lumma | 8982fb3f4b3d431e50e1a2ca17d46559bdcd1b5b8f07e06a6e42da39e8a8f845

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2024, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 89.0MB
Sample241021-qjrtpaxapp
SHA256 81aa20dea213a7b44f10cb281b4dca82ddeb0237867a41e85a61ed39045c728f
MD5 8ca3c0938fc208653ee70c07c97d0b2f
SHA1 6c16c9f971bd63fa66729a22462379cbc966bdb4
SHA512 2187aee691bcf9236fa19f919c6b21db7b94e87ae274094d3b693d822b26648c8d61aaab66bc67da0bc615384cb660dd09322a526535ab17f737e8f22a7de0ea
SSDEEP 24576:V2hmfw/0pe1fawnocABP/Mmig45o4saM4+cL9E/GMiy:/fwc8cwnocAZ/Mmx1FM4GMf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://snailyeductyi.sbs
https://ferrycheatyk.sbs
https://deepymouthi.sbs
https://wrigglesight.sbs
https://captaitwik.sbs
https://sidercotay.sbs
https://heroicmint.sbs
https://monstourtu.sbs

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 1 IoCs

pid	Process
3948	Maximize.pif

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3632	tasklist.exe
848	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 1240	3948	Maximize.pif	109

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PciState	Setup.exe
File opened for modification	C:\Windows\SolomonSpeaking	Setup.exe
File opened for modification	C:\Windows\BoCoverage	Setup.exe
File opened for modification	C:\Windows\WiderGuests	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maximize.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif
1240	nslookup.exe
1240	nslookup.exe
1240	nslookup.exe
1240	nslookup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3632	tasklist.exe
Token: SeDebugPrivilege	848	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3948	Maximize.pif
3948	Maximize.pif
3948	Maximize.pif

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 100	4992	Setup.exe	87
PID 4992 wrote to memory of 100	4992	Setup.exe	87
PID 4992 wrote to memory of 100	4992	Setup.exe	87
PID 100 wrote to memory of 3632	100	cmd.exe	91
PID 100 wrote to memory of 3632	100	cmd.exe	91
PID 100 wrote to memory of 3632	100	cmd.exe	91
PID 100 wrote to memory of 2500	100	cmd.exe	92
PID 100 wrote to memory of 2500	100	cmd.exe	92
PID 100 wrote to memory of 2500	100	cmd.exe	92
PID 100 wrote to memory of 848	100	cmd.exe	94
PID 100 wrote to memory of 848	100	cmd.exe	94
PID 100 wrote to memory of 848	100	cmd.exe	94
PID 100 wrote to memory of 4992	100	cmd.exe	95
PID 100 wrote to memory of 4992	100	cmd.exe	95
PID 100 wrote to memory of 4992	100	cmd.exe	95
PID 100 wrote to memory of 3468	100	cmd.exe	96
PID 100 wrote to memory of 3468	100	cmd.exe	96
PID 100 wrote to memory of 3468	100	cmd.exe	96
PID 100 wrote to memory of 2304	100	cmd.exe	97
PID 100 wrote to memory of 2304	100	cmd.exe	97
PID 100 wrote to memory of 2304	100	cmd.exe	97
PID 100 wrote to memory of 988	100	cmd.exe	99
PID 100 wrote to memory of 988	100	cmd.exe	99
PID 100 wrote to memory of 988	100	cmd.exe	99
PID 100 wrote to memory of 3948	100	cmd.exe	100
PID 100 wrote to memory of 3948	100	cmd.exe	100
PID 100 wrote to memory of 3948	100	cmd.exe	100
PID 100 wrote to memory of 4396	100	cmd.exe	101
PID 100 wrote to memory of 4396	100	cmd.exe	101
PID 100 wrote to memory of 4396	100	cmd.exe	101
PID 3948 wrote to memory of 1240	3948	Maximize.pif	109
PID 3948 wrote to memory of 1240	3948	Maximize.pif	109
PID 3948 wrote to memory of 1240	3948	Maximize.pif	109
PID 3948 wrote to memory of 1240	3948	Maximize.pif	109
PID 3948 wrote to memory of 1240	3948	Maximize.pif	109

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Casual Casual.bat & Casual.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:100
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2500
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- - C:\Windows\SysWOW64\findstr.exe
    findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 59049
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "TommySalvadorCandlesConfused" Neck
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Ten + ..\Kernel + ..\Older + ..\Cookbook + ..\Improve + ..\Iowa + ..\Person + ..\Pulled c
    3⤵
    - System Location Discovery: System Language Discovery
    PID:988
- - C:\Users\Admin\AppData\Local\Temp\59049\Maximize.pif
    Maximize.pif c
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\SysWOW64\nslookup.exe
      C:\Windows\SysWOW64\nslookup.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1240
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Maximize.pif

Path C:\Users\Admin\AppData\Local\Temp\59049\Maximize.pif
Size 872KB
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
SSDEEP 12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\59049\c
Size 556KB
SHA256 ddaade54d3738646b8e8d24c7fcc65d579cb0375fedcbd7496f1d718545e01c9
MD5 0e6eb46981a5c4f7852def01c5425746
SHA1 f1aea5d803b3b367f263c6744564c356a25de216
SHA512 da1bc62a870c756443fdea3a1baabe205b6a26b4bbda148b6acbd06108ea8ed2bbe34f24538dc3a049e23646e585bd38be00769d2f0a34784adc90bf1af0028a
SSDEEP 12288:7rlxg9aNc0IgeDgIdTEFbxiLzGl3ChiaW1CM90hiA:7lrZKwFizGl3xcMyhiA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Casual

Path C:\Users\Admin\AppData\Local\Temp\Casual
Size 17KB
SHA256 6df06d4cb125160dec5382051f9dfcb4a9a5f0de836d7b9eb4aebfb08a49698e
MD5 32ab071bda45600f8da4408617d22e94
SHA1 f07cd9e3deaaff5bcde8c1aaf3070d5bb7471824
SHA512 fa70a9ad9c43fa932e9549e93f25fdd23450e62081554ceec21a52ca7c7d3bab7697577f724c6c6c840ceda557f11f851b6824e92f6254612bfde16045ac38c3
SSDEEP 384:HJen/f82YB50nTZkUPSod4fIUrbxoP4p3n63tR10rBGnaf9VyFcAjTU1d2Mh:G/f8lBuTZkUPSoGXKP4p3notgrBGnafl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cookbook

Path C:\Users\Admin\AppData\Local\Temp\Cookbook
Size 87KB
SHA256 15819667b0280864ae144bc19857bf01e5212376467077d3ac6493c75cff7e0a
MD5 eac73e9c53653617920f7bbc79055daa
SHA1 e8b3134055498c106e39ae49aafe90eb38fd98cc
SHA512 408a9bd89c5c12f5040194c8406f1e109624eef268d39ac08f61f0d4f2f2a791546a5df88cdf2cc3a4adf1bd9df4a4971a832a7a37e7a3a3dc2ce4f4af161c5b
SSDEEP 1536:4Cyga6Hzfcgs41LLeiIu8WBe+WVi0QW3otM1JEaRcug5SnXJDuqEnhrSM5wKKkXA:VLaQs+OiIRWBeic36a6JSXJidJPwK7XA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Improve

Path C:\Users\Admin\AppData\Local\Temp\Improve
Size 68KB
SHA256 6c87b9928c258065bf08a13a5959e66ac242cd972800e328a653036b55dacb05
MD5 c512c9b4495066ab05827b1daf4d291f
SHA1 70b2959020371a5363985e15a13df32adf2b5310
SHA512 ddfb77278cccf17ce1490c15ea22603e2fe61c101b08714613c2aa198eeb7cfbf47098f9044dad4724c0ff77e5711ddb5aca929876ba60eb4cbcaabd52d23991
SSDEEP 1536:RZVYdzk+3kiRxEHVZaGDoRk1kr3dQ+2fRyREXrmD1cd:R/WzR3k/1ZRDGkqr3dbKXmOd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Iowa

Path C:\Users\Admin\AppData\Local\Temp\Iowa
Size 68KB
SHA256 eb7eeea0f7fb931624b174550425b0bd7943617467a7d176970a364ea381b82e
MD5 3003bffdfd969b47e77395dc22f127aa
SHA1 3b6bf4d131d697248696bd2ce5f5327d2fced637
SHA512 77a488e7f5c742a72816a2a593e30b09609875a54bc7861fc68860b7d3a38b02a5f16129f286e7cacd83eb8d39e24f04c957ff859aef5692017e6446e0f51725
SSDEEP 1536:+pCHtbYX8KThFI3esqM4Qjg+IE8yAxqkYxWMGtopvT:+IYiAxqfcMr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kernel

Path C:\Users\Admin\AppData\Local\Temp\Kernel
Size 86KB
SHA256 87648977b4cd4fbbca2171b422336deda82b4feec956ee7c6438bd268cabbec4
MD5 d7b5760b9c2fe0485e8abeb52bc9d999
SHA1 bad5fd6ae8201c90d4d412f0dfc51ee7947fe2c0
SHA512 ef23a23a7739d24c05d70c7bd65d1d8d9c754c307734fc2539f63b8246d3bf420902595403282fdec3f43084556e88e23399e49c92d0467a0a0569c425aa5137
SSDEEP 1536:E1RbAq0eWMR9qyoBQpXCndMEUB3Rn3PyZ9aiWNTQMaLOttK7//hsk6eII:E1Rb70eWMfKUqdo5xaq8FL4gf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Neck

