lumma | a8d152de36ec0fac1dda7345e4faa0c2be3cbfecd7d566d7c147ff41c1e7bb46

Analysis

max time kernel
92s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
!#Ŝetüp_11640--#KéyPa$Ŝ!!/Setup.exe
Size 11.6MB
Sample240603-2n46cscf55
SHA256 90754bf8b4c72bb29a627ab28b253c91c7e424e54d17b10398a77a804cf6a70a
MD5 53457e788927f82e667edc60bb418682
SHA1 dfb72bb9cdc225c07a07158ca0bfd85b1ef05077
SHA512 64a9612ee17555d3766e06e2850e6705f6ba2f375633164a897e749201bc6d51dda35fa8c30b89a9cdad429dbe3ce35a6e042522e298ea90793c877edff47c60
SSDEEP 98304:2kLEI4MBsdrHJlxGLQ5LwyDuUgToBqUvVi9Gr1UhXt2XUmRQQ4+S2WrN7hC3focX:BEOB4rHJlxk43uZA1U/64+SbrN7hOPP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://tremendousjuokeyow.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://considerrycurrentyws.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Setup.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Setup.tmp

Executes dropped EXE 5 IoCs

pid	Process
2988	Setup.tmp
2924	Setup.tmp
2096	UnRAR.exe
848	convert.exe
2708	convert.exe

Loads dropped DLL 5 IoCs

pid	Process
2988	Setup.tmp
2924	Setup.tmp
848	convert.exe
2708	convert.exe
452	Ftur.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2708 set thread context of 4644	2708	convert.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2924	Setup.tmp
2924	Setup.tmp
848	convert.exe
2708	convert.exe
2708	convert.exe
4644	more.com
4644	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2708	convert.exe
4644	more.com

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	Setup.tmp

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2988	1460	Setup.exe	84
PID 1460 wrote to memory of 2988	1460	Setup.exe	84
PID 1460 wrote to memory of 2988	1460	Setup.exe	84
PID 2988 wrote to memory of 4556	2988	Setup.tmp	86
PID 2988 wrote to memory of 4556	2988	Setup.tmp	86
PID 2988 wrote to memory of 4556	2988	Setup.tmp	86
PID 4556 wrote to memory of 2924	4556	Setup.exe	87
PID 4556 wrote to memory of 2924	4556	Setup.exe	87
PID 4556 wrote to memory of 2924	4556	Setup.exe	87
PID 2924 wrote to memory of 2096	2924	Setup.tmp	89
PID 2924 wrote to memory of 2096	2924	Setup.tmp	89
PID 2924 wrote to memory of 848	2924	Setup.tmp	96
PID 2924 wrote to memory of 848	2924	Setup.tmp	96
PID 2924 wrote to memory of 848	2924	Setup.tmp	96
PID 848 wrote to memory of 2708	848	convert.exe	98
PID 848 wrote to memory of 2708	848	convert.exe	98
PID 848 wrote to memory of 2708	848	convert.exe	98
PID 2708 wrote to memory of 4644	2708	convert.exe	100
PID 2708 wrote to memory of 4644	2708	convert.exe	100
PID 2708 wrote to memory of 4644	2708	convert.exe	100
PID 2708 wrote to memory of 4644	2708	convert.exe	100
PID 4644 wrote to memory of 452	4644	more.com	104
PID 4644 wrote to memory of 452	4644	more.com	104
PID 4644 wrote to memory of 452	4644	more.com	104
PID 4644 wrote to memory of 452	4644	more.com	104
PID 4644 wrote to memory of 452	4644	more.com	104

C:\Users\Admin\AppData\Local\Temp\!#Ŝetüp_11640--#KéyPa$Ŝ!!\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\!#Ŝetüp_11640--#KéyPa$Ŝ!!\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\is-P2GGO.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-P2GGO.tmp\Setup.tmp" /SL5="$E0056,4518846,799232,C:\Users\Admin\AppData\Local\Temp\!#Ŝetüp_11640--#KéyPa$Ŝ!!\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\!#Ŝetüp_11640--#KéyPa$Ŝ!!\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\!#Ŝetüp_11640--#KéyPa$Ŝ!!\Setup.exe" /VERYSILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\is-MRVLS.tmp\Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MRVLS.tmp\Setup.tmp" /SL5="$7017A,4518846,799232,C:\Users\Admin\AppData\Local\Temp\!#Ŝetüp_11640--#KéyPa$Ŝ!!\Setup.exe" /VERYSILENT
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Users\Admin\AppData\Local\BrowserAuth_CGM\CurrentVersion\bin\UnRAR.exe
        
        "C:\Users\Admin\AppData\Local\\BrowserAuth_CGM\\CurrentVersion\\bin\\\UnRAR.exe" x -p2024 -o+ "C:\Users\Admin\AppData\Local\\BrowserAuth_CGM\\CurrentVersion\\bin\\\hgfdsdfesaa.rar" "C:\Users\Admin\AppData\Local\\BrowserAuth_CGM\\CurrentVersion\\bin\\"
        5⤵
        Executes dropped EXE
        
        PID:2096
    - - C:\Users\Admin\AppData\Local\BrowserAuth_CGM\CurrentVersion\bin\convert.exe
        
        "C:\Users\Admin\AppData\Local\BrowserAuth_CGM\CurrentVersion\bin\convert.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:848
      - C:\Users\Admin\AppData\Roaming\cpprest141_2_8\convert.exe
        
        C:\Users\Admin\AppData\Roaming\cpprest141_2_8\convert.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\more.com
        
        C:\Windows\SysWOW64\more.com
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Ftur.au3
        
        C:\Users\Admin\AppData\Local\Temp\Ftur.au3
        8⤵
        Loads dropped DLL
        
        PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UnRAR.exe

Path C:\Users\Admin\AppData\Local\BrowserAuth_CGM\CurrentVersion\bin\UnRAR.exe
Size 494KB
SHA256 e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b
MD5 98ccd44353f7bc5bad1bc6ba9ae0cd68
SHA1 76a4e5bf8d298800c886d29f85ee629e7726052d
SHA512 d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f
SSDEEP 6144:yY8mmN3YWYGAj9JwXScp39ioIKzKVEKfr01//bbh3S62Wt3A3ksFqXqjh6AusDyn:yY8XiWYGAkXh3Qqia/zAot3A6AhezSpK
MD5 SHA1 SHA512 SSDEEP

Submit Download

borage.pkg

Path C:\Users\Admin\AppData\Local\BrowserAuth_CGM\CurrentVersion\bin\borage.pkg
Size 1.3MB
SHA256 317e1dc225f271261c2b65dc92f22d619788d0fb26ee04effb38055142b6f3ca
MD5 2a142a8de9004d9a0b8fa4677ae5ec81
SHA1 55997f521c4dd9b629d248f3e08f45f094fcb7ee
SHA512 e75075993157e9ac4731b271f0b383aa905912a90bcd34c13302777a5d456aa3c2807cd4ea39a37ed59f322c1f6098e922b80ba5d871bf51178c02b75f2f2d49
SSDEEP 24576:wWdTp469aoOmV0DSQGu26XCCupkIVVoc9+KTWd5Q3jP2wyUVTxqyUBffFk:DpgUvbPwWp7cH5c+wzYE
MD5 SHA1 SHA512 SSDEEP

Submit Download

convert.exe

Path C:\Users\Admin\AppData\Local\BrowserAuth_CGM\CurrentVersion\bin\convert.exe
Size 5.5MB
SHA256 db2457caa1ccd65e63718b9e28789a12e17bc7a038975fba4f07dcd9f38e7016
MD5 9d8649afd4141d960b6545998fbc423b
SHA1 3ddd700caaebab0a9d2ed640f235d4b716a505de
SHA512 0a50681e956df3187a718570fd54600365e8ad805b7e291eb5fc6169df47a6d31596f890419aa36a4f3d983b17eb21eae9e2e51cf5755f8b2b890ba87b752da2
SSDEEP 49152:88iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ79z:bihyoPgbInQEHY3N3sNfxLlC1Dxeh
MD5 SHA1 SHA512 SSDEEP

Submit Download

hgfdsdfesaa.rar

Path C:\Users\Admin\AppData\Local\BrowserAuth_CGM\CurrentVersion\bin\hgfdsdfesaa.rar
Size 3.1MB
SHA256 9718c71750ae8c83932ac1b87d88445c44b9f56e5ee4232627897566dbbe9fd9
MD5 a56e573a51569bc1949f27224f43143d
SHA1 90a0efad912d80c652cbef01bd9ef0a7f100e8a5
SHA512 67e43b0fecceecd2c386de657d7e627c51cc42fe45edfbb967efae54f1e8c0a48334c83f5a81bea92533b4870c858de37ebe494c8d48006d3aae27c7afac95fa
SSDEEP 98304:I664fT3I8CdyRRR88KQXeuu8oknWVtyXutk:I1YRR85qeuVNA4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

passional.ogg

Path C:\Users\Admin\AppData\Local\BrowserAuth_CGM\CurrentVersion\bin\passional.ogg
Size 63KB
SHA256 c4a90bb1cddaa9077d8d546b91651591f89077803c85b867cd998bd184396b9f
MD5 94ab49b0ba0309c460597af26c5b029d
SHA1 583f4f2f5ac584b10672a99f4c60f959a1fb333b
SHA512 50e438c826a9ba72cf71384f6979ababe3c162b98f67fed0d52f6c08fe0aea78145b51a61b681be7463392180eaf2338a8ef68fe619cba14e09ef0b3f71dfe3e
SSDEEP 1536:d5/f+/szN52Zgufl4duAVFJ90CNF4WVm8Kma+cGri:D/fbzqD9FKFrnVm8K82
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcomp100.dll

Path C:\Users\Admin\AppData\Local\BrowserAuth_CGM\CurrentVersion\bin\vcomp100.dll
Size 49KB
SHA256 ee62a6c371d7a3b7a954598fee2090b6bb250cd630da099a5e2a6a9646c1082e
MD5 b1b84d9643458da52e4578da62fc7049
SHA1 6609ebac8b21690d08b37019f91eb469bfa1ea9e
SHA512 1b910dec7435c9dc0f8e627469d0b0802a8a444691c0a77e3f98b025895706a449d8c8d11cafd0b032d8a5f8f3f02a0089d826778b17fb1f75678b1fb1afa487
SSDEEP 1536:lPYlL8AJtsgMZvpKVb9KmLSPS/x6F5c8P:gPtsdvpKVbYBS/cF5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ftur.au3

Path C:\Users\Admin\AppData\Local\Temp\Ftur.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

ba9ab764

Path C:\Users\Admin\AppData\Local\Temp\ba9ab764
Size 1.8MB
SHA256 cc01f1353aeb292e9a2a44e0e65167ab017e722a2b6cf453b9d1f832c3e3658e
MD5 090bb44e2296bf37a4009b0c9b101f5b
SHA1 90fd3bc513215dd3f49c795779086132114cc89b
SHA512 a4586312ac55d3da25f2141d811e720e8ffcd3464957ec9069ad11b15e5571f9eb5afd114f66217d6711122bde97c4c4aeb7b2036b34395da57f3987251a4fa5
SSDEEP 49152:0E1oM2IbtBxaSbI69pT4OjXL5Wyb6tVIMhLRj7:j1xESNb5WliMhLRj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-ET5MB.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-P2GGO.tmp\Setup.tmp
Size 3.0MB
SHA256 7e3de3e8629bc0e0a0f7d5e01bfa60c2d39688af2469a93d426ab1ef94dfbe7e
MD5 5864454207ecc55087ddaa6663f3ac21
SHA1 b614ee6d0183aa0b87591276d0bb79c71cc3f3af
SHA512 a25dffaa50cd1adf6b3475c441a3094979ba51b96342a08a0fe2677dcc50baa6e58b7ca746d4394a7ac8dedb7fe4f0205ad607c99fadaf0874b7c33f97b06ee5
SSDEEP 49152:BWGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbZ333PO:DtLutqgwh4NYxtJpkxhG+3332
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-80-0x00007FFF72410000-0x00007FFF72605000-memory.dmp

Download

memory/452-82-0x0000000000240000-0x000000000029B000-memory.dmp

Download

memory/848-54-0x0000000075890000-0x0000000075A0B000-memory.dmp

Download

memory/848-55-0x00007FFF72410000-0x00007FFF72605000-memory.dmp

Download

memory/1460-20-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/1460-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/1460-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/2708-69-0x00000000756E0000-0x000000007585B000-memory.dmp

Download

memory/2708-67-0x00000000756E0000-0x000000007585B000-memory.dmp

Download

memory/2708-68-0x00007FFF72410000-0x00007FFF72605000-memory.dmp

Download

memory/2924-47-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2988-17-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/2988-6-0x0000000000400000-0x000000000070C000-memory.dmp

Download

memory/4556-50-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4556-15-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4556-13-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/4644-72-0x00007FFF72410000-0x00007FFF72605000-memory.dmp

Download

memory/4644-74-0x00000000756E0000-0x000000007585B000-memory.dmp

Download