Overview

overview

10

Static

static

1

RMS.7.1.7....nt.msi

windows7-x64

10

RMS.7.1.7....nt.msi

windows10-2004-x64

10

RMS.7.1.7....nt.msi

windows11-21h2-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RMS.7.1.7.0_configured_client.msi

  • Size

    21.5MB

  • Sample

    241123-pan6rsvjc1

  • MD5

    282e49971af85d26fcc453c1604dbca2

  • SHA1

    e2fa2c353891cd1782d0237a65d86bd4ad9e811c

  • SHA256

    7246aefd7681d59bc981afbece29efbe31ce1aabac8c3ee6d74a4e52afcda468

  • SHA512

    486be3d725bf9828521fd883033eb1ee9c2b5cc3faee0bf8cab829deccff70c6510f92088876193ba7d3249390a4e0c166cf07850917a8fe2c1e5845a5e83705

  • SSDEEP

    393216:p4HnfylxIDItISQ3f5W4YyGIi8224pPwpd0YDW0J9pd88lVpA:p4HaYkITCyGH822UoDW0e

Score
10/10
lummadiscoverypersistenceprivilege_escalationstealer

Malware Config

Targets

    • Target

      RMS.7.1.7.0_configured_client.msi

    • Size

      21.5MB

    • MD5

      282e49971af85d26fcc453c1604dbca2

    • SHA1

      e2fa2c353891cd1782d0237a65d86bd4ad9e811c

    • SHA256

      7246aefd7681d59bc981afbece29efbe31ce1aabac8c3ee6d74a4e52afcda468

    • SHA512

      486be3d725bf9828521fd883033eb1ee9c2b5cc3faee0bf8cab829deccff70c6510f92088876193ba7d3249390a4e0c166cf07850917a8fe2c1e5845a5e83705

    • SSDEEP

      393216:p4HnfylxIDItISQ3f5W4YyGIi8224pPwpd0YDW0J9pd88lVpA:p4HaYkITCyGH822UoDW0e

    Score
    10/10
    lummadiscoverypersistenceprivilege_escalationstealer

    • Detect Lumma Stealer payload V2

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

      stealerlumma

    • Lumma family

      lumma

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks