lumma | c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4

General

Target

c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe
Size

259KB
MD5

e7edd336bf750b6cd3b1a8625e8d4605
SHA1

ddcdb6fb6a23746e82c3fe86f11dec68b81b39a1
SHA256

c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4
SHA512

145428695c3fbd72e101bc117222ba7e30a0a7adb1cd00227cc4cf638b7d803d4c916615919d7b0af1473160336f218ecec1a22196e8596ad657488cbbfb08ba
SSDEEP

6144:HITjqLGuP75b7WO+BMH1uzjc0JErdm03oFbU4zqQna:HIT2Kuz5eBBuuKdr3oFP

Score

10^/10

lumma smokeloader backdoor spyware stealer trojan

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Signatures

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3292-134-0x00000000006E0000-0x00000000006E9000-memory.dmp	family_smokeloader

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

54 3208 rundll32.exe
55 3208 rundll32.exe
62 3208 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

9C89.exeE73F.exe

pid process

3812 9C89.exe
3928 E73F.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3208 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3488 3812 WerFault.exe 9C89.exe

flow	pid	process
54	3208	rundll32.exe
55	3208	rundll32.exe
62	3208	rundll32.exe

pid	process
3812	9C89.exe
3928	E73F.exe

pid	process
3208	rundll32.exe

pid	pid_target	process	target process
3488	3812	WerFault.exe	9C89.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe

pid	process
3292	c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe
3292	c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1204
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe

pid process

3292 c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 1204
Token: SeCreatePagefilePrivilege 1204

pid	process
1204

description	pid	process
Token: SeShutdownPrivilege	1204
Token: SeCreatePagefilePrivilege	1204

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9C89.exe

description	pid	process	target process
PID 1204 wrote to memory of 3812	1204		9C89.exe
PID 1204 wrote to memory of 3812	1204		9C89.exe
PID 1204 wrote to memory of 3812	1204		9C89.exe
PID 3812 wrote to memory of 3208	3812	9C89.exe	rundll32.exe
PID 3812 wrote to memory of 3208	3812	9C89.exe	rundll32.exe
PID 3812 wrote to memory of 3208	3812	9C89.exe	rundll32.exe
PID 1204 wrote to memory of 3928	1204		E73F.exe
PID 1204 wrote to memory of 3928	1204		E73F.exe
PID 1204 wrote to memory of 3928	1204		E73F.exe

C:\Users\Admin\AppData\Local\Temp\c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe
"C:\Users\Admin\AppData\Local\Temp\c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3292

C:\Users\Admin\AppData\Local\Temp\9C89.exe
C:\Users\Admin\AppData\Local\Temp\9C89.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 540
2⤵
- Program crash
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3812 -ip 3812
1⤵
PID:1100

C:\Users\Admin\AppData\Local\Temp\E73F.exe
C:\Users\Admin\AppData\Local\Temp\E73F.exe
1⤵
- Executes dropped EXE
PID:3928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9C89.exe
Filesize
1.1MB

MD5
17f4caa00baa4a343b7037f575363737

SHA1
af29ee05e88a3967d639b4c0e5e1ddabf32d555a

SHA256
6bdc0c711117eb2484229026a82977f4a3d48e7a5ec167f3486aea5f50512462

SHA512
11b0f2d11bc1f65071f0f5e2a61c01cbea448d7077764ea10ce320be98652428f1418bc3a427897dfb80e82596077cee7fa561d59a4736a1d15b0978ef9087ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C89.exe
Filesize
1.1MB

MD5
17f4caa00baa4a343b7037f575363737

SHA1
af29ee05e88a3967d639b4c0e5e1ddabf32d555a

SHA256
6bdc0c711117eb2484229026a82977f4a3d48e7a5ec167f3486aea5f50512462

SHA512
11b0f2d11bc1f65071f0f5e2a61c01cbea448d7077764ea10ce320be98652428f1418bc3a427897dfb80e82596077cee7fa561d59a4736a1d15b0978ef9087ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\E73F.exe
Filesize
276KB

MD5
ec5a9982316bd834d0b86f26e1c7b8f0

SHA1
3e21f03d7f7b156c637bfa215074938cc5721390

SHA256
74bb3105998c9b5ebced3ff42889fce1c437d37f76da8ba1980762e6d88f0186

SHA512
dd19a7e65888aa58af67300ca52d86d8adfb0876733f222f3b98d20d282225896f0499ea14e2966e08ac9d0963619627dcd3e0872d954c8bb70c3ad3420664ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\E73F.exe
Filesize
276KB

MD5
ec5a9982316bd834d0b86f26e1c7b8f0

SHA1
3e21f03d7f7b156c637bfa215074938cc5721390

SHA256
74bb3105998c9b5ebced3ff42889fce1c437d37f76da8ba1980762e6d88f0186

SHA512
dd19a7e65888aa58af67300ca52d86d8adfb0876733f222f3b98d20d282225896f0499ea14e2966e08ac9d0963619627dcd3e0872d954c8bb70c3ad3420664ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp
Filesize
774KB

MD5
e06fb66bfbe1444cc091f0297b8d32db

SHA1
c3e13e3edcbbf30cdc51ce96cc7a802fc88e83af

SHA256
b282eb3f05d375d3487d20596d783fa52aa27013e8b2b407db32d9a3a751319d

SHA512
c639b62f417d46148c3a84ae5ff2cc7018c653424cc1d643a983c41d4a12f6015df0f4359c5e078c2c3e5b1d42de18acfb6aab432266a8c4e37aa5449e961d95

Download Submit
memory/3208-143-0x0000000000000000-mapping.dmp

Download
memory/3292-136-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3292-135-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3292-133-0x000000000076E000-0x0000000000784000-memory.dmp

Filesize
88KB

Download
memory/3292-134-0x00000000006E0000-0x00000000006E9000-memory.dmp

Filesize
36KB

Download
memory/3812-141-0x0000000002320000-0x000000000244E000-memory.dmp

Filesize
1.2MB

Download
memory/3812-142-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/3812-137-0x0000000000000000-mapping.dmp

Download
memory/3812-140-0x0000000002025000-0x000000000210E000-memory.dmp

Filesize
932KB

Download
memory/3812-149-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/3928-146-0x0000000000000000-mapping.dmp

Download
memory/3928-150-0x000000000056D000-0x0000000000587000-memory.dmp

Filesize
104KB

Download
memory/3928-151-0x0000000000520000-0x000000000054A000-memory.dmp

Filesize
168KB

Download
memory/3928-152-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3928-153-0x000000000056D000-0x0000000000587000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads