Overview

overview

10

Static

static

10

e3a0b2039b...d3.ps1

windows10-2004-x64

10

e3a0b2039b...d3.ps1

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e3a0b2039b3f4eb9222ae14b0dfe0ee34da695dbe69f9fb8338820bd9b0c84d3.ps1
  • Size 2KB
  • Sample250423-e9fnkaxsbs
  • SHA256 e3a0b2039b3f4eb9222ae14b0dfe0ee34da695dbe69f9fb8338820bd9b0c84d3
  • MD5 SHA1 SHA512
Score
10/10
lummadefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://wn.sg/file.exe
  • exe.dropper

    https://wn.sg/script.ps1

Extracted

Family

  • lumma

C2

  • https://clarmodq.top/qoxo

  • https://ilongitudde.digital/wizu

  • https://hemispherexz.top/xapp

  • https://equatorf.run/reiq

  • https://latitudert.live/teui

  • https://longitudde.digital/wizu

  • https://climatologfy.top/kbud

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://wn.sg/file.exe
  • exe.dropper

    https://wn.sg/script.ps1

Targets

    • Target
      e3a0b2039b3f4eb9222ae14b0dfe0ee34da695dbe69f9fb8338820bd9b0c84d3.ps1
    • Size 2KB
    • SHA256 e3a0b2039b3f4eb9222ae14b0dfe0ee34da695dbe69f9fb8338820bd9b0c84d3
    • MD5 SHA1 SHA512
    Score
    10/10
    lummadefense_evasiondiscoveryexecutionpersistencespywarestealer

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks