lumma | af5b6c05d1f194eb059920b06e8f8a4182383c3da2e1ef1a0c56a46f028425aa

Analysis

max time kernel
340s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2024, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VALLACUC.zip
Size 3.2MB
Sample240226-w33m7acf99
SHA256 af5b6c05d1f194eb059920b06e8f8a4182383c3da2e1ef1a0c56a46f028425aa
MD5 348cc3f23e8ca100515dc926beff4ead
SHA1 8e918e3a02196535dcdb0df1b6b2bb352c9100bc
SHA512 ea3952c6405942ce755749c71d7d8aee786061535ce3ec3a0447d146dab6d61f82e2126e71e7155cecf45d088c5e85a7e19f2cd32789f18840d5b2099313c1a7
SSDEEP 98304:k8b43Dhxc7Zky67b44euxN6O2U3yQ9qPSlJN:k8czhxc7Zk7v9xNbUqn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma persistence stealer

Malware Config

Extracted

Family

lumma

https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AuybgNzQVLXg\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\AuybgNzQVLXg"	VALORANT.exe

Executes dropped EXE 2 IoCs

pid	Process
3452	bypasser.exe
2072	VALORANT.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe
2072	VALORANT.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2072	VALORANT.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	912	7zG.exe
Token: 35	912	7zG.exe
Token: SeSecurityPrivilege	912	7zG.exe
Token: SeSecurityPrivilege	912	7zG.exe
Token: SeLoadDriverPrivilege	2072	VALORANT.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
912	7zG.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	VALORANT.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4308	2072	VALORANT.exe	105
PID 2072 wrote to memory of 4308	2072	VALORANT.exe	105
PID 2072 wrote to memory of 4388	2072	VALORANT.exe	106
PID 2072 wrote to memory of 4388	2072	VALORANT.exe	106
PID 2072 wrote to memory of 1372	2072	VALORANT.exe	107
PID 2072 wrote to memory of 1372	2072	VALORANT.exe	107
PID 2072 wrote to memory of 4348	2072	VALORANT.exe	108
PID 2072 wrote to memory of 4348	2072	VALORANT.exe	108
PID 2072 wrote to memory of 4128	2072	VALORANT.exe	109
PID 2072 wrote to memory of 4128	2072	VALORANT.exe	109
PID 2072 wrote to memory of 4252	2072	VALORANT.exe	110
PID 2072 wrote to memory of 4252	2072	VALORANT.exe	110
PID 2072 wrote to memory of 3204	2072	VALORANT.exe	111
PID 2072 wrote to memory of 3204	2072	VALORANT.exe	111
PID 2072 wrote to memory of 2580	2072	VALORANT.exe	112
PID 2072 wrote to memory of 2580	2072	VALORANT.exe	112
PID 2072 wrote to memory of 4280	2072	VALORANT.exe	113
PID 2072 wrote to memory of 4280	2072	VALORANT.exe	113
PID 2072 wrote to memory of 1176	2072	VALORANT.exe	114
PID 2072 wrote to memory of 1176	2072	VALORANT.exe	114
PID 2072 wrote to memory of 3572	2072	VALORANT.exe	115
PID 2072 wrote to memory of 3572	2072	VALORANT.exe	115
PID 2072 wrote to memory of 4004	2072	VALORANT.exe	116
PID 2072 wrote to memory of 4004	2072	VALORANT.exe	116
PID 2072 wrote to memory of 4036	2072	VALORANT.exe	117
PID 2072 wrote to memory of 4036	2072	VALORANT.exe	117
PID 2072 wrote to memory of 324	2072	VALORANT.exe	118
PID 2072 wrote to memory of 324	2072	VALORANT.exe	118
PID 2072 wrote to memory of 1616	2072	VALORANT.exe	119
PID 2072 wrote to memory of 1616	2072	VALORANT.exe	119
PID 2072 wrote to memory of 1392	2072	VALORANT.exe	120
PID 2072 wrote to memory of 1392	2072	VALORANT.exe	120
PID 2072 wrote to memory of 732	2072	VALORANT.exe	121
PID 2072 wrote to memory of 732	2072	VALORANT.exe	121
PID 2072 wrote to memory of 3480	2072	VALORANT.exe	122
PID 2072 wrote to memory of 3480	2072	VALORANT.exe	122
PID 2072 wrote to memory of 1508	2072	VALORANT.exe	123
PID 2072 wrote to memory of 1508	2072	VALORANT.exe	123
PID 2072 wrote to memory of 2376	2072	VALORANT.exe	124
PID 2072 wrote to memory of 2376	2072	VALORANT.exe	124
PID 2072 wrote to memory of 924	2072	VALORANT.exe	125
PID 2072 wrote to memory of 924	2072	VALORANT.exe	125
PID 2072 wrote to memory of 4048	2072	VALORANT.exe	126
PID 2072 wrote to memory of 4048	2072	VALORANT.exe	126
PID 2072 wrote to memory of 4028	2072	VALORANT.exe	127
PID 2072 wrote to memory of 4028	2072	VALORANT.exe	127
PID 2072 wrote to memory of 4620	2072	VALORANT.exe	128
PID 2072 wrote to memory of 4620	2072	VALORANT.exe	128
PID 2072 wrote to memory of 3768	2072	VALORANT.exe	129
PID 2072 wrote to memory of 3768	2072	VALORANT.exe	129
PID 2072 wrote to memory of 4960	2072	VALORANT.exe	130
PID 2072 wrote to memory of 4960	2072	VALORANT.exe	130
PID 2072 wrote to memory of 400	2072	VALORANT.exe	131
PID 2072 wrote to memory of 400	2072	VALORANT.exe	131
PID 2072 wrote to memory of 1972	2072	VALORANT.exe	132
PID 2072 wrote to memory of 1972	2072	VALORANT.exe	132
PID 2072 wrote to memory of 2064	2072	VALORANT.exe	133
PID 2072 wrote to memory of 2064	2072	VALORANT.exe	133
PID 2072 wrote to memory of 2832	2072	VALORANT.exe	134
PID 2072 wrote to memory of 2832	2072	VALORANT.exe	134
PID 2072 wrote to memory of 540	2072	VALORANT.exe	135
PID 2072 wrote to memory of 540	2072	VALORANT.exe	135
PID 2072 wrote to memory of 1080	2072	VALORANT.exe	136
PID 2072 wrote to memory of 1080	2072	VALORANT.exe	136

