lumma | 0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2024, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7.exe
Size 1.5MB
Sample240910-h5425stbmd
SHA256 0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7
MD5 e03f6d8f05428a28951934f2118be06f
SHA1 cc3b12d142e11b594b02db46614046d277d14b05
SHA512 5742cb103e8e4e41fcfb101cac251363b0f3dfa1252d5e9f7a13b06c455fe3b9899f7f2931594c5f3591f844d506e41e1810800975a33034c39b63056bba3cca
SSDEEP 24576:BzZeqRhXkCkHesZojy1AT895kAdXjjUjHgl2fPOM3OfVUAqSjYlfzj:BgqRhXkCvsmN84ej4jAl2fPOM3OfVUAo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://deaddynpangju.shop/api
https://tenntysjuxmz.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7.exe

Executes dropped EXE 2 IoCs

pid	Process
2956	Sacred.pif
1360	Sacred.pif

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5000	tasklist.exe
676	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2956 set thread context of 1360	2956	Sacred.pif	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sacred.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sacred.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	tasklist.exe
Token: SeDebugPrivilege	5000	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2956	Sacred.pif
2956	Sacred.pif
2956	Sacred.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 2268	3848	0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7.exe	86
PID 3848 wrote to memory of 2268	3848	0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7.exe	86
PID 3848 wrote to memory of 2268	3848	0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7.exe	86
PID 2268 wrote to memory of 676	2268	cmd.exe	90
PID 2268 wrote to memory of 676	2268	cmd.exe	90
PID 2268 wrote to memory of 676	2268	cmd.exe	90
PID 2268 wrote to memory of 224	2268	cmd.exe	91
PID 2268 wrote to memory of 224	2268	cmd.exe	91
PID 2268 wrote to memory of 224	2268	cmd.exe	91
PID 2268 wrote to memory of 5000	2268	cmd.exe	94
PID 2268 wrote to memory of 5000	2268	cmd.exe	94
PID 2268 wrote to memory of 5000	2268	cmd.exe	94
PID 2268 wrote to memory of 2668	2268	cmd.exe	95
PID 2268 wrote to memory of 2668	2268	cmd.exe	95
PID 2268 wrote to memory of 2668	2268	cmd.exe	95
PID 2268 wrote to memory of 4636	2268	cmd.exe	96
PID 2268 wrote to memory of 4636	2268	cmd.exe	96
PID 2268 wrote to memory of 4636	2268	cmd.exe	96
PID 2268 wrote to memory of 1552	2268	cmd.exe	97
PID 2268 wrote to memory of 1552	2268	cmd.exe	97
PID 2268 wrote to memory of 1552	2268	cmd.exe	97
PID 2268 wrote to memory of 2112	2268	cmd.exe	98
PID 2268 wrote to memory of 2112	2268	cmd.exe	98
PID 2268 wrote to memory of 2112	2268	cmd.exe	98
PID 2268 wrote to memory of 2956	2268	cmd.exe	99
PID 2268 wrote to memory of 2956	2268	cmd.exe	99
PID 2268 wrote to memory of 2956	2268	cmd.exe	99
PID 2268 wrote to memory of 4804	2268	cmd.exe	100
PID 2268 wrote to memory of 4804	2268	cmd.exe	100
PID 2268 wrote to memory of 4804	2268	cmd.exe	100
PID 2956 wrote to memory of 1360	2956	Sacred.pif	104
PID 2956 wrote to memory of 1360	2956	Sacred.pif	104
PID 2956 wrote to memory of 1360	2956	Sacred.pif	104
PID 2956 wrote to memory of 1360	2956	Sacred.pif	104
PID 2956 wrote to memory of 1360	2956	Sacred.pif	104

C:\Users\Admin\AppData\Local\Temp\0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7.exe
"C:\Users\Admin\AppData\Local\Temp\0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k move Scroll Scroll.bat & Scroll.bat & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa.exe opssvc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:224
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 693222
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "CREATESSPIESLANESCOVERAGE" Promptly
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Athletic + ..\Tiffany + ..\Planners + ..\Migration + ..\Fda + ..\Original + ..\Psychiatry + ..\Sign x
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\693222\Sacred.pif
    Sacred.pif x
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\693222\Sacred.pif
      C:\Users\Admin\AppData\Local\Temp\693222\Sacred.pif
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1360
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sacred.pif

Path C:\Users\Admin\AppData\Local\Temp\693222\Sacred.pif
Size 872KB
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
SSDEEP 12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\693222\x
Size 612KB
SHA256 82e6f07e6fdad84f2f4e5bc83aa37e741257891eb01bd7b7d77f1efdecc57a86
MD5 8cd637a84380ee9e14f6fa4ee9a67f02
SHA1 431ada09e9bd4c2770e4b6a078acb8b10a12b13b
SHA512 975695a8990f992492a604c988172f880d202c554a182d3f5164bdfe307e1feb3e009e9f8ef9723e1ceac7dc1ea9a15d6462556a6589ed4114cc4d1c52f4df79
SSDEEP 12288:OUGIqjTJY2VPNmzPItNDtfafu0de/8gn2UjLeT8EKdk9C8:OUVqjTy2VYkXDgfu0dej2UjyT89dkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Athletic

Path C:\Users\Admin\AppData\Local\Temp\Athletic
Size 85KB
SHA256 fdef9a737ea13303c52d363069966a498becf83002926d1e18d66e2c8bf4925f
MD5 fa1a1bffad89ba99e557ef3f14f8b434
SHA1 fe92a6ddf9c9cc449daa538211cf97e32a031567
SHA512 28d6ecab78da56e53fdd6455d4dfbe19bfd7c3c42a1ed2a0e2c1f9b1470e9e866af5c501d1d5b28fd9ca85f61e1c32e6d9d9d1f54ddc7a2baf02f29971c3a871
SSDEEP 1536:PGxvfGiQpudXiLhV4eCnJhxRP8aaAmY7Ji8O0e24/Eo5C6+3vRQM6xpyGastmM:O9fGj0xiLhVQPgAV7JiruCECpUscM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fda

Path C:\Users\Admin\AppData\Local\Temp\Fda
Size 73KB
SHA256 31e034fbfedb2aba6df39857508417d35d826d025ec72cff275e8636c5519cfc
MD5 97f84a8199cd8d22a6c52b260ec6a9dc
SHA1 35b84d12060bcf7c90180668ad73c8bc2ee00714
SHA512 d514ece1166f631b937ff3834e3494d6d2740f4d2531af48fdb164cae195a5dd2574e82c878f148ef3231b26ab6f04c0908d26fce30b855ef9c8b30911ed9c8b
SSDEEP 1536:Kf70O4WleTPyE6omIzelHPFk5t/RuYC9SRmmBkUnIJTUj:dXEcTmIzelvFAt/s6k2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Migration

Path C:\Users\Admin\AppData\Local\Temp\Migration
Size 54KB
SHA256 1818da271ac9c09f9b1381e5466788a2c5e81980b6d7a363719411c0ef95c710
MD5 c3ff39a820b095f1036732c9f9f5e529
SHA1 f841444905bbe0a917563c0519ef54f349efc60e
SHA512 1685aa79d8e73a89447e35b308a2be334b3ecd0f796ed6abdb7765d9256af18e50579b73f182d5b3c37019bff430f3b58702e29ff9c0f5d57d73f0eb37850839
SSDEEP 1536:In96esB2AcKVHbAm+70Vsz9b+NedqnsmDBC6Xu7FS:In96es1nh+o2b+NJnsmN5upS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Original

Path C:\Users\Admin\AppData\Local\Temp\Original
Size 65KB
SHA256 5082eb3c3839c43be41f50f764324ce0b2c238ad4bd8a5f12b0c1b95249a6cb9
MD5 1ec61d8c9f2173fda3922709c6c28aa0
SHA1 78dc9242cfb14427547732f59a4fbad34072bf7c
SHA512 cbf4861cae8c237085cf0dc007f165d62c38ea2459f67a83bfbf7d8f3ee7794564887a9cea24bd62a3d0eab53a6625ca3a38d647afb465c53f1a2c0cd3003412
SSDEEP 1536:Orw1JogO67k0nAFmZx6WmVQvynGcxurWYiwUaBXYPz+Egm:mwUgO6mFoyG0YhUaW2m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Planners

Path C:\Users\Admin\AppData\Local\Temp\Planners
Size 76KB
SHA256 1531d2f93fbcb5de961e27048eb2a44524f47e7dce3abcea66a627642862c763
MD5 90d0b360f8834a336569ccf25632ed62
SHA1 7dbcb1888e21d07d107257cb0128b0a1a66c9ea2
SHA512 55cb35e23f49d2ce5027143a5bbd939fedaa6b7c89a694a2fc78561f3e708f35d198e86ca273c019578e7260c83d5442d4e385c09404e2b126154c1a039914a6
SSDEEP 1536:vlGVmhU49R4A/hcY8hfKe+tTqLCsAo+7wy3OmzToBZrxGBVsCfnM:dGVu9R46h0hCe+Bqus8wyemz8mNfM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Promptly

