lumma | b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe
Size

1.4MB
MD5

0885bc5d9c2aa1895ebd5fcad13b53be
SHA1

ad559563e4e21cb7354a4692b31852839b0b22d7
SHA256

b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25
SHA512

91c73e9a3a74624dad400c0c5b7670b977946a06344782ca859be70578e64c2f0d4fdb3eadb70821168c64929a8bfe16a18fb10ba65bcd80e14701ef8c05091f
SSDEEP

24576:2FhvDaw/UXpu2f0yreRvqD5a7cMszShDAIB4aaz39hx2xa3243f:4hv+w4PzeRvr7cM8ShLWaaz392xD43f

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://femininedspzmhu.shop/api

https://locatedblsoqp.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe

Deletes itself 1 IoCs

pid	Process
3316	Associates.pif

Executes dropped EXE 2 IoCs

pid	Process
3316	Associates.pif
3220	Associates.pif

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1064	tasklist.exe
1328	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3316 set thread context of 3220	3316	Associates.pif	104

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MaximizeRepresentative	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe
File opened for modification	C:\Windows\ChristmasHerbal	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe
File opened for modification	C:\Windows\LadySquare	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe
File opened for modification	C:\Windows\PrerequisiteCents	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe
File opened for modification	C:\Windows\ChipsCounted	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1664	3220	WerFault.exe	104
2972	3220	WerFault.exe	104
2780	3220	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Associates.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Associates.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	tasklist.exe
Token: SeDebugPrivilege	1328	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3316	Associates.pif
3316	Associates.pif
3316	Associates.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4148	2512	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe	85
PID 2512 wrote to memory of 4148	2512	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe	85
PID 2512 wrote to memory of 4148	2512	b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe	85
PID 4148 wrote to memory of 1064	4148	cmd.exe	88
PID 4148 wrote to memory of 1064	4148	cmd.exe	88
PID 4148 wrote to memory of 1064	4148	cmd.exe	88
PID 4148 wrote to memory of 3544	4148	cmd.exe	89
PID 4148 wrote to memory of 3544	4148	cmd.exe	89
PID 4148 wrote to memory of 3544	4148	cmd.exe	89
PID 4148 wrote to memory of 1328	4148	cmd.exe	91
PID 4148 wrote to memory of 1328	4148	cmd.exe	91
PID 4148 wrote to memory of 1328	4148	cmd.exe	91
PID 4148 wrote to memory of 3724	4148	cmd.exe	92
PID 4148 wrote to memory of 3724	4148	cmd.exe	92
PID 4148 wrote to memory of 3724	4148	cmd.exe	92
PID 4148 wrote to memory of 4140	4148	cmd.exe	93
PID 4148 wrote to memory of 4140	4148	cmd.exe	93
PID 4148 wrote to memory of 4140	4148	cmd.exe	93
PID 4148 wrote to memory of 5044	4148	cmd.exe	94
PID 4148 wrote to memory of 5044	4148	cmd.exe	94
PID 4148 wrote to memory of 5044	4148	cmd.exe	94
PID 4148 wrote to memory of 2072	4148	cmd.exe	95
PID 4148 wrote to memory of 2072	4148	cmd.exe	95
PID 4148 wrote to memory of 2072	4148	cmd.exe	95
PID 4148 wrote to memory of 3316	4148	cmd.exe	96
PID 4148 wrote to memory of 3316	4148	cmd.exe	96
PID 4148 wrote to memory of 3316	4148	cmd.exe	96
PID 4148 wrote to memory of 4200	4148	cmd.exe	97
PID 4148 wrote to memory of 4200	4148	cmd.exe	97
PID 4148 wrote to memory of 4200	4148	cmd.exe	97
PID 3316 wrote to memory of 3220	3316	Associates.pif	104
PID 3316 wrote to memory of 3220	3316	Associates.pif	104
PID 3316 wrote to memory of 3220	3316	Associates.pif	104
PID 3316 wrote to memory of 3220	3316	Associates.pif	104
PID 3316 wrote to memory of 3220	3316	Associates.pif	104

C:\Users\Admin\AppData\Local\Temp\b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe
"C:\Users\Admin\AppData\Local\Temp\b7763f18a43e9727036d685576fe102901f45fd1b9407395bbc10966a9811d25.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Investigations Investigations.bat & Investigations.bat & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3544
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 590819
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4140
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "MEDICAIDGROUPSSHARPGOVERNOR" Novels
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Sheet + ..\Drums + ..\Actually + ..\Mls + ..\Real + ..\Zoophilia + ..\Ah + ..\Opposed + ..\Affiliated y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif
    Associates.pif y
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif
      C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1136
        5⤵
        Program crash
        
        PID:2972
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1160
        5⤵
        Program crash
        
        PID:1664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 1160
        5⤵
        Program crash
        
        PID:2780
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 3220 -ip 3220
1⤵
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3220 -ip 3220
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3220 -ip 3220
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\590819\Associates.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
C:\Users\Admin\AppData\Local\Temp\590819\y

Filesize
647KB

MD5
0e69e7ffa036b111a3714e8ba7de2503

SHA1
67f7153234105690f026d671091774e04d34c351

SHA256
7411e4d7b5ee7e09d6d8f41b6c58d557b39724cda3367614d49dbaf77ff89d47

SHA512
a16a095735f978f9fa41060bca6cbd3331edb7612ea671497fa9ad950ee5e438aeeb1c96ffbd9cd7b4c22d3bb33b6f60d911c30997932b8310e0995a48fc7270

Download Submit
C:\Users\Admin\AppData\Local\Temp\Actually

Filesize
82KB

MD5
f5218581f47d5d88efb244c2528e9388

SHA1
2c925494f15dd8854b0ff25292e64dba075afc8a

SHA256
446596953913b5ff8e1f4909cdd68e4740a21948b8da28b2223abd731f38f3cf

SHA512
16f7b5fb8dfb306be93036697ad4b18679b6bdcf9b936e3b4ede15c39a80901a2244b7854c9beeab0a8cf25df2c106d127d8977523b54140ac75a241e823720a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Affiliated

Filesize
13KB

MD5
5a4bb3b58f5344ea0b6ac99794a1a409

SHA1
956ac766f4faf5a8fe38b2fa11fd64832b588ea6

SHA256
3f6a1e674de512477ff87efaa39a6d0158f1a394da442018f2cae16499a67164

SHA512
06460ab54d087095ae5c925f5826aaf23a1012a0dad8ff50615ab9d7bc3851aa794d826d883269717484aac4686f0263c284c27986e5440eaae2c371afa76561

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ah

Filesize
78KB

MD5
fdec53e5fc2b73fc6f3f2cebc7e7d581

SHA1
32be33cddaf6888589e6f579ba74553e682cb05d

SHA256
2c846b30ded9be840eb62fe5f6ee78a715bbb27c8c5f13cf7ce7526fd8505278

SHA512
373b289677a94955293f0a6cdfcea1c45f11034c939e5e8eee4a4e28cc3e3e12a5eff9e9d1fa1360e3e2ffd9b452428f3b62621133a3eb7386437840c1c9efd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Drums

Filesize
87KB

MD5
eddfe1bd56d718737082e26b663c5344

SHA1
19751b4253e62d8995fbf7c16686aa9a78045091

SHA256
06969d045e1dedd05bf352e08e66d6b72faca7b0d6cb7a20e3a815b04aec4794

SHA512
d6b8dc233eca6cd4dd8ecda267e80096e152840acd4e47ea8ab0c081fa37e17ad4aa507882aee7bb8e70000fdb46905726243e14d02987440386c1fcd9c3d8db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Investigations

Filesize
21KB

MD5
993e7c77985a64987f81795903f4ec4e

SHA1
9daf8b58d2aea92416b4b26d4a8c644bff2c1073

SHA256
18aedca1669442af85f543f052feef6b2d70ee3f191f391930c053d1476cda76

SHA512
26d2518beb0716227cacb6e5f89643b3a8ea7a095dbe741873e274fbb18de4da335dc99ca01951a7db448e5ddc29c85af895ec57f9378cec9851815648d83a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mls

