lumma | 6c1ae2ea634d7dfb613450b14687d0ff7d8bfa3b96e12ab1cb58bcc85ecef6a2

Analysis

max time kernel
91s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
27-11-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stover Launcher.rar
Size

3.3MB
MD5

9ceb9d749842eb84f2a001cbd51c1cf4
SHA1

53c8b425a52bb14ddc26bc0b8987e06fe982f43b
SHA256

6c1ae2ea634d7dfb613450b14687d0ff7d8bfa3b96e12ab1cb58bcc85ecef6a2
SHA512

91d982781d23ddb3f362da2d711a6d86c462b7117661e18d447d4e16fb0e766f7898b0aeff20504904f079957ca8e7b9c3addfb8ee69395ee24a9dbe7f46d856
SSDEEP

98304:tICdzprSxk9zR6xZak9j9hMtGooKbYAovQQE7gV:2Cd9r0MzeZbl9hMtGwovQvu

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://property-imper.sbs

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 7 IoCs

Processes:

stoverlauncher.exestoverlauncher.exestoverlauncher.exestoverlauncher.exestoverlauncher.exestoverlauncher.exestoverlauncher.exe

pid	Process
224	stoverlauncher.exe
1636	stoverlauncher.exe
2532	stoverlauncher.exe
2448	stoverlauncher.exe
1480	stoverlauncher.exe
2176	stoverlauncher.exe
4032	stoverlauncher.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

stoverlauncher.exestoverlauncher.exestoverlauncher.exe

description	pid	Process	procid_target
PID 224 set thread context of 2532	224	stoverlauncher.exe	85
PID 2448 set thread context of 1480	2448	stoverlauncher.exe	94
PID 2176 set thread context of 4032	2176	stoverlauncher.exe	99

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
2784	2532	WerFault.exe	85
4380	2532	WerFault.exe	85
2976	1480	WerFault.exe	94
2092	4032	WerFault.exe	99
3220	4032	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

stoverlauncher.exestoverlauncher.exestoverlauncher.exestoverlauncher.exestoverlauncher.exestoverlauncher.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stoverlauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stoverlauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stoverlauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stoverlauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stoverlauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stoverlauncher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid	Process
3684	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

7zFM.exe

description	pid	Process
Token: SeRestorePrivilege	3684	7zFM.exe
Token: 35	3684	7zFM.exe
Token: SeSecurityPrivilege	3684	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid	Process
3684	7zFM.exe
3684	7zFM.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

stoverlauncher.exestoverlauncher.exestoverlauncher.exe

description	pid	Process	procid_target
PID 224 wrote to memory of 1636	224	stoverlauncher.exe	84
PID 224 wrote to memory of 1636	224	stoverlauncher.exe	84
PID 224 wrote to memory of 1636	224	stoverlauncher.exe	84
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 224 wrote to memory of 2532	224	stoverlauncher.exe	85
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2448 wrote to memory of 1480	2448	stoverlauncher.exe	94
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99
PID 2176 wrote to memory of 4032	2176	stoverlauncher.exe	99

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Stover Launcher.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3684

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3372

C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe
"C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe
  "C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe"
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe
  "C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1472
    3⤵
    - Program crash
    PID:2784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1444
    3⤵
    - Program crash
    PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2532 -ip 2532
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2532 -ip 2532
1⤵
PID:3248

C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe
"C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe
  "C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 1300
    3⤵
    - Program crash
    PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1480 -ip 1480
1⤵
PID:3416

C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe
"C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe
  "C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1436
    3⤵
    - Program crash
    PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1464
    3⤵
    - Program crash
    PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4032 -ip 4032
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4032 -ip 4032
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zE46E32BE7\Stover Launcher\Autoupdate.dll

Filesize
2.5MB

MD5
51397005ac7db572e3af109699f4ba73

SHA1
c9bcb56dd1a4c4b687917aac34f703908a5d4bde

SHA256
07bd44748b663d9efbf35cd962408b57ad72a7ce65bdc2722db284f343b2d891

SHA512
512740d00adf5512cd8f6ca163a1c137a0e17091243d880271945b90306f7ddc6b47928b27985c5b60b4474e5be57273308babe50986fda638dc6b8ea2f0f2c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE46E32BE7\Stover Launcher\x64\cfg.dll

Filesize
5.0MB

MD5
7bfe885d87026d0d41dba5fb4173201c

SHA1
027637e1c7fd24a7bbaba6b926cce67e47d8e7dc

SHA256
2b529e8afa002053744bb4e2430513e7745f91b5052446ef2d0568e91d5b1280

SHA512
d2ded5d1c216900e340425f652c585398f2662f3aefe552e80161af90d1656d2ed202366c2ac794564dbf6eca0c1d769f62fcb979a0d666ea06540e389a30951

Download Submit
C:\Users\Admin\Desktop\Stover Launcher\stoverlauncher.exe

Filesize
461KB

MD5
c30aa30a660900e46d016f3a69b14cbe

SHA1
e3ea76add08a924c1dd0abf7987bd531526c73e9

SHA256
33a4c64a0b43b2732fb8d0be63088b86b6d24288a0c716e382e76e591e856041

SHA512
0230e57ff6c7dd1763d9ef618b615014125ac497b2bad03746827f59a56d28a9c81a9aefefe0001a7cdf163e335b0e42e6c41ec13147b0e0fa134c537ce0c0fc

Download Submit
memory/224-44-0x0000000000AA3000-0x0000000000AA4000-memory.dmp

Filesize
4KB

Download
memory/2532-46-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2532-49-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2532-50-0x0000000000A80000-0x0000000000AF7000-memory.dmp

Filesize
476KB

Download