Path C:\Users\Admin\AppData\Local\Temp\Neck
Size 5KB
SHA256 b95e818cbbf1efa13b2cf98af35491801ac7afd53f04a8cc0efeffe68b3822ba
MD5 7e6540e375a5842741c59f9051c6b331
SHA1 f3ad424a350c3a304d9d1974f38e91aac36c8601
SHA512 5b957a95a21be3cbe510723f0e8b60c3a166b288c43fdd25fd064b53fe7da6d8e39b4d35319101515c46a09083d17f1962f745007bbcd1ff3f7c71ce41196902
SSDEEP 96:3GxgUzr4tgOwVAfBzDICS09CAi6R7u+IhsObfS+NsPvj6ooxdofjxE:3sHAeOqAFDw09CV/2nPvj6DdME
MD5 SHA1 SHA512 SSDEEP

Submit Download

Older

Path C:\Users\Admin\AppData\Local\Temp\Older
Size 56KB
SHA256 c4662c502cc22a4ff1f3ab38a51ac6a24c0458f76208ec4636c6fcbc4438d2c1
MD5 6c4b1a40a8953f882924301a2da77080
SHA1 1c620b366a92b8160d497ee2df611ae6e049883e
SHA512 130ded3091d278dc37026eb08b06d855d6e773a47665660ad93b6a1ac0f3d31776ab0e1d534445703920d29b72a80c0908f9caa7a00066cc256dd5aec69e2fb0
SSDEEP 1536:PnCi4BqI8yUzr9OeoRTww9yKXtOvMJYLuRK3EmR+y:qi4BMy1/HyKXWxLzky
MD5 SHA1 SHA512 SSDEEP

Submit Download

Person

Path C:\Users\Admin\AppData\Local\Temp\Person
Size 55KB
SHA256 a8b4320c7d1fa267a5fa45bb1b83586daa244beb1e8091ea015c3df786ec9d3c
MD5 6b77131a485b190a295c3a6d31d1c99f
SHA1 dd1c3db8032ecbf15cf97986825de0a3b62275bb
SHA512 443ba5022b7dc8c53a1f981a388c14314588b13b8b95a8f6a828d17f1af73b98afede6d2f446118b60ab6772ae4ae8114862f33b8ac2078172d8b2395e4b65c3
SSDEEP 1536:Dozg3QhRTgVYYB1UwCdGIsaZicUSBHyV7bNNI8a:Egg7gVYYB1rPITZiRSsV70x
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pulled

Path C:\Users\Admin\AppData\Local\Temp\Pulled
Size 57KB
SHA256 a1877006844bf862f50a1df8b13ae94cfa9c0a68cdc76d0a0a79dd2184c31da8
MD5 f15030234773bfe898dc8ad569de79b3
SHA1 9d0afb5a709630a4346db0d26515c9914383723d
SHA512 d28f5812495a895da3e0b5d4301d3fbdd257c7c54a5eaa0b6422ede873021242fe5e6c6d9770249899828442aa1a0dbb68df5f98548444eb05e0b86ca7e7d97d
SSDEEP 1536:nCGekN5urQvwyV7yOf+t/00WwDm+3a5Tlm:nCUPulyVdWh00sNA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reno

Path C:\Users\Admin\AppData\Local\Temp\Reno
Size 867KB
SHA256 4ff6e09f55ef10f215c4f5db74c26318a846f543b9953d52e160be96eef94f96
MD5 268cc2dac7aa1ff654a67bec4eeb91c2
SHA1 d810754c7346c4ab1cdc68c21ece474175fc2b52
SHA512 e754536b2e74e6eb3095031887f0ab61b9c9d63681e6b9cf017479833a756585bf6823d0112cfd0dbaa46136c4b6683339973d8f61baf17ea83b2911efb4f9a6
SSDEEP 12288:/V0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:dxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ten

Path C:\Users\Admin\AppData\Local\Temp\Ten
Size 79KB
SHA256 863bfdc7a15b4b8b28e348630ef65b4b54549c75cd874181a883b6bfdb8c5389
MD5 84533cd2885329486220926ac9a4b336
SHA1 ea80dd92d4df63b3ebb334474381cc3a1a8db080
SHA512 bf40e4a849c88b9e57f6383ef1d4a60e8f02f25ec1de755127c6139ecc0be146a6c06f3c7f461c3cb4fd2cc71949f01f4b6019a21c1a4c3c56df49070fc8dd56
SSDEEP 1536:GjcFMQ8BmRLx7Pr7X6c9J6SVNYKjZH0bbznmCagVrJYgpFXuMlfGt0IAoSO5VtND:G6E4LP9J6OYKjZH6HogtJYgpFXlNGqIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1240-393-0x0000000000F60000-0x0000000000FBE000-memory.dmp

Download

memory/1240-394-0x0000000000F60000-0x0000000000FBE000-memory.dmp

Download

memory/1240-395-0x0000000000F60000-0x0000000000FBE000-memory.dmp

Download