Overview

overview

10

Static

static

3

9857c06ea4...42.exe

windows7-x64

10

9857c06ea4...42.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2025, 14:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe

  • Size

    1.5MB

  • MD5

    7513ddc0725a3859ca9e4bba9e6ad831

  • SHA1

    48a7ac1b3127d9ff4acc7c8f89e2980eb977474c

  • SHA256

    9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42

  • SHA512

    102d34cc402a26eddf1a7e5a9fbfd0f5623ab466518e2234d309e5489c4aefb0ad1b83c03044079f7fbfb2ab61dde62b9785065fb70ec93548eae6c77062d977

  • SSDEEP

    24576:O9m+6gpj5uvicCIiSkEs2gWRykuIgxVThEMK1PUDaO/R4wbbz+rA8G0vBVaFHR1Q:bGpj5uv9uIg3TaM6UpR3bbxJ71o8+

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://reflectepatt.click/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
    "C:\Users\Admin\AppData\Local\Temp\9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      "C:\Users\Admin\AppData\Local\Temp\9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4228
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 140
      2⤵
      • Program crash
      PID:2664
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2320 -ip 2320
    1⤵
      PID:2204

    Network

    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      68.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      167.173.78.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      167.173.78.104.in-addr.arpa
      IN PTR
      Response
      167.173.78.104.in-addr.arpa
      IN PTR
      a104-78-173-167deploystaticakamaitechnologiescom
    • flag-us
      DNS
      reflectepatt.click
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      reflectepatt.click
      IN A
      Response
    • flag-us
      DNS
      nearycrepso.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      nearycrepso.shop
      IN A
      Response
    • flag-us
      DNS
      nearycrepso.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      nearycrepso.shop
      IN A
      Response
    • flag-us
      DNS
      abruptyopsn.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      abruptyopsn.shop
      IN A
      Response
    • flag-us
      DNS
      wholersorie.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      wholersorie.shop
      IN A
      Response
    • flag-us
      DNS
      framekgirus.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      framekgirus.shop
      IN A
      Response
    • flag-us
      DNS
      tirepublicerj.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      tirepublicerj.shop
      IN A
      Response
    • flag-us
      DNS
      noisycuttej.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      noisycuttej.shop
      IN A
      Response
    • flag-us
      DNS
      rabidcowse.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      rabidcowse.shop
      IN A
      Response
    • flag-us
      DNS
      cloudewahsj.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      cloudewahsj.shop
      IN A
      Response
    • flag-us
      DNS
      cloudewahsj.shop
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      cloudewahsj.shop
      IN A
      Response
    • flag-us
      DNS
      steamcommunity.com
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      8.8.8.8:53
      Request
      steamcommunity.com
      IN A
      Response
      steamcommunity.com
      IN A
      23.214.143.155
    • flag-gb
      GET
      https://steamcommunity.com/profiles/76561199724331900
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      Remote address:
      23.214.143.155:443
      Request
      GET /profiles/76561199724331900 HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Host: steamcommunity.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Content-Type: text/html; charset=UTF-8
      Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
      Expires: Mon, 26 Jul 1997 05:00:00 GMT
      Cache-Control: no-cache
      Date: Tue, 21 Jan 2025 11:03:07 GMT
      Content-Length: 25984
      Connection: keep-alive
      Set-Cookie: sessionid=71b24fc5a832e3d66df53e31; Path=/; Secure; SameSite=None
      Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
    • flag-us
      DNS
      155.143.214.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      155.143.214.23.in-addr.arpa
      IN PTR
      Response
      155.143.214.23.in-addr.arpa
      IN PTR
      a23-214-143-155deploystaticakamaitechnologiescom
    • flag-us
      DNS
      200.163.202.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.163.202.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.42.69.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.42.69.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      60.153.16.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      60.153.16.2.in-addr.arpa
      IN PTR
      Response
      60.153.16.2.in-addr.arpa
      IN PTR
      a2-16-153-60deploystaticakamaitechnologiescom
    • flag-us
      DNS
      63.141.182.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      63.141.182.52.in-addr.arpa
      IN PTR
      Response
    • 23.214.143.155:443
      https://steamcommunity.com/profiles/76561199724331900
      tls, http
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      1.3kB
       33.2kB
       17
      29

