lumma | f541ede6edd846768b78bff4a679528b580708a41f154fbca194b45dde0cbeac

Analysis

max time kernel
92s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pic simulator ide full crack software.exe
Size

762.1MB
MD5

89e24a2d1e9a5c4b135dd0d05685da21
SHA1

4550bade9b2dfedb5980cf6683793433ae4a9c33
SHA256

f541ede6edd846768b78bff4a679528b580708a41f154fbca194b45dde0cbeac
SHA512

359f56374a41821d8f894bbe0086fe4f34c3cae31f129efba4201fdecff1695890b069b8914d0198a4491d02e623aac50d05bc5d21d3cbbab7fdce0160c19573
SSDEEP

393216:FxTuuL2PddxuL2PdT6ieFM0+M4HBvSEuQRZPR:FBuuL2PddxuL2PdNL9lSEuQRZP

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://river-stone.shop/api

Extracted

Family

lumma

https://river-stone.shop/api

https://occupy-blushi.sbs/api

https://blade-govern.sbs/api

https://story-tense-faz.sbs/api

https://disobey-curly.sbs/api

https://motion-treesz.sbs/api

https://powerful-avoids.sbs/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

pic simulator ide full crack software.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	pic simulator ide full crack software.exe

Executes dropped EXE 1 IoCs

Processes:

Studying.com

pid	Process
4036	Studying.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

Processes:

tasklist.exetasklist.exe

pid	Process
4468	tasklist.exe
944	tasklist.exe

Drops file in Windows directory 1 IoCs

Processes:

pic simulator ide full crack software.exe

description	ioc	Process
File opened for modification	C:\Windows\IntroVessel	pic simulator ide full crack software.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

choice.execmd.exefindstr.exetasklist.execmd.execmd.exepic simulator ide full crack software.exetasklist.exefindstr.exeStudying.com

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pic simulator ide full crack software.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Studying.com

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Studying.com

pid	Process
4036	Studying.com
4036	Studying.com
4036	Studying.com
4036	Studying.com
4036	Studying.com
4036	Studying.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tasklist.exetasklist.exe

description	pid	Process
Token: SeDebugPrivilege	944	tasklist.exe
Token: SeDebugPrivilege	4468	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Studying.com

pid	Process
4036	Studying.com
4036	Studying.com
4036	Studying.com

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Studying.com

pid	Process
4036	Studying.com
4036	Studying.com
4036	Studying.com

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

pic simulator ide full crack software.execmd.exe

description	pid	Process	procid_target
PID 2304 wrote to memory of 3012	2304	pic simulator ide full crack software.exe	89
PID 2304 wrote to memory of 3012	2304	pic simulator ide full crack software.exe	89
PID 2304 wrote to memory of 3012	2304	pic simulator ide full crack software.exe	89
PID 3012 wrote to memory of 944	3012	cmd.exe	92
PID 3012 wrote to memory of 944	3012	cmd.exe	92
PID 3012 wrote to memory of 944	3012	cmd.exe	92
PID 3012 wrote to memory of 4952	3012	cmd.exe	93
PID 3012 wrote to memory of 4952	3012	cmd.exe	93
PID 3012 wrote to memory of 4952	3012	cmd.exe	93
PID 3012 wrote to memory of 4468	3012	cmd.exe	94
PID 3012 wrote to memory of 4468	3012	cmd.exe	94
PID 3012 wrote to memory of 4468	3012	cmd.exe	94
PID 3012 wrote to memory of 4304	3012	cmd.exe	95
PID 3012 wrote to memory of 4304	3012	cmd.exe	95
PID 3012 wrote to memory of 4304	3012	cmd.exe	95
PID 3012 wrote to memory of 2216	3012	cmd.exe	96
PID 3012 wrote to memory of 2216	3012	cmd.exe	96
PID 3012 wrote to memory of 2216	3012	cmd.exe	96
PID 3012 wrote to memory of 4012	3012	cmd.exe	97
PID 3012 wrote to memory of 4012	3012	cmd.exe	97
PID 3012 wrote to memory of 4012	3012	cmd.exe	97
PID 3012 wrote to memory of 4036	3012	cmd.exe	98
PID 3012 wrote to memory of 4036	3012	cmd.exe	98
PID 3012 wrote to memory of 4036	3012	cmd.exe	98
PID 3012 wrote to memory of 2620	3012	cmd.exe	99
PID 3012 wrote to memory of 2620	3012	cmd.exe	99
PID 3012 wrote to memory of 2620	3012	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\pic simulator ide full crack software.exe
"C:\Users\Admin\AppData\Local\Temp\pic simulator ide full crack software.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Ugly Ugly.cmd && Ugly.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4952
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 374235
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Deserve + ..\Himself + ..\Harry + ..\Tn + ..\Visited + ..\Carries + ..\Operating S
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4012
- - C:\Users\Admin\AppData\Local\Temp\374235\Studying.com
    Studying.com S
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4036
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\374235\S

Filesize
487KB

MD5
8dc38c2acd88ae70c8d127d5b3d0327d

SHA1
fc4ca6618b18d37b20029bc23fa733f9c78d4ed3

SHA256
901a9cfd4e0bb20ec072c22976eaa2f52ecffefcb19510bf694e342a73d933b2

SHA512
d065e5e6acbd81019470cfa5b9ec9e0d3dfd7a4eb2dd7027c03d02eda30e9fad79e2cd9b1587234d34393f4360b59676ed79cdbc029eb9d1760a88e388a0b50c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Carries

Filesize
77KB

MD5
fee3c8a099f3cb0845e0031511f8e919

SHA1
22c02c22dff79d1e3f243441f70b671e5a62cc7d

SHA256
10b54e2ce0cecf5c2c79f717bed52571846901a820db5288cf9b836558611ed7

SHA512
63549969a250dc35ba0347ef09202258baa6ece0a30d52f61e28efb3183c2a7eb6f4c5d4087194319a6290f1fc494ee1be2366e3b550f2c67d044dbed0e2ceda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deserve

Filesize
86KB

MD5
b1a4c9712322955a287103fbf912188b

SHA1
4b7aeebe94fa0da609c319a35c2f40ad0ba88119

SHA256
23fd6a58021c4db5b8a1cbe0bcf4ddc16505c81b3e7cdbaff19e8c5b5f8e9cc9

SHA512
61aa611e656d98d5ad9ee78e08d5f442892d32351423e3f69afc3acaec0fda20b2528580737be5c6429231a9b6fdf9a73fe9299d8d3e02eb7fae6f5d968e9f9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Harry

Filesize
88KB

MD5
bff4242993a5411e579ed63808db0804

SHA1
8163adf1d7e3a37b4af255a440bd6d33af48d926

SHA256
255c988c2f3d0708514b5e42f81e2c385370e95eb8a00e1f49e5fa6e5772260b

SHA512
2bb9597514b1c1241f7bc965192de592685cbf22a352dc9acc8882a95c64ec50ce15ca876bba0ac56045c7380d98ce4c9e99612de050782e2317fd8df4a53e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Himself

Filesize
90KB

MD5
4568ec59b3e0d5ccb612a9dad9623609

SHA1
5ec75745d771ace428dcbe955a3064ad8e0c44de

SHA256
f743b936e3dfd033ec8b2650f326a6b41c182d7a3fd32a8bcc44c905fc2318f3

SHA512
315f2cc55e125cb04a39c46e8fe57a722286bc50de4711be5f5230acae991b21c41de1c60fea2ba7ad92a79c864cb10092c85020d2429e5e18127fe8054eb7d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Operating

Filesize
9KB

MD5
c844a2c583994c66481507036a467e4d

SHA1
b783288afd1e7c470c5d2076e47ef66486badb96

SHA256
0b97bf7581b6acca8f7e4de3ff6d1d9f267fc8c5118cfd60a83705dba5c66ffa

SHA512
4172f0951865e4cd3891c8b141da64d0983e6569fd9fe27f9ca23e42523ddea02de17a060ac5425ae1f7efdeb3a28e0da83383c0ee41619b203e65c28fa1a0bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tn

Filesize
77KB

MD5
d561fb89fc339a3c58c9cd9f1e840386

SHA1
153254ccb391e3ffaf64c13a0f893ad664c56fda

SHA256
15f8d5e80c2a00b3a0b6d2bdbef445be35ab2314161064d38516a55fbb1d8550

SHA512
f14f8679365279caea154234a19c3e341853c67e9ca37b045dbf995a3b7c569f574f104c8ad30c625eef70394dad8a4376bb40fcfe44f6bc7454ffd950790e37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ugly

Filesize
8KB

MD5
8f9fd4ec618f95477e36e8060d628be6

SHA1
f092ef81de21cc7d2a85abfad5254818903ee4be

SHA256
baa4c9cc5232482df00a7921a590582073fe5daddc4f9858832187fbbf6ff8ed

SHA512
873956ce7b4ba1864cdab4bb2c9483aca4eb8f5dbf920ce0e4d8220a63da2e1d1a836867c1d74f70f241b927d9139ca1a90c6712a6c906caf3939844165077a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Visited

Filesize
60KB

MD5
76806751e9e33fc8c3be61abde709c3d

SHA1
236b7bdcc8d1eb33ec0fa3a363cc617ad42fb2b8

SHA256
c12eed90e27e048eed040efb93069a891ff8dbb7924f660b6ef32204682a80b6

SHA512
a5ab398cc915a2a2e608c84f2b94d810220dfa77040a2b1549a678852bf92fc327358b7e441631af225089ae4633ef5870898286464d179441a8546b2c65db32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wiki

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
memory/4036-230-0x00000000043D0000-0x000000000442A000-memory.dmp

Filesize
360KB

Download
memory/4036-229-0x00000000043D0000-0x000000000442A000-memory.dmp

Filesize
360KB

Download
memory/4036-228-0x00000000043D0000-0x000000000442A000-memory.dmp

Filesize
360KB

Download
memory/4036-233-0x00000000043D0000-0x000000000442A000-memory.dmp

Filesize
360KB

Download
memory/4036-232-0x00000000043D0000-0x000000000442A000-memory.dmp

Filesize
360KB

Download
memory/4036-231-0x00000000043D0000-0x000000000442A000-memory.dmp

Filesize
360KB

Download