lumma | 7e6a34eb765d6a834b8dbdacd69a94180852d06816cc46ed5e7fee34a32c9752

Analysis

max time kernel
82s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.exe
Size 165.3MB
Sample240509-snv31sbd49
SHA256 7e6a34eb765d6a834b8dbdacd69a94180852d06816cc46ed5e7fee34a32c9752
MD5 55c4d5e0e4a42bdda0558f2c30073d58
SHA1 691b5b6941c620ce55be57cd1fbcf831de520634
SHA512 bbb709d20c1d00e36d91f78f03a41a2610aadac6f3dfa87c47fb3081f808624c51194b875d7ffebd746c019e6fe03bffe5693db8e165328c8462f2d7896f9d2c
SSDEEP 786432:ufqjCcm0EsovRIeDc0m+jXJLLwLseZxXiirAjO3Af6N4NY8KbKz3Im:ufjJ0WeHoJL0oe/XvrGO31NIGb4Ym
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma rhadamanthys execution stealer

Malware Config

Extracted

Family

lumma

https://babycandidateoswp.shop/api
https://acceptabledcooeprs.shop/api
https://obsceneclassyjuwks.shop/api
https://zippyfinickysofwps.shop/api
https://miniaturefinerninewjs.shop/api
https://plaintediousidowsko.shop/api
https://sweetsquarediaslw.shop/api
https://holicisticscrarws.shop/api
https://boredimperissvieos.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4432 created 2940	4432	update1404.exe	51

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4736	powershell.exe
4264	powershell.exe
4372	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Installer.exe

Executes dropped EXE 2 IoCs

pid	Process
4092	connection1404.exe
4432	update1404.exe

Loads dropped DLL 3 IoCs

pid	Process
4636	Installer.exe
4636	Installer.exe
4636	Installer.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
14	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4092 set thread context of 4536	4092	connection1404.exe	103

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\launcher289\update1404.exe	Installer.exe
File opened for modification	C:\Program Files\launcher289\update1404.exe	Installer.exe
File created	C:\Program Files\launcher289\connection1404.zip	Installer.exe
File created	C:\Program Files\launcher289\connection1404.exe	Installer.exe
File opened for modification	C:\Program Files\launcher289\connection1404.exe	Installer.exe
File created	C:\Program Files\launcher289\update1404.zip	Installer.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	4432	WerFault.exe	102

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4736	powershell.exe
4736	powershell.exe
4264	powershell.exe
4264	powershell.exe
4432	update1404.exe
4432	update1404.exe
3692	dialer.exe
3692	dialer.exe
3692	dialer.exe
3692	dialer.exe
4372	powershell.exe
4372	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	Installer.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4736	4636	Installer.exe	96
PID 4636 wrote to memory of 4736	4636	Installer.exe	96
PID 4636 wrote to memory of 4092	4636	Installer.exe	99
PID 4636 wrote to memory of 4092	4636	Installer.exe	99
PID 4636 wrote to memory of 4264	4636	Installer.exe	100
PID 4636 wrote to memory of 4264	4636	Installer.exe	100
PID 4636 wrote to memory of 4432	4636	Installer.exe	102
PID 4636 wrote to memory of 4432	4636	Installer.exe	102
PID 4636 wrote to memory of 4432	4636	Installer.exe	102
PID 4092 wrote to memory of 4536	4092	connection1404.exe	103
PID 4092 wrote to memory of 4536	4092	connection1404.exe	103
PID 4092 wrote to memory of 4536	4092	connection1404.exe	103
PID 4092 wrote to memory of 4536	4092	connection1404.exe	103
PID 4092 wrote to memory of 4536	4092	connection1404.exe	103
PID 4432 wrote to memory of 3692	4432	update1404.exe	104
PID 4432 wrote to memory of 3692	4432	update1404.exe	104
PID 4432 wrote to memory of 3692	4432	update1404.exe	104
PID 4432 wrote to memory of 3692	4432	update1404.exe	104
PID 4432 wrote to memory of 3692	4432	update1404.exe	104
PID 4636 wrote to memory of 4372	4636	Installer.exe	109
PID 4636 wrote to memory of 4372	4636	Installer.exe	109

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2940
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/launcher289'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Program Files\launcher289\connection1404.exe
  "C:\Program Files\launcher289\connection1404.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/launcher289'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4264
- C:\Program Files\launcher289\update1404.exe
  "C:\Program Files\launcher289\update1404.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 616
    3⤵
    - Program crash
    PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/launcher289'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4432 -ip 4432
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

connection1404.exe

Path C:\Program Files\launcher289\connection1404.exe
Size 22.9MB
SHA256 d0d37ef51f82e373268bbfbb7c5ca384676c7a42e31e3e4aa44e072dd776e72b
MD5 37f6e4d71ce156155cfcd70d6c6cb9ae
SHA1 27099cb0f21a4aead1fd47ce9d60062779a4c96b
SHA512 e2e32a8bb5e7d8060c6c917f51bda7e5b6cd88364a269e4c1aefee6f49197f06d524741cb68a303f7cf30d8a81dacef13e07606e7110163344a4fca6b6f03240
SSDEEP 98304:Qr4TTSGVrXWTEdTwJEZFq1XtDzfwHOBkpllGVi1qxdIqwCvzEq+aPJqk3TiNdKSg:/nrm4wJEZYzBCKiAxOq4qXF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

update1404.exe

Path C:\Program Files\launcher289\update1404.exe
Size 537KB
SHA256 5d130be35a463bdb29cb5fac2192c45752b8efc70c092c809632c7a222f67985
MD5 00cb831779c6a4ee61067448973386e1
SHA1 ca34052604fe6e8bea898a5e7b6e449f5b5a9581
SHA512 6b53ecfe617dc0768c16dd470f8701d755652e9caa32afc539cb0cbf5d025d77239ba751982e4a2a5184de777ffb06135abd6656ee9d8880d6e1e8681133274f
SSDEEP 12288:RBHAghJtMmhHt8Sir9yf7vEwkIqy5EAldg/8oQn:R5CgN8Sicf7vjbLldg/8oQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c0997b01ec52ab8d78463c08d43959951ea75b97cc4be1207dcf63f2568b0177
MD5 6cebd2c1953c9892939293351aebee65
SHA1 e9d83ac62d667d67d9ab3db35036d957c4344515
SHA512 2a1c79ab657c8ae68cd70e477ece80290fc326299ccf9c2d0615d1545cf597b46674b720b29b52ba2938cf0a27bb1cb48979b55b9513afbf0ad2e12c4c7e9f84
MD5 SHA1 SHA512

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Installer\shuc1xRJUqTHSuJyeEIHwwt0f3uEtgw=\D3DCompiler_47_cor3.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
MD5 SHA1 SHA512 SSDEEP

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Installer\shuc1xRJUqTHSuJyeEIHwwt0f3uEtgw=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 e284235a4d6e5d905692351cdfe8bc42ed842df8e5a8eb42fde90d1c3e2e90fa
MD5 0c147149b444748dae0a04e2e3d3269a
SHA1 f7edbcd6d1d6b199b6c997d6b781a794d736d3ff
SHA512 ec057829c03623cabc5a42ddebec9b75107f987eaf9cb642f3f1aed4d4c64c544f60a1dc7bc4208e025bce38c72091e615ac2fd9f1bd27651d49addcb0ae8b36
SSDEEP 24576:TgqKM/uABRPKWdTCG9YQ9HnsWJP41rWVxFyG/YtiB5gda4HADUSjNrNmH7Sz5PMC:TMM/uAXKWdTCGgWJP4AVx8WYgB5g9HA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Installer\shuc1xRJUqTHSuJyeEIHwwt0f3uEtgw=\wpfgfx_cor3.dll
Size 1.9MB
SHA256 9c3fdfb42c920bf26f0fbeaee9a63a3d23b1cb35245320af48c69af4e933a606
MD5 425573cd9eea68d2dc78bd7a0e207dbf
SHA1 156ba2df6d5f9ac9b72bb1f9ff967d808cc23062
SHA512 91c2c7279bd4cf9aac6fb69917899556296e0121eb5a41974b311d887a13bc353acb14413ba68f96480091f5991edb9fed998b27dda1608b3518d6501db33329
SSDEEP 24576:hu64Z8enWTOyUXX8nzRpPfgnAAfOiVPawTfcyfyDGl2QdiLdbR4SSMjjvl7Zvcbv:mtvyMX8n7PIn0UPTfc232Qwh94ON7ybv
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_x30x2epv.w0v.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x30x2epv.w0v.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3692-73-0x00000000755F0000-0x0000000075805000-memory.dmp

Download

memory/3692-71-0x00007FFCD3AF0000-0x00007FFCD3CE5000-memory.dmp

Download

memory/3692-68-0x0000000000EF0000-0x0000000000EF9000-memory.dmp

Download

memory/3692-70-0x0000000002A60000-0x0000000002E60000-memory.dmp

Download

memory/4092-62-0x00007FF606D50000-0x00007FF6084A9000-memory.dmp

Download

memory/4092-57-0x00007FF606D50000-0x00007FF6084A9000-memory.dmp

Download

memory/4432-64-0x00000000033F0000-0x00000000037F0000-memory.dmp

Download

memory/4432-63-0x00000000033F0000-0x00000000037F0000-memory.dmp

Download

memory/4432-65-0x00007FFCD3AF0000-0x00007FFCD3CE5000-memory.dmp

Download

memory/4432-67-0x00000000755F0000-0x0000000075805000-memory.dmp

Download

memory/4536-60-0x0000000000E60000-0x0000000000EB7000-memory.dmp

Download

memory/4536-61-0x0000000000E60000-0x0000000000EB7000-memory.dmp

Download

memory/4736-28-0x00007FFCB36D0000-0x00007FFCB4191000-memory.dmp

Download

memory/4736-25-0x00007FFCB36D0000-0x00007FFCB4191000-memory.dmp

Download

memory/4736-24-0x00007FFCB36D0000-0x00007FFCB4191000-memory.dmp

Download

memory/4736-16-0x000002184C4F0000-0x000002184C512000-memory.dmp

Download

memory/4736-13-0x00007FFCB36D3000-0x00007FFCB36D5000-memory.dmp

Download