Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-01-2025 19:44
General
-
Target
BootstrapperV2.exe
-
Size
425KB
-
MD5
243de9a991629f8ded3b708937f10281
-
SHA1
598f43cf568dd410e7d7f7587ad796a4701b68c0
-
SHA256
577acffd2b69db8b0fc1b33b54464293fe98bad61e4c6d75b5e1a4c4be13d80e
-
SHA512
e76d27e7e6850e9673bbd4685e7f4d423c843955917faad1690d537471192669a07e2915ce4d4356311ee27b21c0c3b9ea410cd96099e3ee035cb964aabc3a65
-
SSDEEP
6144:f2biw0pONo+1zNaNAMJQXVGd9qRKl9JrCa/41BMEdKp:+rPNoYzNui4qA0
Malware Config
Extracted
lumma
https://toemagnifuy.biz/api
https://fraggielek.biz/api
https://grandiouseziu.biz/api
https://littlenotii.biz/api
https://marketlumpe.biz/api
https://nuttyshopr.biz/api
https://punishzement.biz/api
https://spookycappy.biz/api
https://truculengisau.biz/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 39 IoCs
-
Suspicious use of SendNotifyMessage 39 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 14002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2456 -ip 24561⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
316KB
-
Filesize
356KB
-
Filesize
1024KB
-
Filesize
860KB
-
Filesize
316KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
860KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB