Analysis

  • max time kernel
    105s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2025, 18:07

General

  • Target

    random.exe

  • Size

    1.8MB

  • MD5

    517735da69f918bddeab9f1aadf47c42

  • SHA1

    bc76a04f3efd8da6c77d6488b6a28e8f2ee8d187

  • SHA256

    eae4aa0f083a86a6b40dd4d5451129411f549fd9f736737b9364450ad4fb3690

  • SHA512

    eb8854a683df0c4682ca7cf242a24e0cc879c31a298d73758e6c5a1f1e4ce23ec5bb81e0cbdb238469e439adc8dc9acc0e717bade64701eb94622c5e137626cf

  • SSDEEP

    49152:0BhZW92dD1yMr/e0gcIXNPcDVcpFHVwLOM+JjFWbyKJ3:8ZNr/OmDVcpF3Wua3

Malware Config

Extracted

Family

lumma

C2

https://rbmlh.xyz/lakd

https://pacwpw.xyz/qwpr

https://comkxjs.xyz/taox

https://unurew.xyz/anhd

https://trsuv.xyz/gait

https://sqgzl.xyz/taoa

https://cexpxg.xyz/airq

https://urarfx.xyz/twox

https://liaxn.xyz/nbzh

Attributes
  • build_id

    390bea80c680e8ad8f5a7491c21e9997d7df1956cb

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:60

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/60-0-0x0000000000C80000-0x000000000111A000-memory.dmp

          Filesize

          4.6MB

        • memory/60-1-0x00000000055F0000-0x00000000055F1000-memory.dmp

          Filesize

          4KB

        • memory/60-4-0x0000000000C80000-0x000000000111A000-memory.dmp

          Filesize

          4.6MB

        • memory/60-6-0x0000000005600000-0x0000000005601000-memory.dmp

          Filesize

          4KB

        • memory/60-5-0x0000000005610000-0x0000000005611000-memory.dmp

          Filesize

          4KB

        • memory/60-7-0x0000000000C80000-0x000000000111A000-memory.dmp

          Filesize

          4.6MB

        • memory/60-9-0x0000000000C80000-0x000000000111A000-memory.dmp

          Filesize

          4.6MB