lumma | a9b403f76dce061708266011f3f159152a7f88ad934ec8326f9ec2f4caf7f4f2

General

Target

f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe
Size

258KB
MD5

a8ce4ce944ac6514356635fe946d8ff4
SHA1

10557d7c007468792264f89563b607c6afb125fb
SHA256

f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98
SHA512

d04bc629b56a55ed427bef4d4e71a27ec3dbc94b6822ffe0d03cf1d43c4aa0b843c43a68a5d3fc36bbbf570f72eb9b8204b1d2a3ee1568e6a41eb2827784839c
SSDEEP

3072:qtz5NzRbLdEgdwiYvODvcEtlMQYolj5/GBAffydfPEz9rsu0jaUAZf7q/1iEcaVu:az7zRLdtVYvWzTXSKz9n0+U4zqQna

Score

10^/10

lumma smokeloader backdoor spyware stealer trojan

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Signatures

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4984-133-0x0000000002180000-0x0000000002189000-memory.dmp	family_smokeloader
behavioral2/memory/4984-136-0x0000000002180000-0x0000000002189000-memory.dmp	family_smokeloader

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

6EE2.exeBDDD.exe

pid process

3644 6EE2.exe
4348 BDDD.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4728 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4660 3644 WerFault.exe 6EE2.exe

pid	process
3644	6EE2.exe
4348	BDDD.exe

pid	process
4728	rundll32.exe

pid	pid_target	process	target process
4660	3644	WerFault.exe	6EE2.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe

pid	process
4984	f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe
4984	f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032
3032

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3032
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe

pid process

4984 f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe

pid	process
3032

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6EE2.exe

description	pid	process	target process
PID 3032 wrote to memory of 3644	3032		6EE2.exe
PID 3032 wrote to memory of 3644	3032		6EE2.exe
PID 3032 wrote to memory of 3644	3032		6EE2.exe
PID 3032 wrote to memory of 4348	3032		BDDD.exe
PID 3032 wrote to memory of 4348	3032		BDDD.exe
PID 3032 wrote to memory of 4348	3032		BDDD.exe
PID 3644 wrote to memory of 4728	3644	6EE2.exe	rundll32.exe
PID 3644 wrote to memory of 4728	3644	6EE2.exe	rundll32.exe
PID 3644 wrote to memory of 4728	3644	6EE2.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe
"C:\Users\Admin\AppData\Local\Temp\f43afb9e320b51fe3b43c2b35317b9ecb20b43b2786f39312a972d2452d20f98.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4984

C:\Users\Admin\AppData\Local\Temp\6EE2.exe
C:\Users\Admin\AppData\Local\Temp\6EE2.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa
2⤵
- Loads dropped DLL
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 532
2⤵
- Program crash
PID:4660

C:\Users\Admin\AppData\Local\Temp\BDDD.exe
C:\Users\Admin\AppData\Local\Temp\BDDD.exe
1⤵
- Executes dropped EXE
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3644 -ip 3644
1⤵
PID:888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6EE2.exe
Filesize
1.1MB

MD5
17f4caa00baa4a343b7037f575363737

SHA1
af29ee05e88a3967d639b4c0e5e1ddabf32d555a

SHA256
6bdc0c711117eb2484229026a82977f4a3d48e7a5ec167f3486aea5f50512462

SHA512
11b0f2d11bc1f65071f0f5e2a61c01cbea448d7077764ea10ce320be98652428f1418bc3a427897dfb80e82596077cee7fa561d59a4736a1d15b0978ef9087ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\6EE2.exe
Filesize
1.1MB

MD5
17f4caa00baa4a343b7037f575363737

SHA1
af29ee05e88a3967d639b4c0e5e1ddabf32d555a

SHA256
6bdc0c711117eb2484229026a82977f4a3d48e7a5ec167f3486aea5f50512462

SHA512
11b0f2d11bc1f65071f0f5e2a61c01cbea448d7077764ea10ce320be98652428f1418bc3a427897dfb80e82596077cee7fa561d59a4736a1d15b0978ef9087ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\BDDD.exe
Filesize
276KB

MD5
ec5a9982316bd834d0b86f26e1c7b8f0

SHA1
3e21f03d7f7b156c637bfa215074938cc5721390

SHA256
74bb3105998c9b5ebced3ff42889fce1c437d37f76da8ba1980762e6d88f0186

SHA512
dd19a7e65888aa58af67300ca52d86d8adfb0876733f222f3b98d20d282225896f0499ea14e2966e08ac9d0963619627dcd3e0872d954c8bb70c3ad3420664ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\BDDD.exe
Filesize
276KB

MD5
ec5a9982316bd834d0b86f26e1c7b8f0

SHA1
3e21f03d7f7b156c637bfa215074938cc5721390

SHA256
74bb3105998c9b5ebced3ff42889fce1c437d37f76da8ba1980762e6d88f0186

SHA512
dd19a7e65888aa58af67300ca52d86d8adfb0876733f222f3b98d20d282225896f0499ea14e2966e08ac9d0963619627dcd3e0872d954c8bb70c3ad3420664ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
memory/3644-142-0x0000000002310000-0x000000000243E000-memory.dmp

Filesize
1.2MB

Download
memory/3644-141-0x00000000021AB000-0x0000000002294000-memory.dmp

Filesize
932KB

Download
memory/3644-138-0x0000000000000000-mapping.dmp

Download
memory/3644-143-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/3644-144-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/4348-148-0x000000000070E000-0x0000000000728000-memory.dmp

Filesize
104KB

Download
memory/4348-152-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4348-145-0x0000000000000000-mapping.dmp

Download
memory/4348-150-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4348-149-0x00000000006A0000-0x00000000006CA000-memory.dmp

Filesize
168KB

Download
memory/4728-151-0x0000000000000000-mapping.dmp

Download
memory/4984-135-0x00000000006BE000-0x00000000006D4000-memory.dmp

Filesize
88KB

Download
memory/4984-136-0x0000000002180000-0x0000000002189000-memory.dmp

Filesize
36KB

Download
memory/4984-132-0x00000000006BE000-0x00000000006D4000-memory.dmp

Filesize
88KB

Download
memory/4984-137-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4984-134-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4984-133-0x0000000002180000-0x0000000002189000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads