lumma | 2f66b87534d0e252da98f11e8a2b43879298f3d9eac0b8c84f382e5c24e2f7a4

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ImPackr.exe
Size 102KB
Sample240624-dmt21awblb
SHA256 689951b03517f77b6c04bb57f604f50736dc1a86b87253b0dee73722d4520a11
MD5 2f779ac4318fd4990c828f60d16f2b17
SHA1 a188080158f8cdfe5050d6e828fb69e17ac0be19
SHA512 7f6dc79ab6db4615bb0c7b31d36cc8750373f9b7c199bfaa8e1eff9dbd6f0b790fe7e4c9dc86b62abb811d93e946e68ddc171701bddba423079447124ca6464c
SSDEEP 1536:BdPnjwBj/h13T5KRy8DiliMz+WPSC0mJcSs93k0TmOTWAnBchQlQICRXRXYu:BdPjwRrdoirza7C0iOPchc6Np
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma persistence privilege_escalation stealer

Malware Config

Extracted

Family

lumma

https://quotakickerrywos.shop/api
https://publicitycharetew.shop/api
https://computerexcudesp.shop/api
https://leafcalfconflcitw.shop/api
https://injurypiggyoewirog.shop/api
https://bargainnygroandjwk.shop/api
https://disappointcredisotw.shop/api
https://doughtdrillyksow.shop/api
https://facilitycoursedw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
1632	ImPackr.exe

Loads dropped DLL 15 IoCs

pid	Process
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 2140	1632	ImPackr.exe	84

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3960	ImPackr.exe
1632	ImPackr.exe
1632	ImPackr.exe
2140	netsh.exe
2140	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1632	ImPackr.exe
2140	netsh.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 1632	3960	ImPackr.exe	82
PID 3960 wrote to memory of 1632	3960	ImPackr.exe	82
PID 3960 wrote to memory of 1632	3960	ImPackr.exe	82
PID 1632 wrote to memory of 2140	1632	ImPackr.exe	84
PID 1632 wrote to memory of 2140	1632	ImPackr.exe	84
PID 1632 wrote to memory of 2140	1632	ImPackr.exe	84
PID 1632 wrote to memory of 2140	1632	ImPackr.exe	84
PID 2140 wrote to memory of 1020	2140	netsh.exe	95
PID 2140 wrote to memory of 1020	2140	netsh.exe	95
PID 2140 wrote to memory of 1020	2140	netsh.exe	95
PID 2140 wrote to memory of 1020	2140	netsh.exe	95
PID 2140 wrote to memory of 1020	2140	netsh.exe	95

C:\Users\Admin\AppData\Local\Temp\ImPackr.exe
"C:\Users\Admin\AppData\Local\Temp\ImPackr.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Roaming\TpcDriverv1\ImPackr.exe
  C:\Users\Admin\AppData\Roaming\TpcDriverv1\ImPackr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\SysWOW64\netsh.exe
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\SysWOW64\SearchIndexer.exe
      C:\Windows\SysWOW64\SearchIndexer.exe
      4⤵
      PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

897974d2

Path C:\Users\Admin\AppData\Local\Temp\897974d2
Size 999KB
SHA256 13abdf173df59ba96dc1b09c788ea8353f593780011c4293943eeff01d751668
MD5 631cffcb8b2052e075c086e9ed8cf27e
SHA1 1b1ddd6fabd715ecfb90f037a057f208736159ed
SHA512 aeb353eca7449821b6826dbfbbc574978e1abf5c823ab2e1b10be9ae4ad58b6ff54672a8b54fdd19e31e2a6edeb82bbd69045a481f4cda556315ea176ead90b3
SSDEEP 24576:6W5bEO2nHH5abjZfA92GuyID6anJR0Gr0Mtb4UbiLZqA3:6WZEhYR+/IXGMtb4UbiVqI
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMHttpComm.dll

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\IMHttpComm.dll
Size 32KB
SHA256 96d6264b26decf6595ca6f0584a1b60589ec5dacdf03ddf5fbb6104a6afc9e7a
MD5 a70d91a9fd7b65baa0355ee559098bd8
SHA1 546127579c06ae0ae4f63f216da422065a859e2f
SHA512 f13b735a47090c7c6cc6c2bf9148408ee6db179c96ee6428270541f27e50ad12cff7486f3a6ffac2ba83fd2e6e8e49661e6258f5aee97eb0f48771cbbd22aefa
SSDEEP 384:UYacYCuDAIKaDEsdpRPcWzXKNfdZ1uTslWfXLhxyM8OjrsVIObsU25hoe1nYPLMt:Scr9/i1AscZ1wf7h4bOjKRsIe1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImLookExU.dll

