lumma | 3ee6f79613b3e07d5b856310e00c59b01f7462ed436e2c0613a65272377af540

Analysis

max time kernel
90s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
#!~#0PeN_8086_P@$$WORd%!$/Setup.exe
Size 11.5MB
Sample240603-1pagpsab7v
SHA256 02c70483c23a8e3f348ba41999476e2f082f863cf11d00e5d11254277213b828
MD5 4acceb13d15569073eb935c9eca64c23
SHA1 5049430baa9e629510708c15afba9a29dc6e6f97
SHA512 10c48376a67f47a01bdf2f902d19517e2c3a54d39db427983276f06bc3b458054adb08e4d4eb0f3b27d91033e93a9b8d8375e777874b61713bf7a1927ee74a4c
SSDEEP 196608:xIIfNn7vYYlNz9cYIXrw2/xA1UrLXtJbZypRmntTYImEZoJAVbsuI89Li8T1+UU:vfmYlNz2YIX3drLwmtT3QeV4uHx3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://scientificymalieffkywo.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://considerrycurrentyws.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Setup.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Setup.tmp

Executes dropped EXE 5 IoCs

pid	Process
940	Setup.tmp
1192	Setup.tmp
816	UnRAR.exe
4216	convert.exe
3128	convert.exe

Loads dropped DLL 5 IoCs

pid	Process
940	Setup.tmp
1192	Setup.tmp
4216	convert.exe
3128	convert.exe
4948	Null.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3128 set thread context of 1952	3128	convert.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1192	Setup.tmp
1192	Setup.tmp
4216	convert.exe
3128	convert.exe
3128	convert.exe
1952	more.com
1952	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3128	convert.exe
1952	more.com

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1192	Setup.tmp

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 940	380	Setup.exe	83
PID 380 wrote to memory of 940	380	Setup.exe	83
PID 380 wrote to memory of 940	380	Setup.exe	83
PID 940 wrote to memory of 3248	940	Setup.tmp	85
PID 940 wrote to memory of 3248	940	Setup.tmp	85
PID 940 wrote to memory of 3248	940	Setup.tmp	85
PID 3248 wrote to memory of 1192	3248	Setup.exe	86
PID 3248 wrote to memory of 1192	3248	Setup.exe	86
PID 3248 wrote to memory of 1192	3248	Setup.exe	86
PID 1192 wrote to memory of 816	1192	Setup.tmp	87
PID 1192 wrote to memory of 816	1192	Setup.tmp	87
PID 1192 wrote to memory of 4216	1192	Setup.tmp	93
PID 1192 wrote to memory of 4216	1192	Setup.tmp	93
PID 1192 wrote to memory of 4216	1192	Setup.tmp	93
PID 4216 wrote to memory of 3128	4216	convert.exe	95
PID 4216 wrote to memory of 3128	4216	convert.exe	95
PID 4216 wrote to memory of 3128	4216	convert.exe	95
PID 3128 wrote to memory of 1952	3128	convert.exe	97
PID 3128 wrote to memory of 1952	3128	convert.exe	97
PID 3128 wrote to memory of 1952	3128	convert.exe	97
PID 3128 wrote to memory of 1952	3128	convert.exe	97
PID 1952 wrote to memory of 4948	1952	more.com	102
PID 1952 wrote to memory of 4948	1952	more.com	102
PID 1952 wrote to memory of 4948	1952	more.com	102
PID 1952 wrote to memory of 4948	1952	more.com	102
PID 1952 wrote to memory of 4948	1952	more.com	102

C:\Users\Admin\AppData\Local\Temp\#!~#0PeN_8086_P@$$WORd%!$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\#!~#0PeN_8086_P@$$WORd%!$\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\is-D912P.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D912P.tmp\Setup.tmp" /SL5="$4021A,4487230,799232,C:\Users\Admin\AppData\Local\Temp\#!~#0PeN_8086_P@$$WORd%!$\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Users\Admin\AppData\Local\Temp\#!~#0PeN_8086_P@$$WORd%!$\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\#!~#0PeN_8086_P@$$WORd%!$\Setup.exe" /VERYSILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\is-Q3M2M.tmp\Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-Q3M2M.tmp\Setup.tmp" /SL5="$4022A,4487230,799232,C:\Users\Admin\AppData\Local\Temp\#!~#0PeN_8086_P@$$WORd%!$\Setup.exe" /VERYSILENT
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1192
    - - C:\Users\Admin\AppData\Local\Temp\is-9TO2O.tmp\UnRAR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-9TO2O.tmp\\UnRAR.exe" x -pVX#YC6 -o+ "C:\Users\Admin\AppData\Local\\lzhService\\config\\\AEWSXDCGFHV.rar" "C:\Users\Admin\AppData\Local\\lzhService\\config\\"
        5⤵
        Executes dropped EXE
        
        PID:816
    - - C:\Users\Admin\AppData\Local\lzhService\config\convert.exe
        
        "C:\Users\Admin\AppData\Local\lzhService\config\convert.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4216
      - C:\Users\Admin\AppData\Roaming\kcd_server\convert.exe
        
        C:\Users\Admin\AppData\Roaming\kcd_server\convert.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\more.com
        
        C:\Windows\SysWOW64\more.com
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Null.au3
        
        C:\Users\Admin\AppData\Local\Temp\Null.au3
        8⤵
        Loads dropped DLL
        
        PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Null.au3

Path C:\Users\Admin\AppData\Local\Temp\Null.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

a4c627f

Path C:\Users\Admin\AppData\Local\Temp\a4c627f
Size 1.8MB
SHA256 21572b0f61c339e944915e5dfa15630222d657ff1073669f90b250cc82105b77
MD5 2259b137ad02f4f75a7b1bb6340a4cd9
SHA1 eff0417aaf43181aa43e68aaecb39381560aaeb4
SHA512 4a3f140d3ead74daa0f48dc93ff47ae603ba79fb13b5ae333c9763d49ab185763867831b24f560e5ee3f961721612ea5ae92e636fbe9be115eb4b45a18c37842
SSDEEP 49152:lTiPDff0ypCCwEBV0P9jv/JdHk3skIUvK:lTiAb60ljWTDvK
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnRAR.exe

Path C:\Users\Admin\AppData\Local\Temp\is-9TO2O.tmp\UnRAR.exe
Size 494KB
SHA256 e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b
MD5 98ccd44353f7bc5bad1bc6ba9ae0cd68
SHA1 76a4e5bf8d298800c886d29f85ee629e7726052d
SHA512 d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f
SSDEEP 6144:yY8mmN3YWYGAj9JwXScp39ioIKzKVEKfr01//bbh3S62Wt3A3ksFqXqjh6AusDyn:yY8XiWYGAkXh3Qqia/zAot3A6AhezSpK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-D912P.tmp\Setup.tmp
Size 3.0MB
SHA256 87b542f157cd81b1a45cbe72baa07c25a47596d6fd715d99e638eb6af380e632
MD5 c76ade3b33022fa6f6385986fbbcaf88
SHA1 355a57e129a5a3a4e4fde4e74c392497984bb7df
SHA512 4fc65b29d6e83d9cd077af003d20128bd348cd992c5b6f2e7c8f55482cd033d0ceebc7a7af6046df7006fcf869c9fd594cdd6481c7caf3f28535ab0f2a6c6de4
SSDEEP 49152:BWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbZ333Pa:DtLutqgwh4NYxtJpkxhG+333S
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-UG1NG.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

AEWSXDCGFHV.rar

Path C:\Users\Admin\AppData\Local\lzhService\config\AEWSXDCGFHV.rar
Size 3.0MB
SHA256 fabfa2ab35df2a72f47c87b424a7532cadf92444b9e1ec0976de8391238a5183
MD5 02cc7ef36390fae63b4bd2b5c889ea90
SHA1 41deaf0517ac6d7a1e512480fa4350dd5007e7d0
SHA512 cbe155e9192b19105f4dbb41ac973145ecb01c1442975531ec62e3442af9fc04f1d4fe96132b32fb5f805a4c3a559ba94e9d8baa8077c4f0dfd40e69c80b8c59
SSDEEP 98304:kA1tbIgOUhpNy33vJPU53H2IsA2N7pvgqqSi:n/biUty33RPOPsA2Tgqy
MD5 SHA1 SHA512 SSDEEP