Filesize
86KB

MD5
f387e0af272b3534f962510925697544

SHA1
2e5fddc860f180d204283ae3d8b7479a73edb7dd

SHA256
076a4be5c1e943bc223adf4eb30f7543911dce2517c305af1df5f0ab012626e0

SHA512
3326c69a65fc163eecf95950cfffbcca800b85c9ba99da3c921c1e54c9bd116f87302a52dade84a8af957d6182db6973e67a02359fd7c8c317c4329e511ec3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Novels

Filesize
510B

MD5
fe6b3945c0591e11b27ce50ae5aa2ae5

SHA1
42eb0951d03f96f1be9dfd7fd3c76366c7dee311

SHA256
2dd13bc773aee2738563910e316684b0cf646991fd67581dd4e129a525153af0

SHA512
adff777db68feed90a6c5de04abf23e2b17f4b0bc9fd0e99cf10773ad159cf4e3cfc82f1bba9799c8e73dea613d392261e8c8be46174d0ce51672492eb6ad3f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opposed

Filesize
89KB

MD5
79e8c0f3c8585392970467fba71bdc5c

SHA1
43871ae11904c036fd72e5452274b6dd33e6e4ce

SHA256
c8497414d50438b6eeace3a0402f01e7d8583415daee5466f3f46ac82e55c27f

SHA512
c9b52232b1b416e2d1fc9a2cc28089748f1f27fdd06bd441e1434f665d8422c6161d5fc4148ce3edb20a6106eace041eb819fe2b962fc7411e03994549b27816

Download Submit
C:\Users\Admin\AppData\Local\Temp\Real

Filesize
74KB

MD5
000b4fa86996cb0beda88a400f07f96f

SHA1
30167f5da3bfb8f99973e347f5548325c8821954

SHA256
2be9420210278b027501f7edb4e8356b00550eb01d94aab082b472fab08dc5c3

SHA512
b483f78ae03c5fd2ec95a8599a676bde4096d710b51e486db68bb8fb3180a478b2536abac9ab54b733867705cfcac7fc16eb8d34cc519fcd6756b131fdb7183e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sheet

Filesize
64KB

MD5
a333bb92009ef81ed7e36eb059292f7c

SHA1
bd95783b66230cbbdd65668a99dbe2aaa7bf6dff

SHA256
0241ad4bc5a549ba937fc9cde1cc4e8c01bc0ac59940611393bd2573649bc391

SHA512
3f5cf884e21d3cdabcf3cd292cdead32d521ccc9ddefedb91f88ba89d903baaa7c89b21d0992a451e6b63a7632bdb92c3ee27adddd3c69d6e9fc97b2bf04ec9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tba

Filesize
872KB

MD5
02dfbccdf45d9f79a8e3b9eadc7c66d2

SHA1
00e7fdbb4466c86ca5dc6cf05623cccf52cce76c

SHA256
ca236e42a79212c9fcab28217df569fc8d3875ef81e206e869b92525d9ede547

SHA512
dc5d3fcc04b1d2b8fad3bd824b899f9a58bed18a708cb3df70c0822ae493dc6ba6f04bd3b57e049e749ea64c21fcd7f78c75b1c6330f0cdde6f70d7b1beb5df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zoophilia

Filesize
74KB

MD5
bbb3a963db3a77c65e1419c6bb3c9992

SHA1
1fee713d2465910ae9740bfea48a471984ba0b54

SHA256
1a4c358cb704b6d3960e9af1dce1b87aa69e41ce590f1477f5d7ef9dd8ddeeec

SHA512
980e8898090779eeb14a27af28239656b219e2ef50275914d98757c368c5878b0bfe5ffa0b102f67fdeecfb618cd857566c67c392eb09538db492e9c5dd738a3

Download Submit
memory/3220-32-0x0000000001040000-0x0000000001092000-memory.dmp

Filesize
328KB

Download
memory/3220-33-0x0000000001040000-0x0000000001092000-memory.dmp

Filesize
328KB

Download
memory/3220-35-0x0000000001040000-0x0000000001092000-memory.dmp

Filesize
328KB

Download