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\ImLookExU.dll
Size 262KB
SHA256 0e469f31a8399483862231a0fe5b78bf90a7df4ac5c0470ae79adc33e4a42d10
MD5 c3d6a629966b2de0ac954c0c75847f59
SHA1 8109256492cb3a2a38a6587b7e1145c58e078769
SHA512 c80f718baa86aa05a566b8b5f8087a9f32703ef8f00ded809e0a2d74e94604b4b524989d953e26b9752e02fe2601ebe6527ef03384f6368ff6e5dca289a857e0
SSDEEP 6144:9X6yu38mY4o8xnZSYDI7jlFl4oYVFl4OgqAIwMr5s:9X6yhmY4pZSYkvl4/NwU5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImLookU.dll

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\ImLookU.dll
Size 606KB
SHA256 a6766c524497144d585efa4fe384b516b563203427003508f7c8f6bffa7c928d
MD5 3ea6d805a18715f7368363dea3cd3f4c
SHA1 30ffafc1dd447172fa91404f07038d759c412464
SHA512 a102f23741de4ca2184485d9aa4ddd1a36b9ea52cb0859cfd264d69a9996293b7e29b325625f1f6f9330d6c80ff415e09e85e1ae838c58acef585ae8dffe3070
SSDEEP 6144:5hvkhcT5e0HWJ5/10UfCrXCL12gQhYwtHWDEyF0nb6rFBvJ+sbJeDH+8uGh7xgLX:5hvkhcTd2JxXCrS85h0Dh0nMKbz45
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImNtUtilU.dll

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\ImNtUtilU.dll
Size 94KB
SHA256 a8e1b0e676dce9556037d29fd96521ec814858404ba4cfdd0db0edbe22c87bc7
MD5 bb326fe795e2c1c19cd79f320e169fd3
SHA1 1c1f2b8d98f01870455712e6eba26d77753adcac
SHA512 a1ec894151baa14e4ac1ee9471e8606bf74edd39f7833d9a1a44eee74d403f6b52780c135e9718ff9564fa27d7128c22b8410b21f77e6d804f698cfb4eda65a1
SSDEEP 1536:q01U2obLeNvXXZ6Wb/2LamjMkUYCTSZaKAxvSJKRDOAG921:NobLeNvXp6Ou+mjMkUYC2ZVAxxFOAG9s
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImPackr.exe

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\ImPackr.exe
Size 102KB
SHA256 689951b03517f77b6c04bb57f604f50736dc1a86b87253b0dee73722d4520a11
MD5 2f779ac4318fd4990c828f60d16f2b17
SHA1 a188080158f8cdfe5050d6e828fb69e17ac0be19
SHA512 7f6dc79ab6db4615bb0c7b31d36cc8750373f9b7c199bfaa8e1eff9dbd6f0b790fe7e4c9dc86b62abb811d93e946e68ddc171701bddba423079447124ca6464c
SSDEEP 1536:BdPnjwBj/h13T5KRy8DiliMz+WPSC0mJcSs93k0TmOTWAnBchQlQICRXRXYu:BdPjwRrdoirza7C0iOPchc6Np
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImUtilsU.dll

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\ImUtilsU.dll
Size 1.4MB
SHA256 914b1e53451b8be2c362d62514f28bdef46a133535d959b13f3f4bf3bc63df3a
MD5 a7eaba8bc12b2b7ec2a41a4d9e45008a
SHA1 6a96a18bb4f1cd6196517713ed634f37f6b0362b
SHA512 0ae7fbdb2677d92c62337aa17b60a4887240a4a426ba638c7633587f4582adbcda2bde5ec824aab1a3f69acf2b391118763842acfab856d3d9764850961a2ac8
SSDEEP 24576:2EQirQajY+S5eqyL9dj7GP4a6xKlnNYndIA1HVtFyC0Glqb6WUOQZljMFbDG0:fQj+S5epJl7+eenN5+HVDD0bUOQPUbDP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImWrappU.dll

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\ImWrappU.dll
Size 158KB
SHA256 7187903a9e4078f4d31f4b709a59d24eb6b417ea289f4f28eabce1ea2e713dce
MD5 cbf4827a5920a5f02c50f78ed46d0319
SHA1 b035770e9d9283c61f8f8bbc041e3add0197de7b
SHA512 d1a285fb630f55df700a74e5222546656de7d2da7e1419e2936078340767d0bab343b603ba0d07140c790eb5d79a8a34b7818b90316ea06cb9f53cad86b6d3f5
SSDEEP 1536:+Vcm093l7KjJdwXjCsZ+WymDAZZxgbgROgldJ+VEcn75A:+Vcm03ggjCsZDym6Og5+Vpm
MD5 SHA1 SHA512 SSDEEP

Submit Download

MFC80U.DLL

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\MFC80U.DLL
Size 1.0MB
SHA256 18be5d3c656236b7e3cd6d619d62496fe3e7f66bf2859e460f8ac3d1a6bdaa9a
MD5 ccc2e312486ae6b80970211da472268b
SHA1 025b52ff11627760f7006510e9a521b554230fee
SHA512 d6892abb1a85b9cf0fc6abe1c3aca6c46fc47541dffc2b75f311e8d2c9c1d367f265599456bd77be0e2b6d20c6c22ff5f0c46e7d9ba22c847ad1cbedc8ca3eff
SSDEEP 12288:o5lk6KUYmYRP6vAt9+J51r64f22JhPeEiz8F+p/xoOTa+S9XqNNw2ohW3:UyUaP64t9+JfrRJiz8F+p/N2/cmW
MD5 SHA1 SHA512 SSDEEP

Submit Download

SftTree_IX86_U_60.dll

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\SftTree_IX86_U_60.dll
Size 570KB
SHA256 24f2399fc83198ab8d63ee6a1ad6ffbd1eda4d38048d3e809fecd2a3e0709671
MD5 57bf106e5ec51b703b83b69a402dc39f
SHA1 bd4cfab7c50318607326504cc877c0bc84ef56ef
SHA512 8bf60649ece6bbb66c7b94ed0d9214fbeab030d5813e1e7b5d6d2349ee1de9075b7dfbbbbeae5af0dc21b071a00eafce0771ca1804e6752e9a71e71e6b1447df
SSDEEP 6144:+F1oCaK7hWLMxQqTxNEaPe/cq0sJBJYzlRtcChgWPQnjLkV3Ij9DvAmintVM:koxK7hhNN1m/cq0sJ/YzNcCj0oVy8Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

chamiso.sql

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\chamiso.sql
Size 36KB
SHA256 205643214e81608a874ea9ce959437cbeae2ca1f92221a113a2aaa2e3802e277
MD5 6bcc249ad4d750689bf56ca9467b4d06
SHA1 ac6af58e8b556f5c9b35c787b204172a949ee9f3
SHA512 5e6bfb766c80e4a6929c0eadec50874c224b335ff2f7d6ced2e24df62a1fe6e3d523389e2429ccec7f9f90174960185529adcae2af330b3076875577855644ea
SSDEEP 768:fqFb2tZmbtBW+XJEEWisWlfBPWZbH2kBN:iFKtZwWgQWLWZbWkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

torpor.zip

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\torpor.zip
Size 763KB
SHA256 62a15b4b84fa2b5419b9ae18c74484ec39f9196cf0ec431ee0c9bbaa319e259f
MD5 d69d7dc8442190f191396782a15ee277
SHA1 8421b70f78dd3204655edbc4ceeb240eef52b846
SHA512 b8744fe9016f3c6f1b722e1857f1fe61eb3c79d23d0d7be5a7d4cd562709f7b62c2e46fd4e226f65b061475b6dcdb8bd715ed72c358ce9eb9173f6c9cb28712d
SSDEEP 12288:CBXYp6Wv2aNk8rcAKSBK0/BCb/hxS9+WgH3iRSEABe8dF0QrX7yI1eOWZ6yX:9p28IvOCb5IrA3cZ8dF0QrryI6wyX
MD5 SHA1 SHA512 SSDEEP

Submit Download

wlessfp1.dll

Path C:\Users\Admin\AppData\Roaming\TpcDriverv1\wlessfp1.dll
Size 70KB
SHA256 fbd4b6011d3d1c2af22827ca548ba19669eef31173d496e75f064ef7a884431c
MD5 5120c44f241a12a3d5a3e87856477c13
SHA1 cd8a6ef728c48e17d570c8dc582ec49e17104f6d
SHA512 67c0e718368e950d42f007d6a21c6f903b084d6514f777b86aab3111ffe3be995949674276081c0281139a0b39119b84630a0ac341d4ae78677ac8346f371ae1
SSDEEP 1536:nEqYKdOEuqRKXd9ZWbIOinToIfYeyOgtPko:EqnB89ZouTBf5yOgtPko
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1020-66-0x0000000000D00000-0x0000000000D54000-memory.dmp

Download

memory/1020-65-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

Download

memory/1632-54-0x0000000076270000-0x00000000766AC000-memory.dmp

Download

memory/1632-51-0x0000000076270000-0x00000000766AC000-memory.dmp

Download

memory/1632-52-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

Download

memory/1632-53-0x0000000076282000-0x0000000076284000-memory.dmp

Download

memory/1632-46-0x0000000000A30000-0x0000000000A40000-memory.dmp

Download

memory/1632-55-0x0000000076270000-0x00000000766AC000-memory.dmp

Download

memory/2140-60-0x000000007627E000-0x0000000076280000-memory.dmp

Download

memory/2140-58-0x0000000076271000-0x000000007627F000-memory.dmp

Download

memory/2140-59-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

Download

memory/2140-61-0x0000000076271000-0x000000007627F000-memory.dmp

Download

memory/2140-64-0x0000000076271000-0x000000007627F000-memory.dmp

Download

memory/2140-68-0x000000007627E000-0x0000000076280000-memory.dmp

Download

memory/3960-2-0x0000000076270000-0x00000000766AC000-memory.dmp

Download

memory/3960-3-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

Download

memory/3960-1-0x0000000000AB0000-0x0000000000B3E000-memory.dmp

Download