Analysis
-
max time kernel
94s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29/01/2025, 22:29
General
-
Target
Loader.exe
-
Size
383KB
-
MD5
38a50f01c6d152ccdfa39db654923c5a
-
SHA1
aea32e51c1d549de779dd1360080696d9e3871ea
-
SHA256
074f68cba07911707860af2932fda77dfae0f0eb978cbadc4f8b64cbb9be1579
-
SHA512
51dc88f3b1686eedea545f37243a5beeb63ad64e121bb9aaf22e5699d39e18765764a5737a63b980530c5c6bf29c7896269928a96ee3207a092335da9c0a9a16
-
SSDEEP
6144:UYLr3e+d1STbKJ5yKpgD75e4qZmzbiCvYOxU:R/3ZST+NyULibiLMU
Malware Config
Extracted
lumma
https://sordid-snaked.cyou/api
https://awake-weaves.cyou/api
https://wrathful-jammy.cyou/api
https://debonairnukk.xyz/api
https://diffuculttan.xyz/api
https://effecterectz.xyz/api
https://deafeninggeh.biz/api
https://immureprech.biz/api
https://brendon-sharjen.biz/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 11962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1296 -ip 12961⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
-
Filesize
296KB
-
Filesize
348KB
-
Filesize
408KB
-
Filesize
176KB
-
Filesize
296KB
-
Filesize
348KB