lumma | 2083c6d2ab049f21c15cf93b454b833f25d5d3aad20357f5e2488cfb838b13f5

General

Target
196b9c8e00d11c72d276a4b9654dd3f5.exe
Size 6.3MB
Sample240801-jvevyazfpm
SHA256 2083c6d2ab049f21c15cf93b454b833f25d5d3aad20357f5e2488cfb838b13f5
MD5 196b9c8e00d11c72d276a4b9654dd3f5
SHA1 c2451b97efe9692f88d1780e65b8d50af3ac8691
SHA512 2d8a2da0074028885f6fd3501a553848806c04a695fae97326e8f74f32d978b360d09eb4a7290bdce3edb4883c431d64607e6831cce81a611d910723b1891239
SSDEEP 98304:6qwtqwQR4XsSjvdnspWEs+hqh+3EtEXA227QpFZd182H4eDP9IIWwILk:6qwtqw/skCWERUh+3EKXAVKo2HzLWwIw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery stealer vmprotect

Malware Config

Extracted

Family

lumma

C2

https://demandlinzei.shop/api
https://applyzxcksdia.shop/api
https://replacedoxcjzp.shop/api
https://declaredczxi.shop/api
https://catchddkxozvp.shop/api
https://arriveoxpzxo.shop/api
https://contemplateodszsv.shop/api
https://bindceasdiwozx.shop/api
https://conformfucdioz.shop/api

Extracted

Family

lumma

C2

https://demandlinzei.shop/api
https://applyzxcksdia.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\Control Panel\International\Geo\Nation	196b9c8e00d11c72d276a4b9654dd3f5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-113082768-653872390-2867000172-1000\Control Panel\International\Geo\Nation	clamer.exe

Executes dropped EXE 2 IoCs

pid	Process
3844	clamer.exe
4128	kltohd.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0008000000023517-14.dat	vmprotect
behavioral2/memory/4128-20-0x0000000000230000-0x0000000000B2D000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2952	4128	WerFault.exe	90
3152	4128	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kltohd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4128	kltohd.exe
4128	kltohd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2592	1416	196b9c8e00d11c72d276a4b9654dd3f5.exe	85
PID 1416 wrote to memory of 2592	1416	196b9c8e00d11c72d276a4b9654dd3f5.exe	85
PID 2592 wrote to memory of 3844	2592	cmd.exe	88
PID 2592 wrote to memory of 3844	2592	cmd.exe	88
PID 3844 wrote to memory of 4128	3844	clamer.exe	90
PID 3844 wrote to memory of 4128	3844	clamer.exe	90
PID 3844 wrote to memory of 4128	3844	clamer.exe	90

C:\Users\Admin\AppData\Local\Temp\196b9c8e00d11c72d276a4b9654dd3f5.exe
"C:\Users\Admin\AppData\Local\Temp\196b9c8e00d11c72d276a4b9654dd3f5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
    clamer.exe -priverdD
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\kltohd.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\kltohd.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4128
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 1148
        5⤵
        Program crash
        
        PID:2952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 1108
        5⤵
        Program crash
        
        PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4128 -ip 4128
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4128 -ip 4128
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
Size 37B
SHA256 bb8582ce28db923f243c8d7a3f2eccb0ed25930f5b5c94133af8eefb57a8231d
MD5 28151380c82f5de81c1323171201e013
SHA1 ae515d813ba2b17c8c5ebdae196663dc81c26d3c
SHA512 46b29cba0dc813de0c58d2d83dc298fa677921fd1f19f41e2ed3c7909c497fab2236d10a9ae59b3f38e49cf167964ede45e15543673a1e0843266242b8e26253
MD5 SHA1 SHA512

Submit Download

clamer.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
Size 5.9MB
SHA256 693473170c237e101fe5527c3c761e0e4aa3fbd7d3d929140db0022e8392d10a
MD5 79ed577078e35b20048d48f84199319f
SHA1 1783d4bc95e698557f9ceac81653ad8e2cf408d5
SHA512 bf3560a66398552f7b7d212d6701515c1bad89769dd221d504ba26674aec27cda75fee6d932fa034563b2cf1eef2407d4994109b7129c67bb375618138c2923a
SSDEEP 98304:ZqwQR4XsSjvdnspWEs+hqh+3EtEXA227QpFZd182H4eDP9IIWwILz:Zqw/skCWERUh+3EKXAVKo2HzLWwI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kltohd.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\kltohd.exe
Size 5.5MB
SHA256 72b84b2530ad63c4e9ab9f8169eeb5f6ec06d3fa46905fa4e97a657585735635
MD5 47ac93b9c8c443a977217b9e6c2731c8
SHA1 083f0e7fc9b440db7e45e2f7bf4eb6e5b86334d8
SHA512 3187f833772e326b7e502600c3e6546014a3bdd37e72de85fa1f83866d816c9f65e160f098c9a15df7828b66f34445c5862f037bd60bfae0989c2f16ae6fce77
SSDEEP 98304:xguJ7n8zi1toIYc/zXVxOOFWW0lAM63vtGou9Addh+93KXSVwHX:2c8zAoIYAXXOXl/wGouSBsaQw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4128-19-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/4128-20-0x0000000000230000-0x0000000000B2D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads