lumma | ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa

General

Target

ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe
Size

718KB
MD5

b4c67501b2783a3c86c8a9b98a5d6798
SHA1

9398be29fc39ce17e01d627050958e2600b324dc
SHA256

ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa
SHA512

84e46ae5711d0585d7e6c5114c3d28b2192fd69228a64f13080ef1b3c99bf40debcb5d82accaeaae0a77d5bae8691edda19eefd8484851ab24108f8735160da0
SSDEEP

12288:1yAtZvj0KxDQsJJr+rwFoKseqaT3ChHLpSjOL1xWONh6WekeI1K5LUpzpVIK8U6+:1yAtmEBQwFHfZTy

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://spellshagey.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 1 IoCs

pid	Process
1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3244	1168	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83
PID 1168 wrote to memory of 2248	1168	ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe	83

C:\Users\Admin\AppData\Local\Temp\ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe
"C:\Users\Admin\AppData\Local\Temp\ee3bcea3ac91ee01a3c4044615a2b9f4667dec5dd54f5935ab3ea23cc1c5e4aa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 1028
  2⤵
  - Program crash
  PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1168 -ip 1168
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
427KB

MD5
9076b45bc5d8605213d289c3d9982f6b

SHA1
c7d2b90764db9b7767f4d968384e371c2e42af08

SHA256
93d7f73c3d8de7d2f51d842cc36196ed60ff4c9df32b9a813dbe6b08e8268d63

SHA512
85a9e09dfbe44287fa58424f5e68477bace4696a361271c6bb979b545ab45fb20649bb277fb334ea68bdb9b4f79f7602ad2aab6a5cdfd1a5468ebe4d0ed29149

Download Submit
memory/1168-0-0x0000000074D5E000-0x0000000074D5F000-memory.dmp

Filesize
4KB

Download
memory/1168-1-0x0000000000E70000-0x0000000000F2C000-memory.dmp

Filesize
752KB

Download
memory/1168-2-0x00000000019C0000-0x00000000019C6000-memory.dmp

Filesize
24KB

Download
memory/1168-8-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/1168-20-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/1168-21-0x0000000074D50000-0x0000000075500000-memory.dmp

Filesize
7.7MB

Download
memory/2248-10-0x00000000012F0000-0x0000000001355000-memory.dmp

Filesize
404KB

Download
memory/2248-19-0x00000000012F0000-0x0000000001355000-memory.dmp

Filesize
404KB

Download
memory/2248-15-0x00000000012F0000-0x0000000001355000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing