lumma | 3a703fe4bc4e4c19f7569b7ba00f1d4dc75bdffc605528e588e54fd789a51301

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wave.exe
Size

513KB
MD5

75ed57737c412920b83115a7f83ab080
SHA1

b0c063d5a3ce591344a3e75b0d6684831e4dd5be
SHA256

465a5e75e0dc8f8ea267e50b10ad2500004351ab9de751a559845a33eb776174
SHA512

856b7d3bb38c8549cacfffcd4ab2bcc850b42fdac6c17ec5169cdd9ee037b04f57aab165590302706d8d70ef022737af9a707646656b8e89bc34e7e3d4a9bc71
SSDEEP

12288:pCNPcUlbc0Lc9bJOqEyBngvKDqcmUPnwYXLFNKScYr:pCWUlbc0LcFJOqEJSD4UPwYXL

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://fancywaxxers.shop/api

Extracted

Family

lumma

https://fancywaxxers.shop/api

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 1 IoCs

pid	Process
3564	Wave.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3564 set thread context of 3560	3564	Wave.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84
PID 3564 wrote to memory of 3560	3564	Wave.exe	84

C:\Users\Admin\AppData\Local\Temp\Wave.exe
"C:\Users\Admin\AppData\Local\Temp\Wave.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
454KB

MD5
d21c3f41ef9c6edbda37fffd0118e8fa

SHA1
2517d28e67e8ae3bc786d40a706b5b3a94cb8eac

SHA256
d185706d8f5f370c07e7ed12483919a6c68193a54728878dde2a019d4cf65755

SHA512
e4f829d4c41e4c149f20b08526806c3e76825f73de28043029134d46f9deede9ad03f2f131535bf807501c838ca4f4858f4d9e24d7e587b8577b528157d61050

Download Submit
memory/3560-9-0x00000000750D0000-0x0000000075133000-memory.dmp

Filesize
396KB

Download
memory/3560-17-0x00000000750D0000-0x0000000075133000-memory.dmp

Filesize
396KB

Download
memory/3560-14-0x00000000750D0000-0x0000000075133000-memory.dmp

Filesize
396KB

Download
memory/3564-0-0x0000000074FBE000-0x0000000074FBF000-memory.dmp

Filesize
4KB

Download
memory/3564-1-0x00000000006C0000-0x0000000000746000-memory.dmp

Filesize
536KB

Download
memory/3564-8-0x0000000074FB0000-0x0000000075760000-memory.dmp

Filesize
7.7MB

Download
memory/3564-19-0x0000000074FB0000-0x0000000075760000-memory.dmp

Filesize
7.7MB

Download
memory/3564-18-0x0000000074FB0000-0x0000000075760000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads