Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-01-2025 10:41
General
-
Target
fghj.exe
-
Size
3.1MB
-
MD5
549e550f48b48de65c69c4e87bffaa00
-
SHA1
ff5914ba3411ba52049f9cec0b7c5267d2f7015a
-
SHA256
b4129afa37522ee77ca932eb2f29c16df3ad47dc6cc52864ef488fbb537296e2
-
SHA512
de2a949ae9ce6f6b80cccea0ae0b7ebd997df54cfc697285c52220ee42d7294d8b9202bc7edece9241b8b6bf7215365608bc704d2cfe636dd528eb2d03320586
-
SSDEEP
98304:R5tGWuHhHh+oGqWy9zLyj3y5Jmpb3wUgzE:R5UWAhlGqpJyjxpbAUgw
Malware Config
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://spellshagey.biz/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fghj.exe"C:\Users\Admin\AppData\Local\Temp\fghj.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB