lumma | 49ac8e4a898376ce13712dcad6434497543edf035e8e371424b1d0a009a9a3f7

General

Target

e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe
Size

257KB
MD5

6d39a370d5b7ed1cd987b61adc89f25d
SHA1

0484fb54f0eb45a4c2fc4e3fa9e647353024f482
SHA256

e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d
SHA512

f6fc10e8b6c848afb2bf5ac38ebfb95416f75316ce12a12977aca108cb8101c3f6bfaa5f3ff90a86e9fa62c84c3d3ee729aeff66a4847863e05b55fb4b92c788
SSDEEP

6144:ILfHALaKffiAxSYBuAwoQ2sY6nlc/SU4zqQna:ILfgWKf6A4YBftQtY6lGSFP

Score

10^/10

lumma smokeloader backdoor spyware stealer trojan

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Signatures

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2128-136-0x0000000002180000-0x0000000002189000-memory.dmp	family_smokeloader
behavioral2/memory/2128-139-0x0000000002180000-0x0000000002189000-memory.dmp	family_smokeloader

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

66 4116 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

75FB.exeA3B3.execdgutij

pid process

936 75FB.exe
4728 A3B3.exe
5004 cdgutij
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4116 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4160 936 WerFault.exe 75FB.exe
3444 4728 WerFault.exe A3B3.exe

flow	pid	process
66	4116	rundll32.exe

pid	process
936	75FB.exe
4728	A3B3.exe
5004	cdgutij

pid	process
4116	rundll32.exe

pid	pid_target	process	target process
4160	936	WerFault.exe	75FB.exe
3444	4728	WerFault.exe	A3B3.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe

pid	process
2128	e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe
2128	e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068
3068

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3068
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe

pid process

2128 e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe

pid	process
3068

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068
Token: SeShutdownPrivilege	3068
Token: SeCreatePagefilePrivilege	3068

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

75FB.exe

description	pid	process	target process
PID 3068 wrote to memory of 936	3068		75FB.exe
PID 3068 wrote to memory of 936	3068		75FB.exe
PID 3068 wrote to memory of 936	3068		75FB.exe
PID 936 wrote to memory of 4116	936	75FB.exe	rundll32.exe
PID 936 wrote to memory of 4116	936	75FB.exe	rundll32.exe
PID 936 wrote to memory of 4116	936	75FB.exe	rundll32.exe
PID 3068 wrote to memory of 4728	3068		A3B3.exe
PID 3068 wrote to memory of 4728	3068		A3B3.exe
PID 3068 wrote to memory of 4728	3068		A3B3.exe

C:\Users\Admin\AppData\Local\Temp\e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe
"C:\Users\Admin\AppData\Local\Temp\e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2128

C:\Users\Admin\AppData\Local\Temp\75FB.exe
C:\Users\Admin\AppData\Local\Temp\75FB.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 524
2⤵
- Program crash
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 936 -ip 936
1⤵
PID:3508

C:\Users\Admin\AppData\Local\Temp\A3B3.exe
C:\Users\Admin\AppData\Local\Temp\A3B3.exe
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1348
2⤵
- Program crash
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4728 -ip 4728
1⤵
PID:2092

C:\Users\Admin\AppData\Roaming\cdgutij
C:\Users\Admin\AppData\Roaming\cdgutij
1⤵
- Executes dropped EXE
PID:5004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\75FB.exe
Filesize
1.1MB

MD5
17f4caa00baa4a343b7037f575363737

SHA1
af29ee05e88a3967d639b4c0e5e1ddabf32d555a

SHA256
6bdc0c711117eb2484229026a82977f4a3d48e7a5ec167f3486aea5f50512462

SHA512
11b0f2d11bc1f65071f0f5e2a61c01cbea448d7077764ea10ce320be98652428f1418bc3a427897dfb80e82596077cee7fa561d59a4736a1d15b0978ef9087ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\75FB.exe
Filesize
1.1MB

MD5
17f4caa00baa4a343b7037f575363737

SHA1
af29ee05e88a3967d639b4c0e5e1ddabf32d555a

SHA256
6bdc0c711117eb2484229026a82977f4a3d48e7a5ec167f3486aea5f50512462

SHA512
11b0f2d11bc1f65071f0f5e2a61c01cbea448d7077764ea10ce320be98652428f1418bc3a427897dfb80e82596077cee7fa561d59a4736a1d15b0978ef9087ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\A3B3.exe
Filesize
276KB

MD5
ec5a9982316bd834d0b86f26e1c7b8f0

SHA1
3e21f03d7f7b156c637bfa215074938cc5721390

SHA256
74bb3105998c9b5ebced3ff42889fce1c437d37f76da8ba1980762e6d88f0186

SHA512
dd19a7e65888aa58af67300ca52d86d8adfb0876733f222f3b98d20d282225896f0499ea14e2966e08ac9d0963619627dcd3e0872d954c8bb70c3ad3420664ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\A3B3.exe
Filesize
276KB

MD5
ec5a9982316bd834d0b86f26e1c7b8f0

SHA1
3e21f03d7f7b156c637bfa215074938cc5721390

SHA256
74bb3105998c9b5ebced3ff42889fce1c437d37f76da8ba1980762e6d88f0186

SHA512
dd19a7e65888aa58af67300ca52d86d8adfb0876733f222f3b98d20d282225896f0499ea14e2966e08ac9d0963619627dcd3e0872d954c8bb70c3ad3420664ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
C:\Users\Admin\AppData\Roaming\cdgutij
Filesize
257KB

MD5
6d39a370d5b7ed1cd987b61adc89f25d

SHA1
0484fb54f0eb45a4c2fc4e3fa9e647353024f482

SHA256
e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d

SHA512
f6fc10e8b6c848afb2bf5ac38ebfb95416f75316ce12a12977aca108cb8101c3f6bfaa5f3ff90a86e9fa62c84c3d3ee729aeff66a4847863e05b55fb4b92c788

Download Submit
C:\Users\Admin\AppData\Roaming\cdgutij
Filesize
257KB

MD5
6d39a370d5b7ed1cd987b61adc89f25d

SHA1
0484fb54f0eb45a4c2fc4e3fa9e647353024f482

SHA256
e23f4ad89ec5f09cfc475f14349bcc6aeaa73f3aaa231db43d4cb6650fb2462d

SHA512
f6fc10e8b6c848afb2bf5ac38ebfb95416f75316ce12a12977aca108cb8101c3f6bfaa5f3ff90a86e9fa62c84c3d3ee729aeff66a4847863e05b55fb4b92c788

Download Submit
memory/936-141-0x0000000000000000-mapping.dmp

Download
memory/936-145-0x000000000074E000-0x0000000000837000-memory.dmp

Filesize
932KB

Download
memory/936-146-0x0000000002340000-0x000000000246E000-memory.dmp

Filesize
1.2MB

Download
memory/936-149-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/2128-137-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2128-135-0x000000000057D000-0x0000000000593000-memory.dmp

Filesize
88KB

Download
memory/2128-140-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2128-139-0x0000000002180000-0x0000000002189000-memory.dmp

Filesize
36KB

Download
memory/2128-138-0x000000000057D000-0x0000000000593000-memory.dmp

Filesize
88KB

Download
memory/2128-136-0x0000000002180000-0x0000000002189000-memory.dmp

Filesize
36KB

Download
memory/4116-144-0x0000000000000000-mapping.dmp

Download
memory/4728-150-0x0000000000000000-mapping.dmp

Download
memory/4728-155-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4728-156-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4728-154-0x00000000004C0000-0x00000000004EA000-memory.dmp

Filesize
168KB

Download
memory/4728-153-0x00000000006ED000-0x0000000000707000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads