lumma | 8777fb6d9cf846754e63e241d2133021b50ebb573e82fbc984565701ee551f49

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
279521aa3c09c012de59789a7e3053a3ceaedd5c4a6d230de0589e7502d4ae4f.exe
Size 6.4MB
Sample240608-dyg7kshb72
SHA256 279521aa3c09c012de59789a7e3053a3ceaedd5c4a6d230de0589e7502d4ae4f
MD5 7d44a8a6757c2b7287c4a7b761f4e326
SHA1 0cd029b3f4cf2d9e6cf012710c805a2a4d1fa552
SHA512 32f8ad062c2bbf3e2ef6e6a713564037a47203b0000078effa57d431929b4c4b267bf6b998f44eec82b226a48ecd07ddce7fce02d5063ed6d7002b6f91cd8b77
SSDEEP 196608:6qwjqwND4f0Zmwn7WydaIwf25TOsupVcWUMkvE60c:mD4jywhel/kTU5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer vmprotect

Malware Config

Extracted

Family

lumma

https://greentastellesqwm.shop/api
https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	work.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	279521aa3c09c012de59789a7e3053a3ceaedd5c4a6d230de0589e7502d4ae4f.exe

Executes dropped EXE 2 IoCs

pid	Process
4136	work.exe
1676	pgeask.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000800000002342b-14.dat	vmprotect
behavioral2/memory/1676-20-0x0000000000B30000-0x0000000001441000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1676	pgeask.exe
1676	pgeask.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4092	460	279521aa3c09c012de59789a7e3053a3ceaedd5c4a6d230de0589e7502d4ae4f.exe	82
PID 460 wrote to memory of 4092	460	279521aa3c09c012de59789a7e3053a3ceaedd5c4a6d230de0589e7502d4ae4f.exe	82
PID 4092 wrote to memory of 4136	4092	cmd.exe	85
PID 4092 wrote to memory of 4136	4092	cmd.exe	85
PID 4136 wrote to memory of 1676	4136	work.exe	88
PID 4136 wrote to memory of 1676	4136	work.exe	88
PID 4136 wrote to memory of 1676	4136	work.exe	88

C:\Users\Admin\AppData\Local\Temp\279521aa3c09c012de59789a7e3053a3ceaedd5c4a6d230de0589e7502d4ae4f.exe
"C:\Users\Admin\AppData\Local\Temp\279521aa3c09c012de59789a7e3053a3ceaedd5c4a6d230de0589e7502d4ae4f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    work.exe -priverdD
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\pgeask.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\pgeask.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
Size 35B
SHA256 065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2
MD5 ff59d999beb970447667695ce3273f75
SHA1 316fa09f467ba90ac34a054daf2e92e6e2854ff8
SHA512 d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d
MD5 SHA1 SHA512

Submit Download

work.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
Size 5.9MB
SHA256 8f66303eb4b2081550df14a9f20593255795a9deadc5fffe7c944896a377a589
MD5 7062978319f2e9eed1281ec867c039bf
SHA1 306b17e75f535bba9651bdeed9f1e8742f2ba164
SHA512 79221b6aac9009e205fd502da995d44dd1502a15acbb9e683f5e6a83b33b216ea4616055f368981ae9f6d9bd24b3872dea027c3749e469eaffe5fe2f9f82db47
SSDEEP 98304:ZqwND4WS0ScbkRwn7zStyWSgj3Iwf2tyZLITOsupVcWUovDkvENsp94mwg6y:ZqwND4f0Zmwn7WydaIwf25TOsupVcWU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

pgeask.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\pgeask.exe
Size 5.5MB
SHA256 d89512fb49bb158b7851502247d850c8c030be161486cf6c35a587fcce8f354b
MD5 4bbf8e1917a0953c48eab300a0d70557
SHA1 86ca4009fe1021d9199584dfbacfea11c73d7230
SHA512 50fa780d6b0af9d78ddd4b3ebad67636f59f0da9bf10aefbaaa1f2375eec979bf660ec7586e2b50c3e8b886ee69a008484b7189e5eb40dbee428dd13c898b772
SSDEEP 98304:JXxiqj1DTVhwXywu7HQVrGhA3O0WXXV0EXGiQ/1ZrLFbvwwS2:RsED5hOyQVrGu31WXs1TrLFUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1676-20-0x0000000000B30000-0x0000000001441000-memory.dmp

Download

memory/1676-19-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

Download