lumma | c8064480cc96c9649ce7bfd61d97cc43a8604fe100a5e2c31c3dc9610f06e791

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe
Size

421KB
MD5

13c7803aceca3b2f651fb667dc2c0797
SHA1

90be3df29854ffc2782edff3c69aceb5788dde50
SHA256

c8064480cc96c9649ce7bfd61d97cc43a8604fe100a5e2c31c3dc9610f06e791
SHA512

9706b95dd98fe0f0844f384105b6c81863f8f50b616511e09cca93686888304ff284c3f3a7cbf05ca9e610364d46d04c373d1307877c4aa65eb00facac9af176
SSDEEP

12288:qOvRpTrdBipxJ/H2M3oouUbx7briAB4Ho+XKI9EQaRLckBBdKHOGLWKwXyKK:Fv/TLipv/WXopF

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://horsedwollfedrwos.shop/api

https://patternapplauderw.shop/api

https://understanndtytonyguw.shop/api

https://considerrycurrentyws.shop/api

https://messtimetabledkolvk.shop/api

https://detailbaconroollyws.shop/api

https://deprivedrinkyfaiir.shop/api

https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4436 set thread context of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86
PID 4436 wrote to memory of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86
PID 4436 wrote to memory of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86
PID 4436 wrote to memory of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86
PID 4436 wrote to memory of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86
PID 4436 wrote to memory of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86
PID 4436 wrote to memory of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86
PID 4436 wrote to memory of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86
PID 4436 wrote to memory of 3940	4436	fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe	86

C:\Users\Admin\AppData\Local\Temp\fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe
"C:\Users\Admin\AppData\Local\Temp\fileb09f38d4b12a76c78e651e92583ea94f219958crypted.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
422KB

MD5
73fbc6dc74221e3a34031f9ec3434010

SHA1
37b9a8f84e9ebf264f88d14c5d060bdd6d43b1d7

SHA256
b8a20b6da6199bdc7e422018f458b19aef6b3a8b7b34543ff7c75830b1bf49bc

SHA512
328e7e6faa0a2a29a63c84c5fbbce90bd043ef894ef8ac7609967a46d20b645982d29daea05c16f75d1f36c6e73f2fc621b8b6f5a4ddd90b550af2c1ffe16db7

Download Submit
memory/3940-8-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3940-11-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3940-13-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4436-0-0x0000000074B5E000-0x0000000074B5F000-memory.dmp

Filesize
4KB

Download
memory/4436-1-0x0000000000FA0000-0x0000000001010000-memory.dmp

Filesize
448KB

Download
memory/4436-12-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4436-14-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download