lumma | 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad

Analysis

max time kernel
94s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2025, 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe
Size

488KB
MD5

4e54c5e3ad2d51863f7bc5ba732f3b3d
SHA1

db604b209f42ab64a3af4d7d81d54ae51c520188
SHA256

8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad
SHA512

30522976db4dc4fd512fb1c61e8d43a42b27b8d1b12ea5028743cd2a7fe3b9300e6551b0180bf462d433aa1c76f570985b842e4153819dae8d911c3705ed92d0
SSDEEP

12288:EQNbVxTVzC+QjqzIUBVDN/u3JBLdih8dEho8HzA0l8mbH3su8d:EQNJtVzC+QjqzDtu3JBRw8dES8zjl

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 1 IoCs

pid	Process
920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 920 set thread context of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83
PID 920 wrote to memory of 3228	920	8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe	83

C:\Users\Admin\AppData\Local\Temp\8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe
"C:\Users\Admin\AppData\Local\Temp\8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
428KB

MD5
16b4ba7659f12778088d2f76ac4ecc64

SHA1
63050c063455316a565e426112a7561a547e13ec

SHA256
dab9fd3f8c26bb886c711c08ae58666571325ac621d3b01bf56bde67ebb56f19

SHA512
b059bbaf663e487c418ae341c4095e6450a981b7f392b66100d925b8fd799b898f804f0d3bdc8ce0d106326f019e8c80b5e5b9df5206c915c7df398a70a8e78b

Download Submit
memory/920-0-0x000000007531E000-0x000000007531F000-memory.dmp

Filesize
4KB

Download
memory/920-1-0x0000000000780000-0x0000000000800000-memory.dmp

Filesize
512KB

Download
memory/920-8-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/920-18-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/920-19-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/3228-17-0x0000000000F30000-0x0000000000F8C000-memory.dmp

Filesize
368KB

Download
memory/3228-13-0x0000000000F30000-0x0000000000F8C000-memory.dmp

Filesize
368KB

Download
memory/3228-9-0x0000000000F30000-0x0000000000F8C000-memory.dmp

Filesize
368KB

Download