lumma | 1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8

Analysis

max time kernel
96s
max time network
141s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27/12/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a99adad8a9f9f1d9dcce30c42dd4be3a.exe
Size 5.9MB
Sample241227-jfvmvasrdt
SHA256 1ad8785caeb519b67ea168477437d8166d9747196a46d22313f48eb4ab86fec8
MD5 a99adad8a9f9f1d9dcce30c42dd4be3a
SHA1 62a01c957ca7d637a1d8090475c4ef2843100bb8
SHA512 ef4d785015f24cdf4339e9ab0ce8f824456e3b60d9d605fedaeec2403797b4490949bebb248cc076d1fa3d031f82eb86d517bc1cdb4e009e413433d84a29b20c
SSDEEP 98304:Xez8a1mzYrkxZ8VYKOwErakov9RUxHJTjrhrpLpMOz8C+kj36YtKonKG6Lq7zzYf:Xez12Yo38VLEraBA3nhLMOJ+I3NtKonr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery evasion stealer

Malware Config

Extracted

Family

lumma

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Set-up.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a99adad8a9f9f1d9dcce30c42dd4be3a.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a99adad8a9f9f1d9dcce30c42dd4be3a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a99adad8a9f9f1d9dcce30c42dd4be3a.exe

Executes dropped EXE 2 IoCs

pid	Process
2720	LummaC2.exe
3024	Set-up.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Wine	a99adad8a9f9f1d9dcce30c42dd4be3a.exe

Loads dropped DLL 4 IoCs

pid	Process
2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe
2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe
2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe
2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0003000000018334-19.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a99adad8a9f9f1d9dcce30c42dd4be3a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LummaC2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe
3024	Set-up.exe
3024	Set-up.exe
3024	Set-up.exe
3024	Set-up.exe
3024	Set-up.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2720	2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe	29
PID 2660 wrote to memory of 2720	2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe	29
PID 2660 wrote to memory of 2720	2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe	29
PID 2660 wrote to memory of 2720	2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe	29
PID 2660 wrote to memory of 3024	2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe	30
PID 2660 wrote to memory of 3024	2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe	30
PID 2660 wrote to memory of 3024	2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe	30
PID 2660 wrote to memory of 3024	2660	a99adad8a9f9f1d9dcce30c42dd4be3a.exe	30

C:\Users\Admin\AppData\Local\Temp\a99adad8a9f9f1d9dcce30c42dd4be3a.exe
"C:\Users\Admin\AppData\Local\Temp\a99adad8a9f9f1d9dcce30c42dd4be3a.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\LummaC2.exe
  "C:\Users\Admin\AppData\Local\Temp\LummaC2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\Set-up.exe
  "C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Set-up.exe

Path C:\Users\Admin\AppData\Local\Temp\Set-up.exe
Size 6.5MB
SHA256 73aa5ee19f0ea048dcff2f44d6fd5ac41c13e2d7e61371459e756836f72cad43
MD5 2a99036c44c996cedeb2042d389fe23c
SHA1 4f1e624bcc030e44722de26b72c8156bf57e14e8
SHA512 6907cd0e47293c8c96345ed00f2f3fa2241ce1671ee73a599837857bfb39f6c7e373aad843cc78fb550d2db10bdfe066a021cec4c8a49aecdf06a7e71edadedd
SSDEEP 98304:ty1CDpiB/weoINcERH7q/70/ske9dKVyz8SC:jViB/NooB7edGG8SC
MD5 SHA1 SHA512 SSDEEP

Submit Download

LummaC2.exe

Path \Users\Admin\AppData\Local\Temp\LummaC2.exe
Size 292KB
SHA256 c9831759e15b3a52238c03d0d51db9de0c1a6c7a61a51de72c5869061172e9db
MD5 607000c61fcb5a41b8d511b5ed7625d4
SHA1 dfaa2bfea8a51b14ac089bb6a39f037e769169d1
SHA512 64940f02635ccbc2dcd42449c0c435a6a50bd00fa93d6e2e161371cdc766103ef858ccbaae4497a75576121ea7bc25ba54a9064748f9d6676989a4c9f8b50e58
SSDEEP 6144:R5s/zt4HV88/rCatOZFABeDUbLv0uC8r9qMq2E9ND43F+ZnSi4:8rtsVPrNMG9qwENs8ZJ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2660-0-0x0000000000B40000-0x000000000165A000-memory.dmp

Download

memory/2660-1-0x0000000000B40000-0x000000000165A000-memory.dmp

Download

memory/2660-2-0x0000000000B40000-0x000000000165A000-memory.dmp

Download

memory/2660-23-0x0000000000B40000-0x000000000165A000-memory.dmp

Download

memory/3024-24-0x0000000000340000-0x00000000009D0000-memory.dmp

Download

memory/3024-26-0x0000000000340000-0x00000000009D0000-memory.dmp

Download

memory/3024-30-0x0000000000340000-0x00000000009D0000-memory.dmp

Download

memory/3024-33-0x0000000000340000-0x00000000009D0000-memory.dmp

Download