lumma | 5f01f121168983ab53d3e4e523e344e3a78abdc3ca66cc2be0b54c8f755d8fbb

General

Target

ng-32948238493-18-1-25.zip
Size

1.3MB
MD5

8ef10cb39cf040535382e7fbe0cbd17c
SHA1

4beccbef5a235de2c6305946c2200f768fa81ca6
SHA256

5f01f121168983ab53d3e4e523e344e3a78abdc3ca66cc2be0b54c8f755d8fbb
SHA512

84169105a3af1bb44735bd3ba25de2e9704593f626d439e1f978a1b12eeb17faffe4fa89dd02778406101d6193932a0d6304e895340f8a0ae06104474590d843
SSDEEP

24576:y7ON2caVsuah8AI+ui5FXBz63nAbSunVPMqzlfud+xJeBW/ikBRrDi2AeH5XW:y7OkcaVJjAI+JPz4AbSux1ZJMW5BNeeI

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

C2

https://aggresiwevommen.cyou/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 3 IoCs

pid	Process
4072	steamerrorreporter.exe
4808	steamerrorreporter.exe
1988	steamerrorreporter.exe

Loads dropped DLL 4 IoCs

pid	Process
4808	steamerrorreporter.exe
4808	steamerrorreporter.exe
1988	steamerrorreporter.exe
1988	steamerrorreporter.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 4180	1988	steamerrorreporter.exe	110

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamerrorreporter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamerrorreporter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamerrorreporter.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1168	7zFM.exe
1168	7zFM.exe
4808	steamerrorreporter.exe
1988	steamerrorreporter.exe
1988	steamerrorreporter.exe
4180	cmd.exe
4180	cmd.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1168	7zFM.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1988	steamerrorreporter.exe
4180	cmd.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	1168	7zFM.exe
Token: 35	1168	7zFM.exe
Token: SeSecurityPrivilege	1168	7zFM.exe
Token: SeSecurityPrivilege	1168	7zFM.exe
Token: SeSecurityPrivilege	1168	7zFM.exe
Token: SeDebugPrivilege	744	taskmgr.exe
Token: SeSystemProfilePrivilege	744	taskmgr.exe
Token: SeCreateGlobalPrivilege	744	taskmgr.exe
Token: 33	744	taskmgr.exe
Token: SeIncBasePriorityPrivilege	744	taskmgr.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1168	7zFM.exe
1168	7zFM.exe
1168	7zFM.exe
1168	7zFM.exe
1168	7zFM.exe
1168	7zFM.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe
744	taskmgr.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 4072	1168	7zFM.exe	101
PID 1168 wrote to memory of 4072	1168	7zFM.exe	101
PID 1168 wrote to memory of 4072	1168	7zFM.exe	101
PID 4808 wrote to memory of 1988	4808	steamerrorreporter.exe	109
PID 4808 wrote to memory of 1988	4808	steamerrorreporter.exe	109
PID 4808 wrote to memory of 1988	4808	steamerrorreporter.exe	109
PID 1988 wrote to memory of 4180	1988	steamerrorreporter.exe	110
PID 1988 wrote to memory of 4180	1988	steamerrorreporter.exe	110
PID 1988 wrote to memory of 4180	1988	steamerrorreporter.exe	110
PID 1988 wrote to memory of 4180	1988	steamerrorreporter.exe	110
PID 4180 wrote to memory of 2444	4180	cmd.exe	113
PID 4180 wrote to memory of 2444	4180	cmd.exe	113
PID 4180 wrote to memory of 2444	4180	cmd.exe	113
PID 4180 wrote to memory of 2444	4180	cmd.exe	113

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ng-32948238493-18-1-25.zip"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\7zO094D8688\steamerrorreporter.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO094D8688\steamerrorreporter.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4072

C:\Users\Admin\Desktop\steamerrorreporter.exe
"C:\Users\Admin\Desktop\steamerrorreporter.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Roaming\javastream_test1\steamerrorreporter.exe
  C:\Users\Admin\AppData\Roaming\javastream_test1\steamerrorreporter.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2444

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO094D8688\steamerrorreporter.exe

Filesize
560KB

MD5
dc1681b98049f1df46dd10d7f4c26045

SHA1
4c7f5cf7c00b6139979f8aa41f46979666369224

SHA256
594f9853124e0a81deeaaecb8ec3d192169e7393778214ef6d8f6460450ef080

SHA512
c9a2086326acbab8aba801da0d8bd2aa06951ec7fd7f32a3150f9521498c0b6711552695fbf9d0de7668503630c508bcd68e1d715796ef34f9945035da3fe1ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\98d8689d

