lumma | 3b0c7bc18b4a6c770fd6420a75424bd0b85d1bc29a0c636587fc45beda5699cf

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe
Size

2.0MB
MD5

901bb7cdf6777fa6661a8230aac4ce43
SHA1

cbe3cb1fe5e90feb741d25da587223478efd1ea6
SHA256

ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5
SHA512

5e619164d8839b2855ed1c2be8212a88f32988c57ef8545b920ed217df2377ae0306d890c6cbd3d637e8371793c21756cf276cd23e0bde38fd1b7fc83403a22b
SSDEEP

49152:arM7OejNT8b7+EQKbLH/KEUOuefPxM97O4xnQfZ:p7OemOfeK0NfZu7O4xnM

Score

10^/10

lumma smokeloader backdoor collection discovery persistence spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://185.215.113.68/fks/index.php

rc4.i32

Signatures

Detect Lumma Stealer payload V4 3 IoCs

resource	yara_rule
behavioral2/memory/5048-101-0x0000000000400000-0x0000000000892000-memory.dmp	family_lumma_v4
behavioral2/memory/5048-100-0x0000000000B20000-0x0000000000B9C000-memory.dmp	family_lumma_v4
behavioral2/memory/5048-102-0x0000000000400000-0x0000000000892000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	4ce071eu.exe

Executes dropped EXE 4 IoCs

pid	Process
4408	Zw3TB57.exe
1980	4ce071eu.exe
5048	6cM5hV5.exe
2336	7sB7cK20.exe

Loads dropped DLL 1 IoCs

pid	Process
1980	4ce071eu.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4ce071eu.exe
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4ce071eu.exe
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4ce071eu.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Zw3TB57.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	4ce071eu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ipinfo.io
27	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1980	4ce071eu.exe
1980	4ce071eu.exe
1980	4ce071eu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2780	1980	WerFault.exe	24
2944	5048	WerFault.exe	110

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7sB7cK20.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7sB7cK20.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7sB7cK20.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2460	schtasks.exe
4676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1980	4ce071eu.exe
1980	4ce071eu.exe
2336	7sB7cK20.exe
2336	7sB7cK20.exe
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found
3420	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2336	7sB7cK20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	4ce071eu.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1980	4ce071eu.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3420	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 4408	3636	ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe	26
PID 3636 wrote to memory of 4408	3636	ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe	26
PID 3636 wrote to memory of 4408	3636	ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe	26
PID 4408 wrote to memory of 1980	4408	Zw3TB57.exe	24
PID 4408 wrote to memory of 1980	4408	Zw3TB57.exe	24
PID 4408 wrote to memory of 1980	4408	Zw3TB57.exe	24
PID 1980 wrote to memory of 3556	1980	4ce071eu.exe	27
PID 1980 wrote to memory of 3556	1980	4ce071eu.exe	27
PID 1980 wrote to memory of 3556	1980	4ce071eu.exe	27
PID 3556 wrote to memory of 2460	3556	cmd.exe	30
PID 3556 wrote to memory of 2460	3556	cmd.exe	30
PID 3556 wrote to memory of 2460	3556	cmd.exe	30
PID 1980 wrote to memory of 2192	1980	4ce071eu.exe	32
PID 1980 wrote to memory of 2192	1980	4ce071eu.exe	32
PID 1980 wrote to memory of 2192	1980	4ce071eu.exe	32
PID 2192 wrote to memory of 4676	2192	cmd.exe	34
PID 2192 wrote to memory of 4676	2192	cmd.exe	34
PID 2192 wrote to memory of 4676	2192	cmd.exe	34
PID 4408 wrote to memory of 5048	4408	Zw3TB57.exe	110
PID 4408 wrote to memory of 5048	4408	Zw3TB57.exe	110
PID 4408 wrote to memory of 5048	4408	Zw3TB57.exe	110
PID 3636 wrote to memory of 2336	3636	ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe	113
PID 3636 wrote to memory of 2336	3636	ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe	113
PID 3636 wrote to memory of 2336	3636	ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4ce071eu.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4ce071eu.exe

C:\Users\Admin\AppData\Local\Temp\ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe
"C:\Users\Admin\AppData\Local\Temp\ce8bc001844f0165e361ff00e271a4576b71a9457760a89719e8dc063becd5c5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Zw3TB57.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Zw3TB57.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6cM5hV5.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6cM5hV5.exe
    3⤵
    - Executes dropped EXE
    PID:5048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1004
      4⤵
      Program crash
      PID:2944
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7sB7cK20.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7sB7cK20.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2336

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ce071eu.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ce071eu.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 3020
  2⤵
  - Program crash
  PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1980 -ip 1980
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5048 -ip 5048
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-94-0x0000000000200000-0x000000000065E000-memory.dmp

Filesize
4.4MB

Download
memory/1980-14-0x0000000000200000-0x000000000065E000-memory.dmp

Filesize
4.4MB

Download
memory/1980-16-0x0000000008CC0000-0x0000000008D36000-memory.dmp

Filesize
472KB

Download
memory/1980-29-0x000000000A7B0000-0x000000000A7CE000-memory.dmp

Filesize
120KB

Download
memory/1980-30-0x0000000000200000-0x000000000065E000-memory.dmp

Filesize
4.4MB

Download
memory/1980-31-0x000000000AFA0000-0x000000000B2F4000-memory.dmp

Filesize
3.3MB

Download
memory/1980-15-0x0000000000200000-0x000000000065E000-memory.dmp

Filesize
4.4MB

Download
memory/1980-86-0x000000000A890000-0x000000000A8F6000-memory.dmp

Filesize
408KB

Download
memory/2336-105-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2336-108-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3420-107-0x0000000001F90000-0x0000000001FA6000-memory.dmp

Filesize
88KB

Download
memory/5048-99-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/5048-100-0x0000000000B20000-0x0000000000B9C000-memory.dmp

Filesize
496KB

Download
memory/5048-101-0x0000000000400000-0x0000000000892000-memory.dmp

Filesize
4.6MB

Download
memory/5048-102-0x0000000000400000-0x0000000000892000-memory.dmp

Filesize
4.6MB

Download