lumma | 12ef3849fa5d882106fc29adf92c5a89871cc59bb6283f9a742d8f9928aa57d7

General

Target

AdminAFHDGDGIID.exe
Size

277KB
MD5

370e6b39022da68d978ba7cc78719bfb
SHA1

ba92d7255234cfe6960c0b67f2da06a443bb8139
SHA256

12ef3849fa5d882106fc29adf92c5a89871cc59bb6283f9a742d8f9928aa57d7
SHA512

54bc40b3b3de664f16d40ed1b896c5e618730377686bb346a281d7e404676348158241fa8cddbfe25b83042410ce8d235a1e9a12fc31eff41c699c0c70ee9941
SSDEEP

6144:CoogZsAxGdSzjRPAnz4lPZ7mxmR+nlPA6XlCk4ZnlMHEO:xoxAxGcz5AncdZ7me+VylMHEO

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

C2

https://interactiedovspm.shop/api

https://potentioallykeos.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2376 set thread context of 3052	2376	AdminAFHDGDGIID.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminAFHDGDGIID.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31
PID 2376 wrote to memory of 3052	2376	AdminAFHDGDGIID.exe	31

C:\Users\Admin\AppData\Local\Temp\AdminAFHDGDGIID.exe
"C:\Users\Admin\AppData\Local\Temp\AdminAFHDGDGIID.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3052

Network

DNS

interactiedovspm.shop

RegAsm.exe

Remote address:

8.8.8.8:53

Request

interactiedovspm.shop

IN A

Response

interactiedovspm.shop

IN A

172.67.161.217

interactiedovspm.shop

IN A

104.21.42.119
POST

https://interactiedovspm.shop/api

RegAsm.exe

Remote address:

172.67.161.217:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: interactiedovspm.shop

Response

HTTP/1.1 200 OK

Date: Thu, 22 Aug 2024 18:48:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=1mj3hkhjvj7imhron6vcr5ka2v; expires=Mon, 16-Dec-2024 12:35:01 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bnNKnCRUBH15WWzwRboCGz7cLy47mHkNdszlYNFYdRTx9UvUVNK2YjE6fMEE9TGflUqdOsWhAvBNQHBVQeGVHTC6p%2F6OxG5ClQ9uykihSHznxW69NkF2WuKCOysl5UB1%2B%2B0Rlk%2Bntmo%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8b75096119cacd16-LHR
alt-svc: h3=":443"; ma=86400
DNS

potentioallykeos.shop

RegAsm.exe

Remote address:

8.8.8.8:53

Request

potentioallykeos.shop

IN A

Response

potentioallykeos.shop

IN A

104.21.95.208

potentioallykeos.shop

IN A

172.67.148.102
DNS

potentioallykeos.shop

RegAsm.exe

Remote address:

8.8.8.8:53

Request

potentioallykeos.shop

IN A
POST

https://potentioallykeos.shop/api

RegAsm.exe

Remote address:

104.21.95.208:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: potentioallykeos.shop

Response

HTTP/1.1 200 OK

Date: Thu, 22 Aug 2024 18:48:25 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XBpMYdfENKeTFjliMCACnKQZqyuhNGZ7J%2BP4QVYYOghQcjchcuzyt3jQafqHQASgr%2FlMh%2BX8y%2BKApeSY1oBF419yq5USgmHx6qUowGilvo8L5gegtNdljzNOQSn3zMl08SeL5VKMgr0%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8b7509794a1a413f-LHR
POST

https://potentioallykeos.shop/api

RegAsm.exe

Remote address:

104.21.95.208:443

Request

POST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Cookie: __cf_mw_byp=gSG1QCg1J_5Rdgup4KDPVpiu7D8K2tAnEftgDEN5S6U-1724352505-0.0.1.1-/api
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 42
Host: potentioallykeos.shop

Response

HTTP/1.1 200 OK

Date: Thu, 22 Aug 2024 18:48:27 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=nbd66j8195dtifh7t1hc2m552q; expires=Mon, 16-Dec-2024 12:35:05 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NnxEPI3PyU1wtam7BP30Shcp%2B6FXoKe3eq03p0%2Fedf6Ht05jnzh53KlmG9IZAwMeTDl0QU0GN5b9tw3UZWFszdNrR92acbnTAaA630hjODFrgq9veQMiNCZMHbjPu8mUeMDwaKS7Aho%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8b75097fa9ef413f-LHR
alt-svc: h3=":443"; ma=86400

172.67.161.217:443

https://interactiedovspm.shop/api

tls, http

RegAsm.exe

1.1kB
5.2kB
11
11

HTTP Request

POST https://interactiedovspm.shop/api

HTTP Response

200
104.21.95.208:443

https://potentioallykeos.shop/api

tls, http

RegAsm.exe

2.7kB
9.7kB
20
17

HTTP Request

POST https://potentioallykeos.shop/api

HTTP Response

200

HTTP Request

POST https://potentioallykeos.shop/api

HTTP Response

200

8.8.8.8:53

interactiedovspm.shop

dns

RegAsm.exe

67 B
99 B
1
1

DNS Request

interactiedovspm.shop

DNS Response

172.67.161.217

104.21.42.119
8.8.8.8:53

potentioallykeos.shop

dns

RegAsm.exe

134 B
99 B
2
1

DNS Request

potentioallykeos.shop

DNS Request

potentioallykeos.shop

DNS Response

104.21.95.208

172.67.148.102

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

Filesize
4KB

Download
memory/2376-1-0x0000000000940000-0x000000000098A000-memory.dmp

Filesize
296KB

Download
memory/2376-13-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/3052-6-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3052-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3052-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3052-10-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3052-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3052-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3052-3-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3052-14-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3052-12-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3052-15-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.