Overview
overview
10Static
static
3SoftV10.19...V8.exe
windows10-2004-x64
10SoftV10.19...up.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-1.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1SoftV10.19...-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
101s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250610-en -
resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2025, 17:42
Static task
static1
Behavioral task
behavioral1
Sample
SoftV10.19/LauncherV8.exe
Resource
win10v2004-20250610-en
Behavioral task
behavioral2
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/WinFallbackLookup.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-console-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral4
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-console-l1-2-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral5
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-datetime-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral6
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-debug-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral7
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-errorhandling-l1-1-0.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-fibers-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral9
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-file-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral10
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-file-l1-2-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral11
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-file-l2-1-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral12
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-handle-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral13
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-heap-l1-1-0.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-interlocked-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral15
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-libraryloader-l1-1-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral16
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-localization-l1-2-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral17
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-memory-l1-1-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral18
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-namedpipe-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral19
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-processenvironment-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral20
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-processthreads-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral21
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral22
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-profile-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral23
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-rtlsupport-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral24
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-string-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral25
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-synch-l1-1-0.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-synch-l1-2-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral27
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-sysinfo-l1-1-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral28
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-timezone-l1-1-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral29
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-core-util-l1-1-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral30
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-crt-conio-l1-1-0.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral31
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral32
Sample
SoftV10.19/bin/java-runtime-gamma/windows/java-runtime-gamma/bin/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20250502-en
General
-
Target
SoftV10.19/LauncherV8.exe
-
Size
97KB
-
MD5
7aa94603be1f83c51661df24c0f88ec3
-
SHA1
583de88d7cc7411d71cad97b4642bfa6aeb54751
-
SHA256
cb893f43012c270c23043563282e012f2552f7c2996f8951cb5672b197511bab
-
SHA512
119503e11435f36266834a40db5eec7fd6da3ebd62dd0f61b5b28233569cfc93634d9ba8a73ad7d8084236e624bbc6e7305b52edaddd2cd0c5fb527717547e79
-
SSDEEP
1536:GCDuhIxHHWMpdPa5wiE21M8kJIGFvb1CwH//+sd7Sy/H7:GCKSwMpdCq/IM8uIGfV//+sd1H7
Malware Config
Extracted
lumma
https://almzsff.shop/pwoq
https://ycvduc.xyz/trie
https://nbcsfar.xyz/tpxz
https://cbakk.xyz/ajng
https://trsuv.xyz/gait
https://sqgzl.xyz/taoa
https://cexpxg.xyz/airq
https://urarfx.xyz/twox
https://liaxn.xyz/nbzh
-
build_id
3015fd16646e24bcf7006651af8e1d699fbf4dec611b40ea06
Signatures
-
Lumma family
-
Blocklisted process makes network request 6 IoCs
flow pid Process 63 1312 rundll32.exe 65 1312 rundll32.exe 66 1312 rundll32.exe 67 1312 rundll32.exe 68 1312 rundll32.exe 69 1312 rundll32.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5960 set thread context of 1312 5960 LauncherV8.exe 107 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1312 rundll32.exe 1312 rundll32.exe 1312 rundll32.exe 1312 rundll32.exe 1312 rundll32.exe 1312 rundll32.exe 1312 rundll32.exe 1312 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeImpersonatePrivilege 1312 rundll32.exe Token: SeImpersonatePrivilege 1312 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107 PID 5960 wrote to memory of 1312 5960 LauncherV8.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\SoftV10.19\LauncherV8.exe"C:\Users\Admin\AppData\Local\Temp\SoftV10.19\LauncherV8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312
-