Path C:\Users\Admin\AppData\Local\Temp\Promptly
Size 374B
SHA256 42c909e6ff262ba163f404e312aff29ba0361877989f876fc592f17d7c6611a7
MD5 57282fc70eb2c87058faae36af309b46
SHA1 9b4894235497f9d07143c2ff744538859426a9af
SHA512 c6f3123c96bc14855158368c6fdde94919235df9ef64025bcfaf44f334d1d18c3ef31bc33c44429934c7eec330dcf3a77ca265a8ba246ea89b74883673ffc319
MD5 SHA1 SHA512

Submit Download

Psychiatry

Path C:\Users\Admin\AppData\Local\Temp\Psychiatry
Size 95KB
SHA256 a31d20b8c479b69330913c551f041ba847770924bcee90150a9bee18c7b96f7f
MD5 b224d06ed5809bd9c4000c43afb53164
SHA1 76f76b783b6bf6dde494e2b2052be96b74c441bc
SHA512 d0df35e37dc5c72130d138cfc7920a203dcca70f66d19abf781d7573f14bbb5fe4acc22400afe1dfdbf0ed0ad2a015f3edd0d3c3129bce6042cf936a0d7f2767
SSDEEP 1536:JXHkx21iCq9WbN2Sa0PuhNcw6CAR6FBCmRAW+SA+amhhOBuLZet3xBBm9r1neNAo:pi7wRVuCw6CAR6XCiAlx+amf2xBQ9r1u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Roll

Path C:\Users\Admin\AppData\Local\Temp\Roll
Size 872KB
SHA256 f3b98eb82b5f55afc786532d716ded3bdbf3e03dffcfb80069d35b20dcbeb9aa
MD5 5832eb4fde739d4fae8c045747e4b406
SHA1 78e32918ede5aa6065f689812454e86298a66cd2
SHA512 f30d8b01fcc254368f8081565b1a8ec19677a6f8cb02beb50d9e14afdfe0a98cec4195fa6abaecc104f9aeb0920e6ba0733cb4511ed9b306eb83046219609107
SSDEEP 12288:/pV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:/Txz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Scroll

Path C:\Users\Admin\AppData\Local\Temp\Scroll
Size 26KB
SHA256 2b2d99caa49a47a9f7de60cce788fd377e799eebbfb0a5f5e289581db866c690
MD5 bb8b17864aca41d55c4ef87ccb1cfdce
SHA1 832d107efed4626935d259b19cbfd36c65a1b12a
SHA512 c9685bb1f71334582b185851d16da2fcb0fbb1c8c771969ef1c75b0a2cb2d0a71b1694942821061a6f7d937cf46ceecf50e8b68fdacc49779c4f836ba3fdb826
SSDEEP 768:/4/CYLczuV6Lengl99BtFuKgFHUlPLfxUv:/4/bcxLHl99BtkKMkrxUv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sign

Path C:\Users\Admin\AppData\Local\Temp\Sign
Size 90KB
SHA256 56ae5b52eb7c659ba1ffa92021558ee1f37d95e42d6c25370ea2f274a9db8191
MD5 51fb12dec4aee2be882175a522780325
SHA1 e9abdfd751870aad41d73205860f5912b82dbb75
SHA512 751014b278b077c803d882a120d92ffbc99b6174244a860963e3e75e078cf92af2e8b4d023f142706a80fd63511ee26b4b6187c0fc61406b93687db7033347e7
SSDEEP 1536:QzDoc/3m2CvI81I+sNh7R49VY9lzANmoCuZC+9X6bVQI8U+b0JIKT4uZRC5BCml:Wf/3mXeUYlzA/CuZCEK5QNjyzkQEC8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tiffany

Path C:\Users\Admin\AppData\Local\Temp\Tiffany
Size 74KB
SHA256 32ca7da32e97df76d7351a9a8de44516e11ea85320a261c4db18a898b2bb036c
MD5 7cf2aa96487e8322291944c4b019b26a
SHA1 ecc87ba3963fa18eb8458d38443cc547ff3b0c40
SHA512 800645207110c1a450354bc912ec6f071345e19e0f4f87de235a34772360cbc55096d96e84ae92e1344024f107c1479f8d331f25f6d1084f3ea906f7a63b35f1
SSDEEP 1536:2Tiqack58HatL5Iiklpuh1wKFYYoDG8JLzoEBxzLLgp+aN:2TbRaZ5yuvtYYoDGOzomxvLM+K
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1360-30-0x0000000000D90000-0x0000000000DE1000-memory.dmp

Download

memory/1360-31-0x0000000000D90000-0x0000000000DE1000-memory.dmp

Download

memory/1360-33-0x0000000000D90000-0x0000000000DE1000-memory.dmp

Download