lumma | bc845ab964ef0e15f09dc27adc16edb3381e9aac924d5787ef0046dbe62347d0

Analysis

max time kernel
138s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/01/2025, 08:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
#Pa$$w0rD__6654--0peɴ_Set-Up#$.zip
Size 7.5MB
Sample250106-kx1e4asmcy
SHA256 bc845ab964ef0e15f09dc27adc16edb3381e9aac924d5787ef0046dbe62347d0
MD5 b82b154592009655f2431f3c3e8537c2
SHA1 14a1e65bb14a1c3374b092403fae84514440465c
SHA512 c6cd3afe1cb5888a96ba0dad7e12f359a8cfeb54a36edbfe3b46784174786a1f9db0cb6c6a219839c011779e619609a766bd5ee1de45ec716299dfeffbec873a
SSDEEP 196608:jzsg208CQPnTFcwHHXWAF2zVmSEno4zx8:Mb0srHHXWAUs1e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 2 IoCs

pid	Process
1672	Set-up.exe
1944	Set-up.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1672	Set-up.exe
1944	Set-up.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	7zFM.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2764	7zFM.exe
Token: 35	2764	7zFM.exe
Token: SeSecurityPrivilege	2764	7zFM.exe
Token: SeSecurityPrivilege	2764	7zFM.exe
Token: SeRestorePrivilege	300	7zG.exe
Token: 35	300	7zG.exe
Token: SeSecurityPrivilege	300	7zG.exe
Token: SeSecurityPrivilege	300	7zG.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2764	7zFM.exe
2764	7zFM.exe
2764	7zFM.exe
2764	7zFM.exe
300	7zG.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\#Pa$$w0rD__6654--0peɴ_Set-Up#$.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2764

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$\" -ad -an -ai#7zMap2814:116:7zEvent223
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:300

C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$\Set-up.exe
"C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1672

C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$\Set-up.exe
"C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$\Set-up.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

#Pa$$w0rD__6654--0peɴ_Set-Up#$.7z

Path C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$.7z
Size 7.5MB
SHA256 b5dd13a6ac780c83b108281abc9b05ab60901556770fca27e0074243449d5b12
MD5 e2e4aa08af81749382abd08bdae9d5ad
SHA1 3310da15547d8bd20376399e4a5ac9543721500a
SHA512 96155e7076929f18205804a957a10e72e72717e1cf778a2c9e68ebff34773eafbeb0ae56a5d08e2d0d0ef979f8af9861fc9d976c26235ca4314e277a4ead3d0d
SSDEEP 196608:Pzsg208CQPnTFcwHHXWAF2zVmSEno4zxg:Yb0srHHXWAUs1u
MD5 SHA1 SHA512 SSDEEP

Submit Download

htwj

Path C:\Users\Admin\Desktop\#Pa$$w0rD__6654--0peɴ_Set-Up#$\Resources\htwj
Size 2.4MB
SHA256 6bf12cad0c848c4ff37152c30d263188d07da8c5f17dac4f49c2ba0691221add
MD5 ceea78710c5247be6a4dda72a209f3d5
SHA1 92d6cc42c820df8fee42748e1f778d3265cf582a
SHA512 e2164edb3eee4bbf97aca6da81b1d2cb7b35bd2569d72c8f0a9fdf42738ae83100a399c7c831229706d857a4d4adbd5ea5cf1ab50b7c0feb43954bb9a7f44471
SSDEEP 49152:0oW77h3ZeJJ1ubXvArL/wmKYXV78GOWF9xY3IEAWF:jsZeJJcvzmdl7vO4E3I9WF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1672-194-0x0000000000700000-0x0000000000757000-memory.dmp

Download