lumma | e3a88ee547921deaffa538b8d4177b40ef32a7b7bd93f61b19a3bcb836ab7491

Analysis

max time kernel
97s
max time network
143s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21-11-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New folder (8)/Setup.exe
Size

1.6MB
MD5

ec539c4a9c60b3690fbd891e19333362
SHA1

7cd141b72d9c6701c27f939b790624ebe04668fd
SHA256

1d60149ce640f4e07bceeb8940950441025277f1eba4f501f8afe558030b34fe
SHA512

b6a3496e7b6f7aed5dcc7e0bb3fe903d2c231ff5470bbedd37e8bea83b1951dc835f32ac6508dea8b561bfd6354e7741227a42eb49fc0575ce64e12b494c00c1
SSDEEP

24576:Iz2WcNmHWLyc6+QrRIVkQirZieVPpd27K8mBWSjTUvJ2Npi8TofJ8jH3cT:RNmHyyc63YwQcTjT02NPTofJWXcT

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://gentlewave.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Blocklisted process makes network request 6 IoCs

Processes:

msiexec.exe

flow	pid	Process
25	4560	msiexec.exe
28	4560	msiexec.exe
31	4560	msiexec.exe
37	4560	msiexec.exe
41	4560	msiexec.exe
44	4560	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description	pid	Process	procid_target
PID 4584 set thread context of 3060	4584	Setup.exe	88

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

more.commsiexec.exeSetup.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	more.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Setup.exemore.com

pid	Process
4584	Setup.exe
4584	Setup.exe
3060	more.com
3060	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Setup.exemore.com

pid	Process
4584	Setup.exe
3060	more.com

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Setup.exemore.com

description	pid	Process	procid_target
PID 4584 wrote to memory of 3060	4584	Setup.exe	88
PID 4584 wrote to memory of 3060	4584	Setup.exe	88
PID 4584 wrote to memory of 3060	4584	Setup.exe	88
PID 4584 wrote to memory of 3060	4584	Setup.exe	88
PID 3060 wrote to memory of 4560	3060	more.com	90
PID 3060 wrote to memory of 4560	3060	more.com	90
PID 3060 wrote to memory of 4560	3060	more.com	90
PID 3060 wrote to memory of 4560	3060	more.com	90
PID 3060 wrote to memory of 4560	3060	more.com	90

C:\Users\Admin\AppData\Local\Temp\New folder (8)\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\New folder (8)\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\SysWOW64\msiexec.exe
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2a3970ce

Filesize
1.1MB

MD5
6ba89a3e5c8f7eb0445eefca69d6f3f9

SHA1
1d837b784c0f67211933fca6fd9cd5b2580c3b86

SHA256
db5f4981bc775f08c962bd268d0ee123e70072dbc1bbf85bd0339c2d112f044a

SHA512
5b64efeb8ef60f3a5e230d0d97b92c91e7dfef892f7633206982790e065f3946b0e1baa2eb90350e275937af08d4535a0c65bd419405d6f637defe58af4b0e6d

Download Submit
memory/3060-18-0x0000000073E00000-0x0000000073F7B000-memory.dmp

Filesize
1.5MB

Download
memory/3060-14-0x0000000073E00000-0x0000000073F7B000-memory.dmp

Filesize
1.5MB

Download
memory/3060-13-0x0000000073E00000-0x0000000073F7B000-memory.dmp

Filesize
1.5MB

Download
memory/3060-8-0x0000000073E00000-0x0000000073F7B000-memory.dmp

Filesize
1.5MB

Download
memory/3060-12-0x00007FFFDA330000-0x00007FFFDA528000-memory.dmp

Filesize
2.0MB

Download
memory/4560-19-0x00007FFFDA330000-0x00007FFFDA528000-memory.dmp

Filesize
2.0MB

Download
memory/4560-21-0x0000000000840000-0x0000000000852000-memory.dmp

Filesize
72KB

Download
memory/4560-20-0x00000000002E0000-0x0000000000354000-memory.dmp

Filesize
464KB

Download
memory/4584-6-0x0000000073E00000-0x0000000073F7B000-memory.dmp

Filesize
1.5MB

Download
memory/4584-2-0x0000000000400000-0x00000000005ED000-memory.dmp

Filesize
1.9MB

Download
memory/4584-3-0x0000000061E00000-0x0000000061ECA000-memory.dmp

Filesize
808KB

Download
memory/4584-4-0x0000000073E13000-0x0000000073E15000-memory.dmp

Filesize
8KB

Download
memory/4584-5-0x0000000073E00000-0x0000000073F7B000-memory.dmp

Filesize
1.5MB

Download
memory/4584-1-0x00007FFFDA330000-0x00007FFFDA528000-memory.dmp

Filesize
2.0MB

Download
memory/4584-0-0x0000000073E00000-0x0000000073F7B000-memory.dmp

Filesize
1.5MB

Download