lumma | 788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c

Analysis

max time kernel
35s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe
Size

527KB
MD5

92cd58dddaf21e1f9b44d89d3548433c
SHA1

3800b8babf53da2b496a7e4e4ced243c4c17c612
SHA256

788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c
SHA512

6e98eec9ed380ac9adc6b0496d5c5fceb857ce441edf12abf0b138445fa64135ef584fde123c3ac42e9975ff3c6d1f752e6cbb73b71f235b9eb12140b4d413de
SSDEEP

12288:yUBIdSw37RH8yvb8RdzSXbHHwGTpVjctWt+6uh3KPEEO:tm7xDz8RoXbJfcIt+5sEt

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4260 set thread context of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4800	4260	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85
PID 4260 wrote to memory of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85
PID 4260 wrote to memory of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85
PID 4260 wrote to memory of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85
PID 4260 wrote to memory of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85
PID 4260 wrote to memory of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85
PID 4260 wrote to memory of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85
PID 4260 wrote to memory of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85
PID 4260 wrote to memory of 1012	4260	788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe	85

C:\Users\Admin\AppData\Local\Temp\788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe
"C:\Users\Admin\AppData\Local\Temp\788df309a4525e76338889f9aab4ed5a95e1eecf19a24e5f5f2a48c932f41a0c.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 292
  2⤵
  - Program crash
  PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4260 -ip 4260
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1012-1-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1012-3-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1012-4-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1012-5-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4260-0-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download