lumma | 70ecfdcd8667bc24ade095f8c9c0d562be1bf31dc8851977a49773b316d83bfd

Analysis

max time kernel
132s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
21/10/2024, 13:41

Target
installer.exe
Size 550KB
Sample241021-qzdl1awbme
SHA256 644b45fa0d076c6a9cfe6a966948085aefadc31ed454fee09cf583b41c7e92eb
MD5 baa49579fe5b7ca9c12de5dfd4a23f39
SHA1 c7476ceb3d586e93e2fdee7d29226923b80fa642
SHA512 473e02dded86b15dfed5d7cd6b82188ff6610a246143cb911f03b244961e1dd6a4faf19ac4062d2d66941d94bc7d2ef77196e51959b424d8217f3a22d8486c04
SSDEEP 12288:RjUMVFCEJXd7QxVp1Gvu4P9z9SFcuT5VU7rsKUfRUQKS:1VLJX5Qt34FZEcuzKUfRUX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3080 set thread context of 5048	3080	installer.exe	74

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4516	3080	WerFault.exe	72

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 64	3080	installer.exe	73
PID 3080 wrote to memory of 64	3080	installer.exe	73
PID 3080 wrote to memory of 64	3080	installer.exe	73
PID 3080 wrote to memory of 5048	3080	installer.exe	74
PID 3080 wrote to memory of 5048	3080	installer.exe	74
PID 3080 wrote to memory of 5048	3080	installer.exe	74
PID 3080 wrote to memory of 5048	3080	installer.exe	74
PID 3080 wrote to memory of 5048	3080	installer.exe	74
PID 3080 wrote to memory of 5048	3080	installer.exe	74
PID 3080 wrote to memory of 5048	3080	installer.exe	74
PID 3080 wrote to memory of 5048	3080	installer.exe	74
PID 3080 wrote to memory of 5048	3080	installer.exe	74

C:\Users\Admin\AppData\Local\Temp\installer.exe
"C:\Users\Admin\AppData\Local\Temp\installer.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\AppData\Local\Temp\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\installer.exe"
  2⤵
  PID:64
- C:\Users\Admin\AppData\Local\Temp\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\installer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 248
  2⤵
  - Program crash
  PID:4516