Overview

overview

10

Static

static

3

150c73a7b6...94.exe

windows10-2004-x64

10

150c73a7b6...94.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    150c73a7b6275381a1d06137a617cc94.exe
  • Size 36.2MB
  • Sample260825-rysj7szyex
  • SHA256 f708c405d13450a3886936d68e63ad841836d0a741fb6848fd7b58c83db988d2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lummadefense_evasiondiscoveryexecutionspywarestealertrojan

Malware Config

Extracted

Family

  • lumma

C2

  • https://t.me/abebebbee

  • https://africeconc.digital/pkas

  • https://jawdedmirror.run/ewqd

  • https://changeaie.top/geps

  • https://lonfgshadow.live/xawi

  • https://liftally.top/xasj

  • https://nighetwhisper.top/lekd

  • https://salaccgfa.top/gsooz

  • https://zestmodp.top/zeda

  • https://owlflright.digital/qopy

Attributes
  • build_id

    e7d67fcf1ee6f5efee381c97883ce1764722e6da7c8d68ddb5

Targets

    • Target
      150c73a7b6275381a1d06137a617cc94.exe
    • Size 36.2MB
    • SHA256 f708c405d13450a3886936d68e63ad841836d0a741fb6848fd7b58c83db988d2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionlummaspywarestealertrojan

    • Family: Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks