Analysis
-
max time kernel
433s -
max time network
439s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
18-01-2025 19:53
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10ltsc2021-20250113-en
4 signatures
600 seconds
Behavioral task
behavioral2
Sample
setup.exe
Resource
win11-20241007-en
2 signatures
600 seconds
General
-
Target
setup.exe
-
Size
673.0MB
-
MD5
ffc834a78ab1262b863024d7a3bd6894
-
SHA1
110d2b563d9561d2ddcf6b7a83fd421dd01e183a
-
SHA256
11d965593e06f6ded4a19258115376ad95c1eeefa66500c6a98f99b032bbbe63
-
SHA512
a6b8b2874c240a348bfb45c76135379be7b2223934101d9ff4391a2bcbd16f1cccf2c292308409a49a2c061bbf80d3121dfbc45001132e038fc812963de9dfb4
-
SSDEEP
49152:JRkmJuZ72eQ5cZ4Eu8zXvwbEDQDYBIR8JL:Jmb/VvwbWGY
Malware Config
Extracted
Family
lumma
C2
https://stewkickyuope.shop/api
Signatures
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3732 setup.exe 3732 setup.exe
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request138.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requeststewkickyuope.shopIN AResponsestewkickyuope.shopIN A172.67.200.189stewkickyuope.shopIN A104.21.50.43
-
Remote address:172.67.200.189:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: stewkickyuope.shop
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=rhvlflp45qnjtqciqap9rcg4nq; expires=Wed, 14 May 2025 13:41:56 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a10rXvAQw7hcYNdurp%2FGHyCwKji2nH9f8qaUYZ8yr%2BbfSnb12QPnsxVndDY6QlV4avgjYeSxtfGSPCLbFO8hfwhiQlQGNTTDlYXPRXC8dklARUegFIeJQg8md0vWeInZCaBlkzs%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 9041244a0a1d4134-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=32402&min_rtt=26743&rtt_var=16153&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3302&recv_bytes=609&delivery_rate=125869&cwnd=248&unsent_bytes=0&cid=7b615adbaee4dc25&ts=289&x=0"
-
Remote address:8.8.8.8:53Requeststrivehelpeu.bondIN AResponse
-
Remote address:8.8.8.8:53Requestcrookedfoshe.bondIN AResponse
-
Remote address:8.8.8.8:53Requestimmolatechallen.bondIN AResponse
-
Remote address:8.8.8.8:53Requeststripedre-lot.bondIN AResponse
-
Remote address:8.8.8.8:53Requestgrowthselec.bondIN AResponse
-
Remote address:8.8.8.8:53Request189.200.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestjarry-deatile.bondIN AResponse
-
Remote address:8.8.8.8:53Requestpain-temper.bondIN AResponse
-
Remote address:8.8.8.8:53Requestjarry-fixxer.bondIN AResponse
-
Remote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A2.22.99.85
-
Remote address:2.22.99.85:443RequestGET /profiles/76561199724331900 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: steamcommunity.com
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Sat, 18 Jan 2025 19:55:18 GMT
Content-Length: 35613
Connection: keep-alive
Set-Cookie: sessionid=deab05863be5fe4b4b71f396; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
-
Remote address:8.8.8.8:53Requestvladimir-ulyanov.comIN AResponse
-
Remote address:8.8.8.8:53Request85.99.22.2.in-addr.arpaIN PTRResponse85.99.22.2.in-addr.arpaIN PTRa2-22-99-85deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.173.189.20.in-addr.arpaIN PTRResponse
-
1.0kB 4.9kB 9 9
HTTP Request
POST https://stewkickyuope.shop/apiHTTP Response
200 -
1.5kB 43.1kB 21 36
HTTP Request
GET https://steamcommunity.com/profiles/76561199724331900HTTP Response
200
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
138.32.126.40.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
64 B 96 B 1 1
DNS Request
stewkickyuope.shop
DNS Response
172.67.200.189104.21.50.43
-
63 B 128 B 1 1
DNS Request
strivehelpeu.bond
-
63 B 128 B 1 1
DNS Request
crookedfoshe.bond
-
66 B 131 B 1 1
DNS Request
immolatechallen.bond
-
64 B 129 B 1 1
DNS Request
stripedre-lot.bond
-
62 B 127 B 1 1
DNS Request
growthselec.bond
-
73 B 135 B 1 1
DNS Request
189.200.67.172.in-addr.arpa
-
64 B 129 B 1 1
DNS Request
jarry-deatile.bond
-
62 B 127 B 1 1
DNS Request
pain-temper.bond
-
63 B 128 B 1 1
DNS Request
jarry-fixxer.bond
-
64 B 80 B 1 1
DNS Request
steamcommunity.com
DNS Response
2.22.99.85
-
66 B 139 B 1 1
DNS Request
vladimir-ulyanov.com
-
69 B 131 B 1 1
DNS Request
85.99.22.2.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
26.173.189.20.in-addr.arpa