lumma | 737b556d3b68ea3bc0ee44dee71e26657802de630e039193e178a4d975c44187

Resubmissions

10/03/2024, 09:40

240310-lnnklshh9t 5

10/03/2024, 09:34

240310-lj5y4ahh2x 10

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

App.Setap/Setup.exe
Size

53KB
MD5

e5ea5d841cb79942698c4e952a199a29
SHA1

ebe0e313c26f87af8ddf4a5f0fad1a68fc5f59d5
SHA256

8e478da3eff27b1be19a893314927385156a62582d8ceffb5be2c8852aff19d7
SHA512

f3aad0d51939184282327a0ed5544f4a9dc71e6b46409909a11dd440680301b5d5c160d58c9586f68800ac544b6573c8215a0a32c270acf0bc611ebbb219e0c0
SSDEEP

768:LNF2WLAuDeGJiqrmehiVSrmaBP39V5+5CYiUFr3HPxWE2plx:LNS7qjh3rmKPND+5C7UdPxg

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://diamondarrivallyowju.shop/api

https://associationokeo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4480 set thread context of 2384	4480	Setup.exe	90

Loads dropped DLL 1 IoCs

pid	Process
3320	WinAPIHObj.au3

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4480	Setup.exe
4480	Setup.exe
2384	more.com
2384	more.com
2384	more.com
2384	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4480	Setup.exe
2384	more.com

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 2384	4480	Setup.exe	90
PID 4480 wrote to memory of 2384	4480	Setup.exe	90
PID 4480 wrote to memory of 2384	4480	Setup.exe	90
PID 4480 wrote to memory of 2384	4480	Setup.exe	90
PID 2384 wrote to memory of 3320	2384	more.com	101
PID 2384 wrote to memory of 3320	2384	more.com	101
PID 2384 wrote to memory of 3320	2384	more.com	101
PID 2384 wrote to memory of 3320	2384	more.com	101
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121
PID 3996 wrote to memory of 4052	3996	firefox.exe	121

C:\Users\Admin\AppData\Local\Temp\App.Setap\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\App.Setap\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\WinAPIHObj.au3
    C:\Users\Admin\AppData\Local\Temp\WinAPIHObj.au3
    3⤵
    - Loads dropped DLL
    PID:3320

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3356

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:4052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.0.1346307791\2090280194" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4cedd67-7ff7-4efa-9f68-b6e992b3db2b} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 1964 283539f6458 gpu
    3⤵
    PID:1556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4052.1.505400395\1580684856" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e99f4d3c-9d7a-42aa-93d1-19e3bd4aa1cf} 4052 "\\.\pipe\gecko-crash-server-pipe.4052" 2364 2834716f858 socket
    3⤵
    PID:728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\95a7380e

Filesize
1.8MB

MD5
6d81947492493fa06cf2c044e24e215e

SHA1
728dfd4b6edfaa94165936a6efda0d683d27a49b

SHA256
41dd0a5a768dc753fa8e3af368496bf6bb048813fae0d8836e5621b4c4a7a2ff

SHA512
0582fc9156b3099cd8ddfc8a877eb3433cab824e9fc3522c8bf62ec641101cccb1367d350863ce1ab69958725079978af951b7310a36611d11f1e82ac05eac0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinAPIHObj.au3

Filesize
925KB

MD5
0162a97ed477353bc35776a7addffd5c

SHA1
10db8fe20bbce0f10517c510ec73532cf6feb227

SHA256
15600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571

SHA512
9638cab1aabe78c22a3d3528a391544f697d792640d831516b63fa52c393ee96bb588223e70163d059208cc5a14481c5ff7ef6ba9ac572322798a823d67f01f5

Download Submit
memory/2384-16-0x0000000075730000-0x00000000758AB000-memory.dmp

Filesize
1.5MB

Download
memory/2384-14-0x0000000075730000-0x00000000758AB000-memory.dmp

Filesize
1.5MB

Download
memory/2384-9-0x00007FFA93010000-0x00007FFA93205000-memory.dmp

Filesize
2.0MB

Download
memory/2384-11-0x0000000075730000-0x00000000758AB000-memory.dmp

Filesize
1.5MB

Download
memory/2384-12-0x0000000075730000-0x00000000758AB000-memory.dmp

Filesize
1.5MB

Download
memory/3320-23-0x0000000000FD0000-0x00000000010BB000-memory.dmp

Filesize
940KB

Download
memory/3320-18-0x00007FFA93010000-0x00007FFA93205000-memory.dmp

Filesize
2.0MB

Download
memory/3320-19-0x00000000009A0000-0x00000000009E9000-memory.dmp

Filesize
292KB

Download
memory/3320-24-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/3320-25-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/3320-26-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/3320-27-0x00000000009A0000-0x00000000009E9000-memory.dmp

Filesize
292KB

Download
memory/4480-0-0x00007FFA74C30000-0x00007FFA74DA2000-memory.dmp

Filesize
1.4MB

Download
memory/4480-5-0x00007FFA74C30000-0x00007FFA74DA2000-memory.dmp

Filesize
1.4MB

Download
memory/4480-6-0x00007FFA74C30000-0x00007FFA74DA2000-memory.dmp

Filesize
1.4MB

Download