lumma | 9d3bff1e8d84def24d52982b30cdda2403fb5645ac7e1b6fa7143c3810bb664d

Analysis

max time kernel
92s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-01-2025 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Exloader/exland_setup_v3.exe
Size

519KB
MD5

e65b9d796febfbf98d7887a2c50a11cc
SHA1

b3f0697389f8c58838db281f23f1740053e5416b
SHA256

12fe4165742c6d9020723d6abb9a1c10c3fa738e52ac353690780615af7f895c
SHA512

c09f291e374c5f2b001ec657881b3206a902a3eaa15564dc47be8d9acebe709f4b4ee1278e4f38d1ece31f4657f7b440444ffbb228b8fdf58d1dfcf13ad08aff
SSDEEP

12288:buYx6vQBHZi+4dD/aCXRYdAIo6QTcutL547S:bFsYBHZi+4dD/aChYdAIohTDL

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://robinsharez.shop/api

https://handscreamny.shop/api

https://chipdonkeruz.shop/api

https://versersleep.shop/api

https://crowdwarek.shop/api

https://apporholis.shop/api

https://femalsabler.shop/api

https://soundtappysk.shop/api

https://letterdrive.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Loads dropped DLL 1 IoCs

pid	Process
3664	exland_setup_v3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3664 set thread context of 2424	3664	exland_setup_v3.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exland_setup_v3.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83
PID 3664 wrote to memory of 2424	3664	exland_setup_v3.exe	83

C:\Users\Admin\AppData\Local\Temp\Exloader\exland_setup_v3.exe
"C:\Users\Admin\AppData\Local\Temp\Exloader\exland_setup_v3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
460KB

MD5
dbabcaafb00ee630d0c6ed9584182247

SHA1
abf1f026573fbcc43e65f488d74af589104aa1f6

SHA256
3247cdc1d68e4c0c518b642d37197b52bc2e21730545165c18755b83b6581cc2

SHA512
5f64e281893fee417200f0c400d14346eca8c27393c1b354e49d6ebbbc10a666469f35a78df34f4fa90fe4777f8ced6c2807064d39ad47c04b002010b82d9ddc

Download Submit
memory/2424-9-0x0000000000F90000-0x0000000000FEB000-memory.dmp

Filesize
364KB

Download
memory/2424-16-0x0000000000F90000-0x0000000000FEB000-memory.dmp

Filesize
364KB

Download
memory/2424-19-0x0000000000F90000-0x0000000000FEB000-memory.dmp

Filesize
364KB

Download
memory/3664-0-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download
memory/3664-1-0x00000000009C0000-0x0000000000A48000-memory.dmp

Filesize
544KB

Download
memory/3664-8-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/3664-12-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/3664-11-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download