lumma | 3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2025 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe
Size

510KB
MD5

d7c19448212a2d2960fbcec60e668e39
SHA1

7150862dbbfe9f861da1d7871933479ba0d24ceb
SHA256

3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d
SHA512

58dbf4391abb00c1b5b6c7b61bf678510480ffa595a7ff9c9142d23497acd367a64e2db6647d39276b4d10b0a4f15def3f10019350d997127a6771f0d454e6fb
SSDEEP

6144:ZH0eGrsB+w9Yz8LNbdx3PFX4NNn0cRXFpAolJyY3xAcl+qiFCSzp8ix9tpqlURxY:YoDAYBTQB5zr1KcpiFCAp1clURx3xG3

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://fancywaxxers.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 1 IoCs

pid	Process
184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 184 set thread context of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85
PID 184 wrote to memory of 1732	184	3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe	85

C:\Users\Admin\AppData\Local\Temp\3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe
"C:\Users\Admin\AppData\Local\Temp\3a0f19ba09f4af8c4744eb733f4236803228cc2bf8b96c1a7d5c29851e5ef08d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
451KB

MD5
c606d229690e71ba231d514666883855

SHA1
34a4c73de42dd6b45238134a4fb58a3832489a95

SHA256
65d42bcfc61aa38056ba9d37b1bef99d6e1c55851b66ac4a4e7a61a2592322e8

SHA512
ab2af63e4606c5ba32459af3b264915cd51c3eb943c058285934666561ba9817a5ab3d1a71056c99566cf791e874a65ef70e98bd2baf7224a41d4b8e3a00bb2e

Download Submit
memory/184-0-0x00000000751CE000-0x00000000751CF000-memory.dmp

Filesize
4KB

Download
memory/184-1-0x0000000000D70000-0x0000000000DF6000-memory.dmp

Filesize
536KB

Download
memory/184-8-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/184-18-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/1732-17-0x0000000001200000-0x000000000125A000-memory.dmp

Filesize
360KB

Download
memory/1732-10-0x0000000001200000-0x000000000125A000-memory.dmp

Filesize
360KB

Download
memory/1732-14-0x0000000001200000-0x000000000125A000-memory.dmp

Filesize
360KB

Download