Submit Download

convert.exe

Path C:\Users\Admin\AppData\Local\lzhService\config\convert.exe
Size 5.5MB
SHA256 db2457caa1ccd65e63718b9e28789a12e17bc7a038975fba4f07dcd9f38e7016
MD5 9d8649afd4141d960b6545998fbc423b
SHA1 3ddd700caaebab0a9d2ed640f235d4b716a505de
SHA512 0a50681e956df3187a718570fd54600365e8ad805b7e291eb5fc6169df47a6d31596f890419aa36a4f3d983b17eb21eae9e2e51cf5755f8b2b890ba87b752da2
SSDEEP 49152:88iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ79z:bihyoPgbInQEHY3N3sNfxLlC1Dxeh
MD5 SHA1 SHA512 SSDEEP

Submit Download

hindfoot.bmp

Path C:\Users\Admin\AppData\Local\lzhService\config\hindfoot.bmp
Size 1.3MB
SHA256 3fa0a6c182a7332baaca24137e98fe9b0e086beed2b3580a0cf1719cb7f0e3e0
MD5 abd94d8b6f90960dc9acf7e1571c388a
SHA1 f4ecd57a5c1b0b85f3b8ec33c6f602229c9132b7
SHA512 5138b53a38135578cf2ebac1c9b1fce76dacedfb6cba9cac21f8bbc9370b301b8330d843387df1a22200de2942ae40787be6788aeea0652de2d6d87cf5f03350
SSDEEP 24576:og6lwkLihA3S6nLTExt5a+FNAAnHQG4gxPpJLgz3Iq3c+MK:6hLiESyTQt5JNATG4qDLQLcE
MD5 SHA1 SHA512 SSDEEP

Submit Download

imprest.m4a

Path C:\Users\Admin\AppData\Local\lzhService\config\imprest.m4a
Size 12KB
SHA256 e88cdf41665ba94f5a887b7d579a10cc0c24a1d9a4078ce4e6c43fa885e20fc0
MD5 b3892229ca279eb7dafb501a0ae8c8a7
SHA1 69572520aca0836caf350dfd0e2054e943368ff4
SHA512 24805667c4162ad3c053ac2dcd2cd9b19685f9d9a1a62c66aadfcf1976627046bf39ec272aed3f9f25c0ab26eb6fb0bf60b448db455976f91a5b045832a6d444
SSDEEP 192:7OGSqKfTlkr+PQl3H7nBq1ft+aQom3jDCmanli+5H9Ik3IOfzUVFekZ72nUxTD:qG4kn7nBkoaQ1L5CIoRfYfOUxTD
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcomp100.dll

Path C:\Users\Admin\AppData\Local\lzhService\config\vcomp100.dll
Size 49KB
SHA256 7d38cf4fc8058147a6019eda042ea2264457dc5ec74cf0d99ef6e345f7eaacad
MD5 983599d2dda3bc9d148c7557111438ea
SHA1 ad72cd10f97dbad50465ab15134a102ccbf58542
SHA512 b169e958261036df23b430a1adefdc4c6c5706c5b147ff83ca3765e309b985063aeeb52e6bc37f3f6bfad3e635c99c522945a06f58b6d01b3ee4f38caa8e7b9e
SSDEEP 1536:TLYlL8A3MlIg7piVbqCmLS4/S/+6F5c8P:G9Mh7piVbjMS/DF5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-19-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/380-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/380-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/940-17-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/940-6-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/1192-47-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/1952-74-0x0000000074EA0000-0x0000000074EF2000-memory.dmp

Download

memory/1952-72-0x00007FFDA0F70000-0x00007FFDA1165000-memory.dmp

Download

memory/3128-67-0x0000000074EA0000-0x0000000074EF2000-memory.dmp

Download

memory/3128-68-0x00007FFDA0F70000-0x00007FFDA1165000-memory.dmp

Download

memory/3128-69-0x0000000074EA0000-0x0000000074EF2000-memory.dmp

Download

memory/3248-16-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/3248-49-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/3248-13-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4216-55-0x00007FFDA0F70000-0x00007FFDA1165000-memory.dmp

Download

memory/4216-54-0x0000000074EA0000-0x0000000074EF2000-memory.dmp

Download

memory/4948-80-0x00007FFDA0F70000-0x00007FFDA1165000-memory.dmp

Download

memory/4948-82-0x0000000000690000-0x00000000006EA000-memory.dmp

Download