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\VALLACUC.zip
1⤵
PID:3092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:556

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\VALLACUC\" -spe -an -ai#7zMap4581:74:7zEvent2487
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:912

C:\Users\Admin\Desktop\VALLACUC\bypasser.exe
"C:\Users\Admin\Desktop\VALLACUC\bypasser.exe"
1⤵
- Executes dropped EXE
PID:3452

C:\Users\Admin\Desktop\VALLACUC\VALORANT.exe
"C:\Users\Admin\Desktop\VALLACUC\VALORANT.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 4
  2⤵
  PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:1176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:3572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:1392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:1508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:3768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:1212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:3944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:2916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color 2
  2⤵
  PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VALORANT.exe

Path C:\Users\Admin\Desktop\VALLACUC\VALORANT.exe
Size 756KB
SHA256 8f0c665c9553661e80666a526e9c939ca9da69bd0bd75b935d5952f80d4687ab
MD5 679dff0691158b5367ef511a57e7a1fc
SHA1 5c1ced94ddfe084c88d66aabfa0ec899073e1e83
SHA512 dac99b8bdea174b77a86cf55d5d23dfe13c774eecdea15156a09d7657183524f7625ecf4ef7b565e182f4cb23697e5e10812f93bf291356ea43ca8b8be977c88
SSDEEP 12288:t5MOHLT+F0sIE9JUzsC6mVFyCsffzMc6pncsP9Qtce0TBs/lPsoCy9N5R7K5dO7v:t5MOrT+F0sIE9JqsC6mVFyCsffzMc6pp
MD5 SHA1 SHA512 SSDEEP

Submit Download

bypasser.exe

Path C:\Users\Admin\Desktop\VALLACUC\bypasser.exe
Size 482KB
SHA256 ecd94d7862164f3dcc80267eac225e7d59d3e19c8d9819b7fe2027bd7cfea75a
MD5 e1f4c125e7ec9e784198518ade924a40
SHA1 717430c9b87a1a51e784e4ce319661cd62faba1e
SHA512 b8133c3d95be21fdf1f17446edea87ec1e36dea91690801847527a0989312606c7ea878183ea1896d7983ff08a7469d2c77be87140e93dcc60edeab08f568875
SSDEEP 12288:LxM0y+A7alDpZuRO+tYCStlSs3hLJeBKq:O0y+AWZu6CStlSChLJeBn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3452-12-0x0000000000850000-0x0000000000899000-memory.dmp

Download

memory/3452-17-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/3452-18-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/3452-19-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/3452-20-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/3452-21-0x0000000000850000-0x0000000000899000-memory.dmp

Download