      HTTP Request

      GET https://steamcommunity.com/profiles/76561199724331900

      HTTP Response

      200
    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      68.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      68.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      167.173.78.104.in-addr.arpa
      dns
      73 B
       139 B
       1
      1

      DNS Request

      167.173.78.104.in-addr.arpa

    • 8.8.8.8:53
      reflectepatt.click
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      64 B
       129 B
       1
      1

      DNS Request

      reflectepatt.click

    • 8.8.8.8:53
      nearycrepso.shop
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      124 B
       238 B
       2
      2

      DNS Request

      nearycrepso.shop

      DNS Request

      nearycrepso.shop

    • 8.8.8.8:53
      abruptyopsn.shop
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      62 B
       119 B
       1
      1

      DNS Request

      abruptyopsn.shop

    • 8.8.8.8:53
      wholersorie.shop
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      62 B
       119 B
       1
      1

      DNS Request

      wholersorie.shop

    • 8.8.8.8:53
      framekgirus.shop
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      62 B
       119 B
       1
      1

      DNS Request

      framekgirus.shop

    • 8.8.8.8:53
      tirepublicerj.shop
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      64 B
       121 B
       1
      1

      DNS Request

      tirepublicerj.shop

    • 8.8.8.8:53
      noisycuttej.shop
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      62 B
       119 B
       1
      1

      DNS Request

      noisycuttej.shop

    • 8.8.8.8:53
      rabidcowse.shop
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      61 B
       118 B
       1
      1

      DNS Request

      rabidcowse.shop

    • 8.8.8.8:53
      cloudewahsj.shop
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      124 B
       238 B
       2
      2

      DNS Request

      cloudewahsj.shop

      DNS Request

      cloudewahsj.shop

    • 8.8.8.8:53
      steamcommunity.com
      dns
      9857c06ea4a5fd183593506b4d3952ba5a9fe67396930f8e9023af771129ac42.exe
      64 B
       80 B
       1
      1

      DNS Request

      steamcommunity.com

      DNS Response

      23.214.143.155

    • 8.8.8.8:53
      155.143.214.23.in-addr.arpa
      dns
      73 B
       139 B
       1
      1

      DNS Request

      155.143.214.23.in-addr.arpa

    • 8.8.8.8:53
      200.163.202.172.in-addr.arpa
      dns
      74 B
       160 B
       1
      1

      DNS Request

      200.163.202.172.in-addr.arpa

    • 8.8.8.8:53
      241.42.69.40.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      241.42.69.40.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      60.153.16.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      60.153.16.2.in-addr.arpa

    • 8.8.8.8:53
      63.141.182.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      63.141.182.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2320-18-0x0000000000452000-0x000000000046B000-memory.dmp

      Filesize

      100KB

      Download

    • memory/2320-1-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2320-2-0x0000000000452000-0x000000000046B000-memory.dmp

      Filesize

      100KB

      Download

    • memory/2320-3-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2320-5-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2320-8-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2320-13-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2320-12-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2320-0-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2320-22-0x0000000000452000-0x000000000046B000-memory.dmp

      Filesize

      100KB

      Download

    • memory/2320-20-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2320-7-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/4228-16-0x0000000000400000-0x0000000000576000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/4228-17-0x00000000000C0000-0x0000000000116000-memory.dmp

      Filesize

      344KB

      Download

    • memory/4228-9-0x00000000000C0000-0x0000000000116000-memory.dmp

      Filesize

      344KB

      Download

    • memory/4228-15-0x00000000000C0000-0x0000000000116000-memory.dmp

      Filesize

      344KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.