lumma | fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2025, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe
Size 1.1MB
Sample250108-dvr8dasjfv
SHA256 fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f
MD5 d0598443fa9984227105811e5d89b70f
SHA1 3932d4696f4130658fbf2a16e7f771fc756a63cc
SHA512 142ebd6e1bf24d82533355e76bb9433deefdd4ee918ba04cc12419cc17cb564f86af386bf949617e386bffa1e0036ec5db912bc8b985a1de94330b3b14e3fd29
SSDEEP 24576:FnsJ39LyjbJkQFMhmC+6GD9nkKh5OYceEMQ+h0W:FnsHyjtk2MYC5GDT58M7hH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma xred backdoor discovery persistence stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://twistforcepo.cfd/api

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

lumma

https://twistforcepo.cfd/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 3 IoCs

pid	Process
384	._cache_fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe
2848	Synaptics.exe
2736	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3448	EXCEL.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3448	EXCEL.EXE
3448	EXCEL.EXE
3448	EXCEL.EXE
3448	EXCEL.EXE
3448	EXCEL.EXE
3448	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 384	3264	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe	82
PID 3264 wrote to memory of 384	3264	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe	82
PID 3264 wrote to memory of 384	3264	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe	82
PID 3264 wrote to memory of 2848	3264	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe	83
PID 3264 wrote to memory of 2848	3264	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe	83
PID 3264 wrote to memory of 2848	3264	fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe	83
PID 2848 wrote to memory of 2736	2848	Synaptics.exe	84
PID 2848 wrote to memory of 2736	2848	Synaptics.exe	84
PID 2848 wrote to memory of 2736	2848	Synaptics.exe	84

C:\Users\Admin\AppData\Local\Temp\fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe
"C:\Users\Admin\AppData\Local\Temp\fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Admin\AppData\Local\Temp\._cache_fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:384
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2736

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 1.1MB
SHA256 fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f
MD5 d0598443fa9984227105811e5d89b70f
SHA1 3932d4696f4130658fbf2a16e7f771fc756a63cc
SHA512 142ebd6e1bf24d82533355e76bb9433deefdd4ee918ba04cc12419cc17cb564f86af386bf949617e386bffa1e0036ec5db912bc8b985a1de94330b3b14e3fd29
SSDEEP 24576:FnsJ39LyjbJkQFMhmC+6GD9nkKh5OYceEMQ+h0W:FnsHyjtk2MYC5GDT58M7hH
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_fc1595c71b570027b6712c70cafcc075686e14b5702a5a0910f642eb739ac01f.exe
Size 322KB
SHA256 f7e32cce4d55bf0dc2f688466983f6f6aa69f1bdacab7522297125ad04d9ecfc
MD5 8f02ccf024090e3bd52574174749c778
SHA1 73ce3afed686e7157ca919118b62f29f5a423196
SHA512 97d68507db1cacf116e19bae4f01c99d9466aaf3a88f29ad52c4a9168e668ab8262f091ed4c0515d560774a013d53ffd8945ce5347198d6e65c4a7acfc540e9c
SSDEEP 6144:aA6xKh6ckttv2vzCYaF82Dx6AU/AbMQTKhCVnXtn43J7:XkKh6c5bCYaF824EMQ+hCZXq
MD5 SHA1 SHA512 SSDEEP

Submit Download

34C75E00

Path C:\Users\Admin\AppData\Local\Temp\34C75E00
Size 22KB
SHA256 5e9f6463bf3d0c9e711f15d27db5c0388a8354e96c1bf4db7e9e3c5864ab0cf9
MD5 722d6f334b1365f729326592d001f6c3
SHA1 622e3e18f1d1999f719d5a83dc5a9c70e5de72ac
SHA512 ad6743c4a13babde2d86793e852567e8fa77ef6ee97018c4c53ccaaef743b825cfca427dadd4655b165c177aa83833c0e190fc3c722c7aaddbef4b8f8ed292ff
SSDEEP 384:MpaYKGHZxphGQVNVIV9omp+o5bfdmGtarUvNNcyl8rLz41SKxc0bktwChMVzRL:MwY5Z+om4o5b1SrA6rH41SWVzRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

s3NXu5qc.xlsm

Path C:\Users\Admin\AppData\Local\Temp\s3NXu5qc.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2848-104-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/2848-189-0x0000000000400000-0x0000000000513000-memory.dmp

Download

memory/2848-190-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/2848-221-0x0000000000400000-0x0000000000513000-memory.dmp

Download

memory/3264-0-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/3264-101-0x0000000000400000-0x0000000000513000-memory.dmp

Download

memory/3448-136-0x00007FFC838D0000-0x00007FFC838E0000-memory.dmp

Download

memory/3448-137-0x00007FFC838D0000-0x00007FFC838E0000-memory.dmp

Download

memory/3448-138-0x00007FFC838D0000-0x00007FFC838E0000-memory.dmp

Download

memory/3448-139-0x00007FFC838D0000-0x00007FFC838E0000-memory.dmp

Download

memory/3448-140-0x00007FFC838D0000-0x00007FFC838E0000-memory.dmp

Download

memory/3448-141-0x00007FFC81480000-0x00007FFC81490000-memory.dmp

Download

memory/3448-142-0x00007FFC81480000-0x00007FFC81490000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads