lumma | 97085a42ee49f9eaf24283640e9857306e685c3b640e4e3f84bbb7fc801906ae

Analysis

max time kernel
92s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-27_222030beeac9f9cd749670e82abf2873_icedid.exe
Size

2.5MB
MD5

222030beeac9f9cd749670e82abf2873
SHA1

f2851ff8883406375b9fd2c3b3cc622af36529cc
SHA256

97085a42ee49f9eaf24283640e9857306e685c3b640e4e3f84bbb7fc801906ae
SHA512

1659c5d7edf0c3bdea8e3d32df08340cab5e9243701e94ed98236300e81d2c9689b6fce39d910d5af4bd681c3ce208adef45a962684e62790100360494a1e214
SSDEEP

24576:7wyBalwmkxV6EZtzch4uyFVVFm5qK69nBHItulI1nusNO1YmqlvOsjV0Jl2rP6ra:7DmAV8h9y7Dm5qPBHIMqrKDq

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://twist-dizzy.cyou

Extracted

Family

lumma

https://twist-dizzy.cyou/api

https://blade-govern.sbs/api

https://story-tense-faz.sbs/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	3468	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-27_222030beeac9f9cd749670e82abf2873_icedid.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3468	2024-11-27_222030beeac9f9cd749670e82abf2873_icedid.exe
3468	2024-11-27_222030beeac9f9cd749670e82abf2873_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-27_222030beeac9f9cd749670e82abf2873_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-27_222030beeac9f9cd749670e82abf2873_icedid.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1448
  2⤵
  - Program crash
  PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3468 -ip 3468
1⤵
PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3468-0-0x0000000000C90000-0x0000000000CE6000-memory.dmp

Filesize
344KB

Download
memory/3468-2-0x0000000000C90000-0x0000000000CE6000-memory.dmp

Filesize
344KB

Download
memory/3468-3-0x0000000000C90000-0x0000000000CE6000-memory.dmp

Filesize
344KB

Download