Overview

overview

10

Static

static

3

d34e7af4d2...ea.exe

windows7-x64

10

d34e7af4d2...ea.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-01-2025 03:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe

  • Size

    19.2MB

  • MD5

    bb0ca87d28e7c1bfd53e3e592e75e684

  • SHA1

    23be4528fe7dd78243845a6a08a88ce68200d59a

  • SHA256

    d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea

  • SHA512

    217effd932ae2b5e21527bcc7a22c0f8a8ae0d89902ef00669ef9cc11463995c8c48d34d0b75b55dd50421c2abf19e8b72289abfbb7757339f825fe6ccdb59a7

  • SSDEEP

    393216:kxVUrUl7eOos7orHgF4n5tZkk5b4EMqbfhYwWMr220ItXVca6cjL6OcaAeEKQHeg:CVUrUl7eOuTg4VkDEMq1YpItB6YOO1Af

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe
    "C:\Users\Admin\AppData\Local\Temp\d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\msit\msit 1.0.1\install\C07CAF6\msit.msi" /qn /norestart AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\d34e7af4d266688eb65118de606ffbeb36d46d488c3be604a5cb240778550cea.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1736583660 "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:648
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 311BCF5DF7D2E60EF7D454BCDD509B84 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:232
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7AC1652BE7840EE5D12515A802145FDF
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5040
    • C:\Windows\Installer\MSI7557.tmp
      "C:\Windows\Installer\MSI7557.tmp"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Windows\SysWOW64\dxdiag.exe
        "C:\Windows\SysWOW64\dxdiag.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e5770ed.rbs
    Filesize

    1KB

    MD5

    1a1fd7b5b923abf577b6b23e0624a9a1

    SHA1

    62d3bf5d18da081513ca9fe2ed3a71dacf134d90

    SHA256

    70dfc5466ea16ec22062c9e35fbd9e63cecf47fc00f098e4c41c652a5aaceb42

    SHA512

    421ce375831368d84923ff297f73d65c0f68d1193ba6fbbfa0dde4cb3c547393d4d95d8ae353bc3b2a9c91cf3edd38c91a2a7e017c1f157905d75f9184dc713f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI66AA.tmp
    Filesize

    997KB

    MD5

    ec6ebf65fe4f361a73e473f46730e05c

    SHA1

    01f946dfbf773f977af5ade7c27fffc7fe311149

    SHA256

    d3614d7bece53e0d408e31da7d9b0ff2f7285a7dd544c778847ed0c5ded5d52f

    SHA512

    e4d7aafa75d07a3071d2739d18b4c2b0a3798f754b339c349db9a6004d031bf02f3970b030cec4a5f55b4c19f03794b0ce186a303d936c222e7e6e8726fffff7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI6B31.tmp
    Filesize

    1.1MB

    MD5

    03cc8828bb0e0105915b7695b1ec8d88

    SHA1

    cbf8ec531ea7e3ee58b51bd642f8bfabdc759ee1

    SHA256

    0e1491ae7344f3a5ec824732648ccdda19b271d6f01471793bf292840fc83b5e

    SHA512

    593a76166eb6ce2e3537b0d93e216daef12e4ab5b181a194b55a90b39a1af2e0374c4ec3833a000530425319a003cd1a648489640fccaf108061ebea1d9cb1e7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI6BAF.tmp
    Filesize

    886KB

    MD5

    accd9092a35e468e8af934accd81e9f6

    SHA1

    3751384e5e586481618002469190e3c1f271ce6d

    SHA256

    8339a5ee92e53a155828e58e7700fc17d4f3f8ecb11daeb52aa1118ba3141ecd

    SHA512

    18e49e56ad2f78db7f4bfabab25cc3ecfcc8180beea8ff162a5d80bd0a6db9eb598f9fa1d5167f078a12f382663a2b205d7e512370e4873a60955a174826e8e3

    Download Submit

  • C:\Users\Admin\AppData\Roaming\msit\msit 1.0.1\install\C07CAF6\TeleportPresets.txt
    Filesize

    740B

    MD5

    dba29b1cc6a0ac337a02a1b600e59e60

    SHA1

    efeff3878b981326da4c70be8f9396f0b6020247

    SHA256

    9331ea0e713c45e2439d7d12709fdd0e1528137c0ef89ae96fb03150d0d9a5de

    SHA512

    e67a41bec75514ecb47ef2b0fe477cb2240ce9254d1656488f1f0e83b86e43e32b316f9deda9a67e731773928f9479cf80dabcefe88c99ac1f7de5dca795109e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\msit\msit 1.0.1\install\C07CAF6\msit.msi
    Filesize

    47.1MB

    MD5

    71b30f6890f9ecf0fabbf1cbbc2427f8

    SHA1

    41c12abedf033ca0e5d0114520b40f4160a20029

    SHA256

    5fe2cd05a7cd3783644e141058408f08427f02ddba6b7bc4220f191a43523a85

    SHA512

    2968e78f4ff28a77b2a6013d70774fed98df3b0cc6496f5d937cf046f37825027e4c2832f9342f0fd61eefda89dd4e1067fd602b9056d9b893be8d0f10628be1

    Download Submit

  • C:\Windows\Installer\MSI7557.tmp
    Filesize

    12.5MB

    MD5

    4d82074854750fdba89d76624cc1e6f6

    SHA1

    1cab8150956317418f64e67692072cac8472b75b

    SHA256

    019cf1aad1f8d4f1b5dae3aa609b2b53cffc3c7894b58b9f0b225868aed7342d

    SHA512

    068bd8c1db17c4def612618d463239f002e8f4712691a8fc9163215bdaa7bc5306aa861c396438c647e7b839c2c67c5709b25e0695e1baa668aa100310255f9d

    Download Submit

  • memory/3672-106-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

    Download

  • memory/3672-107-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

    Download