Analysis
-
max time kernel
42s -
max time network
43s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
-
submitted
10-01-2025 15:41
General
-
Target
s0lara executor 2026.rar
-
Size
1.3MB
-
MD5
e2ce4cc6f2f6c0ea343262a7b88ba908
-
SHA1
63a3fc798e90242131cd169cd75d69284d4facb3
-
SHA256
ec6bf11908f7509cec1e00a361fba9bb7d1fe5e306c39c3a50b82fac24fe28ee
-
SHA512
f059cecc72a10b367f9e68fb54d848b0227ee51368876a586bb542d9d63cce77ae24d8544216e1f390faba5d4bacc83eec40c760714fa226177180e573613c9e
-
SSDEEP
24576:qGGtRMe86AOPXdlyQr1B4Y4OIcR08YI9e/l22jZlIZXeyEBtLPnffhjDkpz:qGGt5qCln4YYcRQ227IZXeFBnfxkR
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://scaredsensa.sbs/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Executes dropped EXE 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 36 IoCs
-
Suspicious use of SendNotifyMessage 33 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\s0lara executor 2026.rar"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\ReleseeBoostrapper\BoostrappersN.exe"C:\Users\Admin\Desktop\ReleseeBoostrapper\BoostrappersN.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\ReleseeBoostrapper\BoostrappersN.exe"C:\Users\Admin\Desktop\ReleseeBoostrapper\BoostrappersN.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\ReleseeBoostrapper\BoostrappersN.exe"C:\Users\Admin\Desktop\ReleseeBoostrapper\BoostrappersN.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Desktop\ReleseeBoostrapper\BoostrappersN.exe"C:\Users\Admin\Desktop\ReleseeBoostrapper\BoostrappersN.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD504602651f127a19f43bfcad57514d552
SHA12c8a0b841bdab3b5c77794a2bad2be1e08d29d86
SHA256a6e4e665ebfe59d7bf884c1750bcdd8cddb77fb537e9d1018efe28abf8945d53
SHA512ddca046391d6318e80b7fdfe335cbbf26ed53ba6f8e2b632aefba1fc34385790fff0a6ac52406fffa7d0a7ab20e25ba1833956a826ff03851b6c80467852db9b
-
Filesize
7.2MB
MD5f6d8913637f1d5d2dc846de70ce02dc5
SHA15fc9c6ab334db1f875fbc59a03f5506c478c6c3e
SHA2564e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187
SHA51221217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036
-
Filesize
780KB
-
Filesize
4.2MB
-
Filesize
348KB
-
Filesize
780KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4.2MB
-
Filesize
348KB
-
Filesize
780KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
780KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
4.2MB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
780KB
-
Filesize
348KB
-
Filesize
4.2MB
-
Filesize
780KB