lumma | 1ce27fdc5a5869835ceaef65c07fc5cf0165d373aa9cae89a5f713d7d704fc29

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2023 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

207KB
MD5

e61bd1023de1c935149a998c33ae9f37
SHA1

f06f36974c483508c0616b5de63aa70472358b14
SHA256

1ce27fdc5a5869835ceaef65c07fc5cf0165d373aa9cae89a5f713d7d704fc29
SHA512

81999880f516b3b6b2ff584e4e8ae4b70e33fe2fcfb0ac15b8f3397e88666e1985d0b62a5660a32c5f6718ef374fa338a92be961dbf586c2a10d3fc9f3d8f475
SSDEEP

3072:ZXNhbS3y+k+BFCJ5vGgdBmRVDb5Lk3O5+n/06Pwx7apb:9fgy+k+uzPMRVDb58u6Pzp

Score

10^/10

lumma smokeloader backdoor spyware stealer trojan

Malware Config

Extracted

Family

lumma

77.73.134.68

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4640-133-0x0000000002CF0000-0x0000000002CF9000-memory.dmp	family_smokeloader

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

8491.exe

pid process

2636 8491.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1880 2636 WerFault.exe 8491.exe

pid	process
2636	8491.exe

pid	pid_target	process	target process
1880	2636	WerFault.exe	8491.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
4640	file.exe
4640	file.exe
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644
2644

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2644
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

file.exe

pid process

4640 file.exe

pid	process
2644

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	2644
Token: SeCreatePagefilePrivilege	2644
Token: SeShutdownPrivilege	2644
Token: SeCreatePagefilePrivilege	2644
Token: SeShutdownPrivilege	2644
Token: SeCreatePagefilePrivilege	2644
Token: SeShutdownPrivilege	2644
Token: SeCreatePagefilePrivilege	2644
Token: SeShutdownPrivilege	2644
Token: SeCreatePagefilePrivilege	2644
Token: SeShutdownPrivilege	2644
Token: SeCreatePagefilePrivilege	2644
Token: SeShutdownPrivilege	2644
Token: SeCreatePagefilePrivilege	2644

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

description	pid	target process
PID 2644 wrote to memory of 2636	2644	8491.exe
PID 2644 wrote to memory of 2636	2644	8491.exe
PID 2644 wrote to memory of 2636	2644	8491.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4640

C:\Users\Admin\AppData\Local\Temp\8491.exe
C:\Users\Admin\AppData\Local\Temp\8491.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 1336
2⤵
- Program crash
PID:1880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2636 -ip 2636
1⤵
PID:3444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8491.exe
Filesize
245KB

MD5
f39ffa9812c55774a4dd1451b23fa2d4

SHA1
f9f60ac20bfe819d2a012d0fb19e88ea4e4a348d

SHA256
758601b7d2c4c1c3ba050f4c9b0fd65f31f8d411965e2529ee22af93623f4148

SHA512
d35209af1f3ed8f0249bc14f70b9c6e95e88abc5c7d10d9e906761a09b98731c1279f87bae9699158e65e07e55e7f6a9d71be0dc9c4a6f07c529d2a668266b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\8491.exe
Filesize
245KB

MD5
f39ffa9812c55774a4dd1451b23fa2d4

SHA1
f9f60ac20bfe819d2a012d0fb19e88ea4e4a348d

SHA256
758601b7d2c4c1c3ba050f4c9b0fd65f31f8d411965e2529ee22af93623f4148

SHA512
d35209af1f3ed8f0249bc14f70b9c6e95e88abc5c7d10d9e906761a09b98731c1279f87bae9699158e65e07e55e7f6a9d71be0dc9c4a6f07c529d2a668266b13

Download Submit
memory/2636-161-0x0000000000000000-mapping.dmp

Download
memory/2636-167-0x0000000000400000-0x0000000002BA5000-memory.dmp

Filesize
39.6MB

Download
memory/2636-166-0x0000000000400000-0x0000000002BA5000-memory.dmp

Filesize
39.6MB

Download
memory/2636-165-0x0000000002C00000-0x0000000002C2A000-memory.dmp

Filesize
168KB

Download
memory/2636-164-0x0000000002CD9000-0x0000000002CF3000-memory.dmp

Filesize
104KB

Download
memory/2644-175-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-149-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-146-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2644-147-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-148-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-179-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-150-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-151-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-152-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-153-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-180-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-155-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-156-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-157-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2644-158-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2644-159-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2644-160-0x00000000030F0000-0x0000000003100000-memory.dmp

Filesize
64KB

Download
memory/2644-144-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-145-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-141-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-142-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-140-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-139-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-138-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-168-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-169-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-170-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-171-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-172-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-178-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-174-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-137-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-176-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-177-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-173-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-143-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-154-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-181-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-182-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-183-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-184-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-185-0x00000000012F0000-0x0000000001300000-memory.dmp

Filesize
64KB

Download
memory/2644-186-0x0000000001300000-0x0000000001310000-memory.dmp

Filesize
64KB

Download
memory/2644-187-0x0000000001300000-0x0000000001310000-memory.dmp

Filesize
64KB

Download
memory/2644-188-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-189-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-190-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-191-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-192-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-193-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-194-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-195-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-196-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-197-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-198-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-199-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-200-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-201-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-202-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-203-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-204-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/2644-205-0x00000000012F0000-0x0000000001300000-memory.dmp

Filesize
64KB

Download
memory/2644-206-0x0000000001300000-0x0000000001310000-memory.dmp

Filesize
64KB

Download
memory/2644-207-0x0000000001300000-0x0000000001310000-memory.dmp

Filesize
64KB

Download
memory/2644-208-0x0000000001300000-0x0000000001310000-memory.dmp

Filesize
64KB

Download
memory/4640-133-0x0000000002CF0000-0x0000000002CF9000-memory.dmp

Filesize
36KB

Download
memory/4640-132-0x0000000002DB9000-0x0000000002DC9000-memory.dmp

Filesize
64KB

Download
memory/4640-134-0x0000000000400000-0x0000000002B9C000-memory.dmp

Filesize
39.6MB

Download
memory/4640-135-0x0000000002DB9000-0x0000000002DC9000-memory.dmp

Filesize
64KB

Download
memory/4640-136-0x0000000000400000-0x0000000002B9C000-memory.dmp

Filesize
39.6MB

Download