Filesize
1016KB

MD5
f377b97e4452de37f1f180a0cf6fd63c

SHA1
736fd2caba9c0f10afb3d36cc3a38b552c31a68b

SHA256
f9d458e63291d7e97dcddd27a91236d7a0634d88b9a6abfd24ce8757ccce6343

SHA512
1bc87eba59a125c3c2f234315d02912bfb0f726983fb37f3650788dbf83bc9a72c51e8158d72120e059f0223dcee50a9e61e432a6ad80d3a8f6cf9bdf3b64c6b

Download Submit
C:\Users\Admin\Desktop\cochlea.torrent

Filesize
55KB

MD5
495344e71846d9e9f55219dd173b8bd8

SHA1
728a127f624ffd35a65e63f9a82c2afe4c622be1

SHA256
4e07702ab4eb53cb3932dea092905b10bdc0299e0b8b3ac98cf7f213f12ad3c5

SHA512
dd77bec78b5b1d457bda9dd4c44175916fce42934a6a30a4bdfe8561ada05ef00aacd05aa366288baa943b3ef2fc7fd6ac1ea5a617d493072e050fd937fc2435

Download Submit
C:\Users\Admin\Desktop\tier0_s.dll

Filesize
341KB

MD5
884013332bf332e4dd8cbf0109a8cfeb

SHA1
c01789d661d465ca29d20174d8f5d29afb1fcffa

SHA256
8ed104f6d7a50f95d515005bf6bd5569cd2dc0107119aa3d91e21dd7ba777e98

SHA512
ea18f416b1295edcfc197c685d56030246097bf95ffffa46f13a16753d05d95a1adb83b5ba0669eaa1049856ea2486ca0fc49507df7d41572de80701e9852f64

Download Submit
C:\Users\Admin\Desktop\vstdlib_s.dll

Filesize
519KB

MD5
5c245a8bc2765f02b838db613a2cdb49

SHA1
0952a9edaeebcb4afb1f746cc08e044ac2f2a4e3

SHA256
411fe1b7a84923e849be6844768240da54122f02dbe9611aa18f33e765ad108a

SHA512
ca2235ea5c01b173106cd33ead51ba4877cd85dcf978fe5468ab1b85b173ce2f85d2e846c4bd278cbffebd82b35674f3b2497271c25658536623f1d7aaee0f8f

Download Submit
C:\Users\Admin\Desktop\wharf.indd

Filesize
775KB

MD5
3ea96a50807b3a6bb83557d94c8f9086

SHA1
1e3f8ddfd9eef1e3b73d228f3da3ab154514f381

SHA256
f56b4dc0c747d09582debee8014ba7c915b7c0b3888e1022795547a983d83c10

SHA512
31b417c4f21a4fdaacc87df63d63822f99b1d64406b979d11d3c70026c602846470270508c419faf3ed3106654df55be6ee9d8323b0777d1765d92ad8f65cce4

Download Submit
memory/744-61-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/744-60-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/744-58-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/744-59-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/744-62-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/744-63-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/744-52-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/744-54-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/744-53-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/744-64-0x000001C2F3EC0000-0x000001C2F3EC1000-memory.dmp

Filesize
4KB

Download
memory/1988-46-0x0000000074F30000-0x00000000750AB000-memory.dmp

Filesize
1.5MB

Download
memory/1988-48-0x0000000074F30000-0x00000000750AB000-memory.dmp

Filesize
1.5MB

Download
memory/1988-47-0x00007FF8DC9F0000-0x00007FF8DCBE5000-memory.dmp

Filesize
2.0MB

Download
memory/2444-67-0x00007FF8DC9F0000-0x00007FF8DCBE5000-memory.dmp

Filesize
2.0MB

Download
memory/2444-68-0x0000000000CD0000-0x0000000000D26000-memory.dmp

Filesize
344KB

Download
memory/4180-51-0x00007FF8DC9F0000-0x00007FF8DCBE5000-memory.dmp

Filesize
2.0MB

Download
memory/4180-65-0x0000000074F30000-0x00000000750AB000-memory.dmp

Filesize
1.5MB

Download
memory/4808-31-0x00007FF8DC9F0000-0x00007FF8DCBE5000-memory.dmp

Filesize
2.0MB

Download
memory/4808-30-0x0000000074F30000-0x00000000750AB000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing