lumma | 633da69035ee5fe3ee2f2f006eab37321c7c127e0a5c39ecaea9a38acc5cb228

Resubmissions

06/01/2025, 23:22

250106-3c2frssnew10

06/01/2025, 23:22

250106-3chzessncw10

Analysis

max time kernel
426s
max time network
428s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
06/01/2025, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 1.1MB
Sample250106-3c2frssnew
SHA256 633da69035ee5fe3ee2f2f006eab37321c7c127e0a5c39ecaea9a38acc5cb228
MD5 873f5709bf55a0aaf991044c645cf8eb
SHA1 feb9447ba639dff591fb3202dc2709e721e27def
SHA512 e49db202a6736eb684d896ee6bf7f0192876977eaa5202c5945948b0aea08c043b3df1cdfc58ded3bde51b2bd2ec86f6f3c180b364f9c3470ea82524c24fa398
SSDEEP 24576:chYvug7sUOQNncXfPm+9zxBRj0oLvcXwH4OPFvpGIr7CJZ:ALg7s0Kzx/j7zcXwJPFx17m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://yokesandusj.sbs/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 1 IoCs

pid	Process
784	M.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3768	tasklist.exe
2732	tasklist.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BeginnersPhotograph	Setup.exe
File opened for modification	C:\Windows\AffiliatesTip	Setup.exe
File opened for modification	C:\Windows\AnalysesDoctors	Setup.exe
File opened for modification	C:\Windows\RapidlyFinland	Setup.exe
File opened for modification	C:\Windows\DeutschMarc	Setup.exe
File opened for modification	C:\Windows\MemorabiliaEnvironmental	Setup.exe
File opened for modification	C:\Windows\LimitationReid	Setup.exe
File opened for modification	C:\Windows\WhyBedroom	Setup.exe
File opened for modification	C:\Windows\UpdatesLiked	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
784	M.com
784	M.com
784	M.com
784	M.com
784	M.com
784	M.com

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3768	tasklist.exe
Token: SeDebugPrivilege	2732	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
784	M.com
784	M.com
784	M.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
784	M.com
784	M.com
784	M.com

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 760	2792	Setup.exe	85
PID 2792 wrote to memory of 760	2792	Setup.exe	85
PID 2792 wrote to memory of 760	2792	Setup.exe	85
PID 760 wrote to memory of 3768	760	cmd.exe	87
PID 760 wrote to memory of 3768	760	cmd.exe	87
PID 760 wrote to memory of 3768	760	cmd.exe	87
PID 760 wrote to memory of 912	760	cmd.exe	88
PID 760 wrote to memory of 912	760	cmd.exe	88
PID 760 wrote to memory of 912	760	cmd.exe	88
PID 760 wrote to memory of 2732	760	cmd.exe	90
PID 760 wrote to memory of 2732	760	cmd.exe	90
PID 760 wrote to memory of 2732	760	cmd.exe	90
PID 760 wrote to memory of 3276	760	cmd.exe	91
PID 760 wrote to memory of 3276	760	cmd.exe	91
PID 760 wrote to memory of 3276	760	cmd.exe	91
PID 760 wrote to memory of 4472	760	cmd.exe	92
PID 760 wrote to memory of 4472	760	cmd.exe	92
PID 760 wrote to memory of 4472	760	cmd.exe	92
PID 760 wrote to memory of 2112	760	cmd.exe	93
PID 760 wrote to memory of 2112	760	cmd.exe	93
PID 760 wrote to memory of 2112	760	cmd.exe	93
PID 760 wrote to memory of 4608	760	cmd.exe	96
PID 760 wrote to memory of 4608	760	cmd.exe	96
PID 760 wrote to memory of 4608	760	cmd.exe	96
PID 760 wrote to memory of 4240	760	cmd.exe	97
PID 760 wrote to memory of 4240	760	cmd.exe	97
PID 760 wrote to memory of 4240	760	cmd.exe	97
PID 760 wrote to memory of 1188	760	cmd.exe	98
PID 760 wrote to memory of 1188	760	cmd.exe	98
PID 760 wrote to memory of 1188	760	cmd.exe	98
PID 760 wrote to memory of 784	760	cmd.exe	99
PID 760 wrote to memory of 784	760	cmd.exe	99
PID 760 wrote to memory of 784	760	cmd.exe	99
PID 760 wrote to memory of 4708	760	cmd.exe	100
PID 760 wrote to memory of 4708	760	cmd.exe	100
PID 760 wrote to memory of 4708	760	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Archive Archive.cmd & Archive.cmd
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3768
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:912
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\SysWOW64\findstr.exe
    findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 811185
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Thousand
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2112
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "makes" Makes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 811185\M.com + Symbol + Bang + Sons + Prefix + Re + Answers + Frank + Chancellor + Enable 811185\M.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Gather + ..\Intend + ..\Couple + ..\Und + ..\Desktop + ..\Laboratories + ..\Leonard c
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1188
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\811185\M.com
    M.com c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:784
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

M.com

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\811185\M.com
Size 1KB
SHA256 dd4af202f0d79e91c3c49c6f9fd340f0016c6df65c207d884c6ded0d3feab9fb
MD5 ab24984f65e3521010f6ddb0930ce019
SHA1 e80746a4e169e68a6916f261d7ae41ee5262ddbb
SHA512 021d7f814fdb5db28880c29714fb9ff94bd858c797e9c178e374b2316e4b1f6e78f366fbfb4ba95237917e1b154d7dbd471812f3d15d8798c0df59ae39673188
MD5 SHA1 SHA512

Submit Download

M.com

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\811185\M.com
Size 925KB
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f
SSDEEP 24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\811185\c
Size 511KB
SHA256 892a47eda407113d570628be1967a42b3dad57e69d6bfd0df44a36ef630d74f3
MD5 c968adcbb493dc9d2a82f36eaa9e95f8
SHA1 282c85e77b6237addcf74a0b939fd16efe84f502
SHA512 028ba278b02c7cdd83314c46e05044f9e6f756b14749da6380a69a3154f2d6689ea9433d83c5122cf79de764be211119abfd7c385439a9feec4f4047628a3c3e
SSDEEP 12288:XO85Bw8NKm6/tt3yxwtIxJGNFexzpeD2PQbMMRi2/YrgMrpUj1j6:e8uT/tt3yxwtIQF2Pq8NdrOjg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Answers

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Answers
Size 50KB
SHA256 7c9cc1aff714e9fc46a16590bfd851de16430c97aee84c3753c6e8cd04cdd515
MD5 c0ef729745f6117c348bedb0eb004abe
SHA1 2031216f14e729ce341e8ad0d21c1d33a5c17e2a
SHA512 ba4b20471c72de6c22af3aacd7418ed506b13160ed32ed28b4e91a2199ad1137b3df06d9221a3217490ff84d00aeec03b70a488f5acf22dd3d2fcb268606119e
SSDEEP 1536:Xe6YF640L6wy4Za9IN3YRYfv2j62SfuVGHj1vtK7h6R8a5:Xe6u640ewy4Za9coRC2jfTq8u
MD5 SHA1 SHA512 SSDEEP

Submit Download