lumma | 1be130eb73f431227a9f44376468d2efdc30394a34ef182326adc5d42b367e0f

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/12/2024, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

acid88/ez_acid.exe
Size

630KB
MD5

8e73d547065d7b0aae9fbed6f0348ae4
SHA1

9570a2f4d366478a759ba720c99372453c7f4cfd
SHA256

e8d1422445c61ea9e849ad8d7e15021b095431d72887f50693fdb27066b75ee5
SHA512

caf8eafe184c258175d2acb6eaefee90a1007dd0a9c0572efb31fb16f331f3dc1af8f62b4a90160103da45a69aa3208dd9d81e2b48ce43214be31c6ea9f1112a
SSDEEP

12288:AZ+vKqnQB3EoRjkMOsfHCdTlKCXyWZZcGiOJ:Akv6vROsfiuCX1ZcGiOJ

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://spellshagey.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 1 IoCs

pid	Process
2364	ez_acid.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ez_acid.exe

C:\Users\Admin\AppData\Local\Temp\acid88\ez_acid.exe
"C:\Users\Admin\AppData\Local\Temp\acid88\ez_acid.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
619KB

MD5
92f4faa8ce4087e1c866f93ae082cc4e

SHA1
953579e606732e66cc7c5e27c7dbb24587e71c31

SHA256
b64ab108ff715dd2d23ae68a379563ebf1a68f5341c5cdb62545f6914d6e3e8c

SHA512
3a2ef1503d9d50f6156b2d94b1823f6584b389eef352a324be5af924c5e95a42f4578d3180881e8a2a82cbb045de75597ed6cdbf45067f3c4b6cab4a196cbaec

Download Submit
memory/2364-0-0x000000007475E000-0x000000007475F000-memory.dmp

Filesize
4KB

Download
memory/2364-1-0x0000000000D00000-0x0000000000DA4000-memory.dmp

Filesize
656KB

Download
memory/2364-6-0x0000000074750000-0x0000000074E3E000-memory.dmp

Filesize
6.9MB

Download