lumma | ade756d0226cb83732da91e85456c095fdc355b75879cd68cc92d6da2efe71a3

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Set-up.exe
Size 2.7MB
Sample240707-kdfataxglm
SHA256 bbf7154f14d736f0c8491fb9fb44d2f179cdb02d34ab54c04466fa0702ea7d55
MD5 870feaab725b148208dd12ffabe33f9d
SHA1 9f3651ad5725848c880c24f8e749205a7e1e78c1
SHA512 5bea301f85e6a55fd5730793b960442bc4dab92d0bf47e4e55c5490448a4a22ed6d0feb1dbe9d56d6b6ff8d06f163381807f83f467621f527bc6521857fc8e1a
SSDEEP 49152:C11fbWXfBeBqTww8Gkfoa0yeL8zj9JLF+lP/MatsfHVnZbhG3EVsMI62Pseaj/1n:QbWkuwwjkULhlPUatsfBxhsE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

lumma

https://bittercoldzzdwu.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
4532	Eq.au3

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5040 set thread context of 4936	5040	Set-up.exe	84

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5040	Set-up.exe
5040	Set-up.exe
4936	netsh.exe
4936	netsh.exe
4532	Eq.au3
4532	Eq.au3
4532	Eq.au3
4532	Eq.au3

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5040	Set-up.exe
4936	netsh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4936	5040	Set-up.exe	84
PID 5040 wrote to memory of 4936	5040	Set-up.exe	84
PID 5040 wrote to memory of 4936	5040	Set-up.exe	84
PID 5040 wrote to memory of 4936	5040	Set-up.exe	84
PID 4936 wrote to memory of 4532	4936	netsh.exe	86
PID 4936 wrote to memory of 4532	4936	netsh.exe	86
PID 4936 wrote to memory of 4532	4936	netsh.exe	86
PID 4936 wrote to memory of 4532	4936	netsh.exe	86

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Users\Admin\AppData\Local\Temp\Eq.au3
    C:\Users\Admin\AppData\Local\Temp\Eq.au3
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Eq.au3

Path C:\Users\Admin\AppData\Local\Temp\Eq.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

f1a53a9d

Path C:\Users\Admin\AppData\Local\Temp\f1a53a9d
Size 1.8MB
SHA256 bb4f97bf4708ceda281ab9a77489917a1e4c14210732eb3ac5bfd23f1960ade5
MD5 e4015f7005130ba21e917b6415b5aae6
SHA1 88891c1e25a2918c8b58235380f6b6b7769a5618
SHA512 7e3d8647cca9f8af146b5c9775c2fcaa3f742f497c81b7adaaa51b586f0b4c09ebd91413241477ffcc2156700f7710c9769675b7949ac2e056552733e875246c
SSDEEP 49152:zK/5nDHOpKo01qV8qxUSolRlbmnx1RAk3i3Kl:qwpKhququNmnx1RAEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4532-23-0x00000000004C0000-0x0000000000517000-memory.dmp

Download

memory/4532-22-0x0000000000887000-0x000000000088F000-memory.dmp

Download

memory/4532-20-0x00000000004C0000-0x0000000000517000-memory.dmp

Download

memory/4532-19-0x00007FFFDBDD0000-0x00007FFFDBFC5000-memory.dmp

Download

memory/4936-15-0x0000000075041000-0x000000007504F000-memory.dmp

Download

memory/4936-12-0x00007FFFDBDD0000-0x00007FFFDBFC5000-memory.dmp

Download

memory/4936-14-0x000000007504E000-0x0000000075050000-memory.dmp

Download

memory/4936-17-0x0000000075041000-0x000000007504F000-memory.dmp

Download

memory/4936-10-0x0000000075041000-0x000000007504F000-memory.dmp

Download

memory/4936-24-0x000000007504E000-0x0000000075050000-memory.dmp

Download

memory/5040-0-0x0000000075040000-0x0000000075054000-memory.dmp

Download

memory/5040-7-0x0000000075040000-0x0000000075054000-memory.dmp

Download

memory/5040-6-0x0000000075040000-0x0000000075054000-memory.dmp

Download

memory/5040-5-0x0000000075052000-0x0000000075054000-memory.dmp

Download

memory/5040-1-0x00007FFFDBDD0000-0x00007FFFDBFC5000-memory.dmp

Download