Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 04:51
General
-
Target
InstallPack (1234).zip
-
Size
18.7MB
-
MD5
94fd170341983a6ecdc67c80f64583e8
-
SHA1
a3d0a1bc36ecf5ea7e46c16c2b00f3d3140e210d
-
SHA256
f6d9ba60e223e0eff4f69f345656c450e81fbc56d152a768045f204a9bebc8f6
-
SHA512
35e226c27dee7749fe25eca2cd838461876d174aa1785aa372fce499bcadd7c592fc994e975ef609c165559b50ab59e2ada0658e25348fe5cf6e1b721d70117b
-
SSDEEP
393216:uSrFkoIJqAnNXz79fwl0S8adE0YyLVoNfojJR:UoIJTNj7dI8aPLSNQjP
Score
10/10
Malware Config
Extracted
Family
lumma
C2
https://priceygoveiuz.cyou/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\InstallPack (1234).zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\install.exe"C:\Users\Admin\Desktop\install.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
-
Filesize
340KB