Analysis

  • max time kernel
    99s
  • max time network
    209s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    10-01-2025 00:26

General

  • Target

    Setuv6.9.86/Setuv6.997.exe

  • Size

    705KB

  • MD5

    d5917e889f8facae25ef3c35e3cc2fc3

  • SHA1

    c72e0fcccf29f187433cd7d0b49ed2cca1ea8474

  • SHA256

    39710ed8a0ab2db1d2388e27429edc1e0b34f3691d85c0feeb5fe4e3b179e6db

  • SHA512

    f53f09e71332c618bb6bc56a641399118e2b507db528ac476d1b3c3be70aed5d6067b9154ecce2db6d0662c576364d729eb8a01366992c6899bcb33d580662f5

  • SSDEEP

    12288:yZOOIkzlNMaPghgAbLe3ss+YRdKYt0eFPghgAbLe3ss+YRdKYt0eIlr7v:DOIkTM0qXXeuYeeRqXXeuYeeUr7v

Score
10/10

Malware Config

Extracted

Family

lumma

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setuv6.9.86\Setuv6.997.exe
    "C:\Users\Admin\AppData\Local\Temp\Setuv6.9.86\Setuv6.997.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Local\Temp\Setuv6.9.86\Setuv6.997.exe
      "C:\Users\Admin\AppData\Local\Temp\Setuv6.9.86\Setuv6.997.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2372

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2372-1-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2372-3-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2372-4-0x0000000000A20000-0x0000000000AD4000-memory.dmp

    Filesize

    720KB

  • memory/4284-0-0x0000000000A3C000-0x0000000000A3D000-memory.dmp

    Filesize

    4KB