lumma | 9994b9e197b422529221de7238dc0e44ae21e66d78c48355f31837c3696ec90e

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe
Size

297KB
MD5

cf19765d8a9a2c2fd11a7a8c4ba3deda
SHA1

63b5142b07b7773d4201932e7834ac11eafa1ab3
SHA256

60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c
SHA512

b97fc305bd0d22e26abf99e302b166cd5d2bb959eddecad0f45dc978761178f5f6d47788c4ad5098313e587198abc66a3477ed42203345c20dc07db4783bb762
SSDEEP

6144:thP45uoAaSWyz8jVnA183ipgz7YGGmEOM8xm53Jhuy3/uL:t25uDiyzmR7kYVxm5i+2L

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://servicedny.site/api

https://authorisev.site/api

https://faulteyotk.site/api

https://dilemmadu.site/api

https://contemteny.site/api

https://goalyfeastz.site/api

https://opposezmny.site/api

https://seallysl.site/api

https://mafnufacut.cyou/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 1 IoCs

pid	Process
4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4680 set thread context of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83
PID 4680 wrote to memory of 1208	4680	60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe	83

C:\Users\Admin\AppData\Local\Temp\60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe
"C:\Users\Admin\AppData\Local\Temp\60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
435KB

MD5
330f34f58ccf18d73fd3762d200a21f9

SHA1
3c5b99bcbd2d8e1a02040a8b25aebdbd274f422c

SHA256
9110eaaf2945deb7a1af94855f90ff10a342ae5ef8d70758d5924fa2371d92fd

SHA512
6df28801cdf4a6f59481e3ac93d50637308be7206958b2cb395cc74fa851bcd2e25fe5f9e926db2b537f0eef9cc32eb2a96c3e821a0c51ee57e1b8ee4aaa90cb

Download Submit
memory/1208-10-0x0000000002730000-0x0000000002797000-memory.dmp

Filesize
412KB

Download
memory/1208-14-0x0000000002730000-0x0000000002797000-memory.dmp

Filesize
412KB

Download
memory/1208-18-0x0000000002730000-0x0000000002797000-memory.dmp

Filesize
412KB

Download
memory/4680-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

Filesize
4KB

Download
memory/4680-1-0x00000000002C0000-0x0000000000310000-memory.dmp

Filesize
320KB

Download
memory/4680-2-0x0000000004C30000-0x0000000004C36000-memory.dmp

Filesize
24KB

Download
memory/4680-9-0x0000000074C90000-0x0000000075440000-memory.dmp

Filesize
7.7MB

Download
memory/4680-20-0x0000000074C90000-0x0000000075440000-memory.dmp

Filesize
7.7MB

Download
memory/4680-19-0x0000000074C90000-0x0000000075440000-memory.dmp

Filesize
7.7MB

Download