Analysis
- max time kernel
120s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20250129-en - resource tags
- submitted
31/01/2025, 17:40
General
- Target 2024-12-25/unknown-e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962.exe
- Size 2.5MB
- Sample250131-v87nnasmdv
- SHA256 e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962
Malware Config
Extracted
-
lumma
-
https://rapeflowwj.lat/api
-
https://crosshuaht.lat/api
-
https://sustainskelet.lat/api
-
https://aspecteirs.lat/api
-
https://energyaffai.lat/api
-
https://necklacebudi.lat/api
-
https://discokeyus.lat/api
-
https://grannyejh.lat/api
-
https://movementby.cyou/api
Signatures
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25\unknown-e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25\unknown-e49324f54cdf00a226d1779157391c9c260ddb6a5179ece3276f326052b95962.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4484-2-0x0000000000800000-0x0000000000900000-memory.dmp
memory/4484-3-0x0000000000800000-0x0000000000900000-memory.dmp
memory/4484-4-0x0000000000800000-0x0000000000900000-memory.dmp
memory/4484-6-0x0000000000400000-0x0000000000452000-memory.dmp
memory/4484-10-0x0000000000800000-0x0000000000900000-memory.dmp