extracted
lumma
https://robinsharez.shop/api
https://handscreamny.shop/api
https://chipdonkeruz.shop/api
https://versersleep.shop/api
https://crowdwarek.shop/api
https://apporholis.shop/api
https://femalsabler.shop/api
https://soundtappysk.shop/api
https://letterdrive.shop/api
Signatures
-
Lumma family
-
Loads dropped DLL 1 IoCs
pid Process 2180 exland_setup_v3.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language exland_setup_v3.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2920 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2920 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe 2920 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Exloader\exland_setup_v3.exe"C:\Users\Admin\AppData\Local\Temp\Exloader\exland_setup_v3.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2180
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2744
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460KB
MD5dbabcaafb00ee630d0c6ed9584182247
SHA1abf1f026573fbcc43e65f488d74af589104aa1f6
SHA2563247cdc1d68e4c0c518b642d37197b52bc2e21730545165c18755b83b6581cc2
SHA5125f64e281893fee417200f0c400d14346eca8c27393c1b354e49d6ebbbc10a666469f35a78df34f4fa90fe4777f8ced6c2807064d39ad47c04b002010b82d9ddc