Analysis
-
max time kernel
88s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
01/03/2025, 17:48
General
-
Target
Eulen-main.zip
-
Size
1.4MB
-
MD5
605851048ca50fa367c2f07334d07e01
-
SHA1
9283ebde400358d1a8fcc84c6b0d9f50f20974b5
-
SHA256
4247b08cc378ae26e1302c571e2d89beffe6061ab99a37213efd124113582752
-
SHA512
27367b32bc9ad1a746d09dc48aa3e00abe17456d03075abf4a37638184b7a45402d2280ba941b72c77f584f5e4e67acb2ae97b0c92591b99becc5af0510f0a2e
-
SSDEEP
24576:BwMt0Z7HgShMicpLy2pE2I0gxiO521UcgazBGuWJQmrfjNiVrGroGxgkIKgu:Nyd1MicLjB22L+Jf/NqrGMGxUdu
Malware Config
Extracted
lumma
https://secretionsuitcasenioise.shop/api
https://modestessayevenmilwek.shop/api
https://triangleseasonbenchwj.shop/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Eulen-main.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Eulen-main\Loader.exe"C:\Users\Admin\Desktop\Eulen-main\Loader.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
604KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
604KB