lumma | add4313bc558d395b550227f6b1e6873ffb1cbb23e146fa3e6f195390439d0db

General

Target

Ps99 Duplicator.exe
Size

507KB
MD5

0b302e592f1cc0c5c10c15dbe7e7769d
SHA1

385e8478c5d84b41578bfddba235df3216ba9536
SHA256

d3c1cad594dc1780682c5360491589898c91a51732c78a66e2a41b0cb35b7d05
SHA512

20157b3cebd76db9d7ad7c32a1baede94bd656d75c2e29a9b9409a28ea89176cc68f8cc9acd46c701e4e38044c2d45585e7c930e42c16ce4fa994679ee4a6747
SSDEEP

12288:Flz+rW2k8wcin+TQj+PmrvW03cgzG9zl:bz+rQ8wcinWa+e

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://fancywaxxers.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 1 IoCs

pid	Process
1176	Ps99 Duplicator.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1176 set thread context of 4804	1176	Ps99 Duplicator.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ps99 Duplicator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	taskmgr.exe
Token: SeSystemProfilePrivilege	3624	taskmgr.exe
Token: SeCreateGlobalPrivilege	3624	taskmgr.exe
Token: 33	3624	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3624	taskmgr.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe
3624	taskmgr.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83
PID 1176 wrote to memory of 4804	1176	Ps99 Duplicator.exe	83

C:\Users\Admin\AppData\Local\Temp\Ps99 Duplicator.exe
"C:\Users\Admin\AppData\Local\Temp\Ps99 Duplicator.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4804

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
448KB

MD5
2ddb4c6c958ca0fa1c7660cc008aaa97

SHA1
cc752c33263a14d3b8f3628e95bbc5f6902cc1fe

SHA256
13b121790d2efdae6fd876e139834a09d3b400af0a7ff9298c0cd0c2184ea40f

SHA512
6b7ef0fe105547b12e5adb6963d405ccfc69691b750c0dcdc581abfa03b79c8ef11fe754692a53e083405484d6c1eee20c0e175e52ce6d70553bcde50b702e05

Download Submit
memory/1176-19-0x0000000075150000-0x0000000075900000-memory.dmp

Filesize
7.7MB

Download
memory/1176-0-0x000000007515E000-0x000000007515F000-memory.dmp

Filesize
4KB

Download
memory/1176-7-0x0000000075150000-0x0000000075900000-memory.dmp

Filesize
7.7MB

Download
memory/1176-9-0x0000000075150000-0x0000000075900000-memory.dmp

Filesize
7.7MB

Download
memory/1176-1-0x0000000000EF0000-0x0000000000F74000-memory.dmp

Filesize
528KB

Download
memory/3624-31-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/3624-20-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/3624-21-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/3624-26-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/3624-32-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/3624-22-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/3624-30-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/3624-29-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/3624-28-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/3624-27-0x000001556D820000-0x000001556D821000-memory.dmp

Filesize
4KB

Download
memory/4804-14-0x0000000001330000-0x000000000139A000-memory.dmp

Filesize
424KB

Download
memory/4804-11-0x0000000001330000-0x000000000139A000-memory.dmp

Filesize
424KB

Download
memory/4804-18-0x0000000001330000-0x000000000139A000-memory.dmp

Filesize
424KB

Download

Analysis

Sharing