lumma | c273ce5129fd202d8b7adc3bff93a8b7008c00196694f1d4be737759bd825223

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 283KB
Sample240820-azdzrsvblh
SHA256 4c143649b75ae0f7d7b5a0fd163b12c94e528c24260693a5771232a3ad847623
MD5 a3d72454d0ec9092053f3b3e50ef856f
SHA1 c446699a84dca2972c227fa84d9f6fd3725391cb
SHA512 c390dcd96da1d6b8ede760ec81e1ad8e8e0eae7fb7c10f247651b7daac301059f15fe9c8482067ff2f42ff9b1fd1bbbca8723d99e3165ceb3f3e8a17257838ab
SSDEEP 6144:U6mwC3SgaL2USd3d6aGFXnm/ZY52R1kMG7coyj3EO:UjhamdUFXnQK8MMIcoG3EO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://potentioallykeos.shop/api
https://interactiedovspm.shop/api
https://charecteristicdxp.shop/api
https://cagedwifedsozm.shop/api
https://deicedosmzj.shop/api
https://southedhiscuso.shop/api
https://consciousourwi.shop/api
https://tenntysjuxmz.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3832 set thread context of 4764	3832	Loader.exe	92

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4764	3832	Loader.exe	92
PID 3832 wrote to memory of 4764	3832	Loader.exe	92
PID 3832 wrote to memory of 4764	3832	Loader.exe	92
PID 3832 wrote to memory of 4764	3832	Loader.exe	92
PID 3832 wrote to memory of 4764	3832	Loader.exe	92
PID 3832 wrote to memory of 4764	3832	Loader.exe	92
PID 3832 wrote to memory of 4764	3832	Loader.exe	92
PID 3832 wrote to memory of 4764	3832	Loader.exe	92
PID 3832 wrote to memory of 4764	3832	Loader.exe	92

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3708,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:8
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3832-0-0x000000007448E000-0x000000007448F000-memory.dmp

Download

memory/3832-1-0x0000000000DC0000-0x0000000000E0A000-memory.dmp

Download

memory/3832-7-0x0000000074480000-0x0000000074C30000-memory.dmp

Download

memory/3832-9-0x0000000074480000-0x0000000074C30000-memory.dmp

Download

memory/4764-3-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4764-6-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4764-8-0x0000000000400000-0x000000000044E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads