Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-01-2025 19:49
Static task
static1
Behavioral task
behavioral1
Sample
Νεω_Sετυρ_v.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Νεω_Sετυρ_v.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Νεω_Sετυρ_v.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral4
Sample
Νεω_Sετυρ_v.exe
Resource
win11-20241007-en
General
-
Target
Νεω_Sετυρ_v.exe
-
Size
655.1MB
-
MD5
16b7783cdcbddb455dc62548e436d521
-
SHA1
17869b46530bb62aeec9cd27cba831a2f6fb8f73
-
SHA256
b9b0afa977b327f17116e43f95e078c28ecc8683b0049a2bbde022a90529b637
-
SHA512
5fa69a12c66857f28ac8b50aa53f8824b30789c4bca2e95f3751990588b2c438eb5aee59ca7542bbf23727b0ae5356c1f98d1f441a284f4294a01b84f9fb160e
-
SSDEEP
98304:aVoGZ1wozU8VI8uG6CWi2XrloOlTh3jz:aNRArloO//
Malware Config
Extracted
lumma
https://twigbestug.shop/api
Signatures
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Νεω_Sετυρ_v.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4340 Νεω_Sετυρ_v.exe 4340 Νεω_Sετυρ_v.exe