lumma | c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4

General

Target

file.exe
Size

259KB
MD5

e7edd336bf750b6cd3b1a8625e8d4605
SHA1

ddcdb6fb6a23746e82c3fe86f11dec68b81b39a1
SHA256

c2a75573a025cf346b85db9db3e95b2e02d337d4058c2363d3a1e2267e78aed4
SHA512

145428695c3fbd72e101bc117222ba7e30a0a7adb1cd00227cc4cf638b7d803d4c916615919d7b0af1473160336f218ecec1a22196e8596ad657488cbbfb08ba
SSDEEP

6144:HITjqLGuP75b7WO+BMH1uzjc0JErdm03oFbU4zqQna:HIT2Kuz5eBBuuKdr3oFP

Score

10^/10

lumma smokeloader backdoor stealer trojan

Malware Config

Extracted

Family

lumma

C2

77.73.134.68

Signatures

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4836-133-0x0000000002180000-0x0000000002189000-memory.dmp	family_smokeloader
behavioral2/memory/4836-136-0x0000000002180000-0x0000000002189000-memory.dmp	family_smokeloader

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

F121.exe1B7E.exe

pid process

2008 F121.exe
4556 1B7E.exe

pid	process
2008	F121.exe
4556	1B7E.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

file.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

file.exe

pid	process
4836	file.exe
4836	file.exe
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2716
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

file.exe

pid process

4836 file.exe

pid	process
2716

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

F121.exe

description	pid	process	target process
PID 2716 wrote to memory of 2008	2716		F121.exe
PID 2716 wrote to memory of 2008	2716		F121.exe
PID 2716 wrote to memory of 2008	2716		F121.exe
PID 2008 wrote to memory of 1136	2008	F121.exe	rundll32.exe
PID 2008 wrote to memory of 1136	2008	F121.exe	rundll32.exe
PID 2008 wrote to memory of 1136	2008	F121.exe	rundll32.exe
PID 2716 wrote to memory of 4556	2716		1B7E.exe
PID 2716 wrote to memory of 4556	2716		1B7E.exe
PID 2716 wrote to memory of 4556	2716		1B7E.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4836

C:\Users\Admin\AppData\Local\Temp\F121.exe
C:\Users\Admin\AppData\Local\Temp\F121.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Sdaaysrpyefiy.tmp",Qowsuiaedfeupa
2⤵
PID:1136

C:\Users\Admin\AppData\Local\Temp\1B7E.exe
C:\Users\Admin\AppData\Local\Temp\1B7E.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2008 -ip 2008
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1B7E.exe
Filesize
276KB

MD5
ec5a9982316bd834d0b86f26e1c7b8f0

SHA1
3e21f03d7f7b156c637bfa215074938cc5721390

SHA256
74bb3105998c9b5ebced3ff42889fce1c437d37f76da8ba1980762e6d88f0186

SHA512
dd19a7e65888aa58af67300ca52d86d8adfb0876733f222f3b98d20d282225896f0499ea14e2966e08ac9d0963619627dcd3e0872d954c8bb70c3ad3420664ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\1B7E.exe
Filesize
276KB

MD5
ec5a9982316bd834d0b86f26e1c7b8f0

SHA1
3e21f03d7f7b156c637bfa215074938cc5721390

SHA256
74bb3105998c9b5ebced3ff42889fce1c437d37f76da8ba1980762e6d88f0186

SHA512
dd19a7e65888aa58af67300ca52d86d8adfb0876733f222f3b98d20d282225896f0499ea14e2966e08ac9d0963619627dcd3e0872d954c8bb70c3ad3420664ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\F121.exe
Filesize
1.1MB

MD5
17f4caa00baa4a343b7037f575363737

SHA1
af29ee05e88a3967d639b4c0e5e1ddabf32d555a

SHA256
6bdc0c711117eb2484229026a82977f4a3d48e7a5ec167f3486aea5f50512462

SHA512
11b0f2d11bc1f65071f0f5e2a61c01cbea448d7077764ea10ce320be98652428f1418bc3a427897dfb80e82596077cee7fa561d59a4736a1d15b0978ef9087ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\F121.exe
Filesize
1.1MB

MD5
17f4caa00baa4a343b7037f575363737

SHA1
af29ee05e88a3967d639b4c0e5e1ddabf32d555a

SHA256
6bdc0c711117eb2484229026a82977f4a3d48e7a5ec167f3486aea5f50512462

SHA512
11b0f2d11bc1f65071f0f5e2a61c01cbea448d7077764ea10ce320be98652428f1418bc3a427897dfb80e82596077cee7fa561d59a4736a1d15b0978ef9087ed

Download Submit
memory/1136-144-0x0000000000000000-mapping.dmp

Download
memory/2008-138-0x0000000000000000-mapping.dmp

Download
memory/2008-141-0x0000000002159000-0x0000000002242000-memory.dmp

Filesize
932KB

Download
memory/2008-142-0x00000000022A0000-0x00000000023CE000-memory.dmp

Filesize
1.2MB

Download
memory/2008-143-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download
memory/4556-145-0x0000000000000000-mapping.dmp

Download
memory/4556-150-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4556-149-0x0000000002050000-0x000000000207A000-memory.dmp

Filesize
168KB

Download
memory/4556-148-0x00000000004ED000-0x0000000000507000-memory.dmp

Filesize
104KB

Download
memory/4836-135-0x000000000059D000-0x00000000005B3000-memory.dmp

Filesize
88KB

Download
memory/4836-134-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4836-133-0x0000000002180000-0x0000000002189000-memory.dmp

Filesize
36KB

Download
memory/4836-132-0x000000000059D000-0x00000000005B3000-memory.dmp

Filesize
88KB

Download
memory/4836-137-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4836-136-0x0000000002180000-0x0000000002189000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads