lumma | 14fa452afcc4ff5ee00c88e603f670af754af1f8d0f53ae7cbaaa4b8c44afe1d

General

Target

x86_64-win64-ranlib.rar
Size

101.6MB
MD5

360e220a0ad7d7771381380291d1fdca
SHA1

8540aff3ff35c33a3537da15d7f59c87dbf367d6
SHA256

14fa452afcc4ff5ee00c88e603f670af754af1f8d0f53ae7cbaaa4b8c44afe1d
SHA512

0dc66bbcfdc3beb5f091c7f8fddf1148c89f98cd5ee177e1d7b4774ca224d6667e3fb8b14e0a198b3f6cfc8f27f1396cc4758db1852a25d0d72df17cb6ba8eee
SSDEEP

3145728:UMqnPiVuViUkukCc63AwWkFb6xuMPPXhz:ULnS0dkuk7ukuePh

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

C2

https://racklilekwqp.shop/api

https://locatedblsoqp.shop/api

https://traineiwnqo.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

Processes:

win64.exe

pid	Process
1052	win64.exe

Loads dropped DLL 1 IoCs

Processes:

win64.exe

pid	Process
1052	win64.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

win64.exe

description	pid	Process	procid_target
PID 1052 set thread context of 3276	1052	win64.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
920	3276	WerFault.exe	108
3396	3276	WerFault.exe	108

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

win64.exeaspnet_regiis.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Modifies registry class 3 IoCs

Processes:

cmd.exeOpenWith.exeOpenWith.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zG.exe

description	pid	Process
Token: SeRestorePrivilege	4676	7zG.exe
Token: 35	4676	7zG.exe
Token: SeSecurityPrivilege	4676	7zG.exe
Token: SeSecurityPrivilege	4676	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid	Process
4676	7zG.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

OpenWith.exeOpenWith.exe

pid	Process
4856	OpenWith.exe
2752	OpenWith.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

win64.exe

description	pid	Process	procid_target
PID 1052 wrote to memory of 3276	1052	win64.exe	108
PID 1052 wrote to memory of 3276	1052	win64.exe	108
PID 1052 wrote to memory of 3276	1052	win64.exe	108
PID 1052 wrote to memory of 3276	1052	win64.exe	108
PID 1052 wrote to memory of 3276	1052	win64.exe	108
PID 1052 wrote to memory of 3276	1052	win64.exe	108
PID 1052 wrote to memory of 3276	1052	win64.exe	108
PID 1052 wrote to memory of 3276	1052	win64.exe	108
PID 1052 wrote to memory of 3276	1052	win64.exe	108

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x86_64-win64-ranlib.rar
1⤵
- Modifies registry class
PID:436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2752

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\x86_64-win64-ranlib\" -spe -an -ai#7zMap22102:118:7zEvent2663
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4676

C:\Users\Admin\AppData\Local\Temp\x86_64-win64-ranlib\win64.exe
"C:\Users\Admin\AppData\Local\Temp\x86_64-win64-ranlib\win64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1188
    3⤵
    - Program crash
    PID:920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1228
    3⤵
    - Program crash
    PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3276 -ip 3276
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3276 -ip 3276
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\x86_64-win64-ranlib\msvcp140.dll

Filesize
482KB

MD5
cb452ff0e3988a8c7fb41688ec781075

SHA1
b290b4abf85e9ea8e936074af87a80a46a428d82

SHA256
c0afba25a5bee7ede2e6613ee37cc06798eaa01db001818c8f170da140deab7c

SHA512
49df21c1362bdb12b908a2c8fbd9e4b671f32cd6505bc799500a831387c7c8bf302862dc003f7ebdd6d7b11f980bed2d28f5f7ac30550786af712f9336c98ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\x86_64-win64-ranlib\win64.exe

Filesize
269KB

MD5
2f09c68b10b5408c90e7c1a3cc6acb30

SHA1
3cfcca38337c19e8f9d0468153461a3dbb3fbab9

SHA256
d4b670521fe8171afb54639e2ee31ae5d2474f2f4003e5535fe2cd4fa8d59163

SHA512
f964a0aa40da7b6e470e8326b0f0ee50023e7ff4c2a9752e8ba2aefedddc3ee8ad3db69e350644aeddbfbe2768a8cb3e0898083e7901ed965b1927bdf61d85cf

Download Submit
C:\Users\Admin\AppData\Roaming\d3d9x.dll

Filesize
482KB

MD5
527215990a163859c5839bcb63c33939

SHA1
85a5d60cbbf4e9711886dc45a31e99c9bbc826ca

SHA256
9ff423e7e4032403d5edebd04950241bdeb393ea8d0a528aabd990a5f21ef9e6

SHA512
7730558b4476144891d090091d001f734866314d6006ffc464adcaa7c616fade623a4da0e061d15fc71c7b487b0247c469009d2bc6e24cff2c57c7b96cfe24cc

Download Submit
memory/3276-83-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3276-84-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads