lumma | f6a6bada54ddce2bc211976e7dfe05c89f4780eab1b992b409dacc7c9b8755b7

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2025, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Release-x64.zip
Size

38.9MB
MD5

36f9005784b19cc8f7448390e997a2c1
SHA1

140fefa1d80a828795c03f52ad28002b5d9635d2
SHA256

f6a6bada54ddce2bc211976e7dfe05c89f4780eab1b992b409dacc7c9b8755b7
SHA512

131d1cbb777c1e428b26b870a9f5626f3ed76c97fb9ef9cfb22fb8204da510336e065e71c18a47b3cc31495082ffcab7a37be88a4922dd2956bb73ef1eb6d76c
SSDEEP

786432:v7mya0tlAZkF2k3ya5OzccWkjzuWUKorpBsdDdtd3vA5BsdDdtd3vAD5:zojZ62u56cceWUvpBsDbo5BsDbo1

Score

10^/10

lumma cryptone discovery packer stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral2/files/0x0007000000023cd1-18.dat	cryptone

Executes dropped EXE 1 IoCs

pid	Process
4040	Bootstrapper.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	4040	WerFault.exe	105

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bootstrapper.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
976	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	976	7zFM.exe
Token: 35	976	7zFM.exe
Token: SeSecurityPrivilege	976	7zFM.exe
Token: SeSecurityPrivilege	976	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
976	7zFM.exe
976	7zFM.exe
976	7zFM.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Release-x64.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2708

C:\Users\Admin\Downloads\Release\Bootstrapper.exe
"C:\Users\Admin\Downloads\Release\Bootstrapper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1276
  2⤵
  - Program crash
  PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4040 -ip 4040
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Downloads\Release\Bootstrapper.exe

Filesize
304KB

MD5
79f0a3279859e8b69226a57ba343b3de

SHA1
108593b52ac5367411ceb201c43d0dc1a8d43013

SHA256
87ab9777bb83462f3deebcfb858ca8ec46bf6e647961920748725ba3f9b905b5

SHA512
8db7cca52500465df1f13d7c557908fe7aaec8b59c204c62ba5adeab2c7a3fc9cdc255b1f3bf6b7bb619d0546551208df5fb1fa4fc9b1ba8be2ffdeec49e31fd

Download Submit
C:\Users\Admin\Downloads\Release\scripts\local

Filesize
18.7MB

MD5
88fd7dbf04bcf75123d02009aea3f7f7

SHA1
cecf16bdad71e54afc941179ea2b7438a04efa1d

SHA256
01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4

SHA512
2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917

Download Submit
memory/4040-26-0x00000000021C0000-0x00000000021EE000-memory.dmp

Filesize
184KB

Download
memory/4040-27-0x00000000021F0000-0x000000000223D000-memory.dmp

Filesize
308KB

Download
memory/4040-28-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4040-29-0x00000000021C0000-0x00000000021EE000-memory.dmp

Filesize
184KB

Download
memory/4040-30-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4040-31-0x00000000021F0000-0x000000000223D000-memory.dmp

Filesize
308KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads