lumma | bc845ab964ef0e15f09dc27adc16edb3381e9aac924d5787ef0046dbe62347d0

Resubmissions

06-01-2025 08:53

250106-ktfaravkfl 5

06-01-2025 08:49

250106-kreansskgv 10

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

#Pa$$w0rD__6654--0peɴ_Set-Up#$.zip
Size

7.5MB
MD5

b82b154592009655f2431f3c3e8537c2
SHA1

14a1e65bb14a1c3374b092403fae84514440465c
SHA256

bc845ab964ef0e15f09dc27adc16edb3381e9aac924d5787ef0046dbe62347d0
SHA512

c6cd3afe1cb5888a96ba0dad7e12f359a8cfeb54a36edbfe3b46784174786a1f9db0cb6c6a219839c011779e619609a766bd5ee1de45ec716299dfeffbec873a
SSDEEP

196608:jzsg208CQPnTFcwHHXWAF2zVmSEno4zx8:Mb0srHHXWAUs1e

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
2972	Set-up.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1232	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	Set-up.exe
3068	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3068	7zFM.exe
1232	vlc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	3068	7zFM.exe
Token: 35	3068	7zFM.exe
Token: SeSecurityPrivilege	3068	7zFM.exe
Token: SeSecurityPrivilege	3068	7zFM.exe
Token: SeSecurityPrivilege	3068	7zFM.exe

Suspicious use of FindShellTrayWindow 24 IoCs

pid	Process
3068	7zFM.exe
3068	7zFM.exe
3068	7zFM.exe
3068	7zFM.exe
3068	7zFM.exe
3068	7zFM.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe
1232	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1232	vlc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2972	3068	7zFM.exe	31
PID 3068 wrote to memory of 2972	3068	7zFM.exe	31
PID 3068 wrote to memory of 2972	3068	7zFM.exe	31
PID 3068 wrote to memory of 2972	3068	7zFM.exe	31

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\#Pa$$w0rD__6654--0peɴ_Set-Up#$.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\7zOCFBE0DD7\Set-up.exe
  "C:\Users\Admin\AppData\Local\Temp\7zOCFBE0DD7\Set-up.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

C:\Windows\system32\winver.exe
"C:\Windows\system32\winver.exe"
1⤵
PID:1060

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\WriteUnprotect.mp2"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-36-0x000007FEF55C0000-0x000007FEF55D1000-memory.dmp

Filesize
68KB

Download
memory/1232-47-0x000007FEF41A0000-0x000007FEF41B1000-memory.dmp

Filesize
68KB

Download
memory/1232-31-0x000000013F960000-0x000000013FA58000-memory.dmp

Filesize
992KB

Download
memory/1232-34-0x000007FEF60E0000-0x000007FEF60F8000-memory.dmp

Filesize
96KB

Download
memory/1232-38-0x000007FEF5580000-0x000007FEF5591000-memory.dmp

Filesize
68KB

Download
memory/1232-40-0x000007FEF5540000-0x000007FEF5551000-memory.dmp

Filesize
68KB

Download
memory/1232-39-0x000007FEF5560000-0x000007FEF557D000-memory.dmp

Filesize
116KB

Download
memory/1232-41-0x000007FEF5330000-0x000007FEF553B000-memory.dmp

Filesize
2.0MB

Download
memory/1232-50-0x000007FEF4140000-0x000007FEF4151000-memory.dmp

Filesize
68KB

Download
memory/1232-32-0x000007FEF6100000-0x000007FEF6134000-memory.dmp

Filesize
208KB

Download
memory/1232-37-0x000007FEF55A0000-0x000007FEF55B7000-memory.dmp

Filesize
92KB

Download
memory/1232-35-0x000007FEF60C0000-0x000007FEF60D7000-memory.dmp

Filesize
92KB

Download
memory/1232-43-0x000007FEF4230000-0x000007FEF4271000-memory.dmp

Filesize
260KB

Download
memory/1232-44-0x000007FEF4200000-0x000007FEF4221000-memory.dmp

Filesize
132KB

Download
memory/1232-45-0x000007FEF41E0000-0x000007FEF41F8000-memory.dmp

Filesize
96KB

Download
memory/1232-46-0x000007FEF41C0000-0x000007FEF41D1000-memory.dmp

Filesize
68KB

Download
memory/1232-48-0x000007FEF4180000-0x000007FEF4191000-memory.dmp

Filesize
68KB

Download
memory/1232-33-0x000007FEF5710000-0x000007FEF59C6000-memory.dmp

Filesize
2.7MB

Download
memory/1232-49-0x000007FEF4160000-0x000007FEF417B000-memory.dmp

Filesize
108KB

Download
memory/2972-16-0x0000000001F20000-0x0000000001F77000-memory.dmp

Filesize
348KB

Download