lumma | 14dc380896e6d3631ced48498b0d552c9b0585764fdd666bf26bb7d8fca15eaf

General

Target

SbieCtrl.exe
Size

3.2MB
MD5

b258355c6111fc69e4fba1c4c9c7ad44
SHA1

4fc0ad0b5246ef80e94929104483d8264c673481
SHA256

a1dfdadb5d8aa92efb1edb2ff281f205d14d10526b1b70272af121a5ed64f1fa
SHA512

d586baa499a27772631972ba5b5afa6ae7b0b94709c04e67b9b5a15ca7fd73788d0919e09be3873ab1956449dfbbc27eccbff4b506d61012f3ce2f162392f0a2
SSDEEP

49152:RVun9dkI2fZKTRQOXjuOvDApXkFDbHMnE++X3mDWRPhm3K9IMrPTfRmsHxQK2GWH:RufvCcuE++hhm3grNmsRQKW0jijZ

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

C2

https://sensatiogener.sbs/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
3004	SbieCtrl.exe

Loads dropped DLL 1 IoCs

pid	Process
3004	SbieCtrl.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 2468	3004	SbieCtrl.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3040	SbieCtrl.exe
3004	SbieCtrl.exe
3004	SbieCtrl.exe
2468	cmd.exe
2468	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3004	SbieCtrl.exe
2468	cmd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3004	3040	SbieCtrl.exe	83
PID 3040 wrote to memory of 3004	3040	SbieCtrl.exe	83
PID 3004 wrote to memory of 2468	3004	SbieCtrl.exe	84
PID 3004 wrote to memory of 2468	3004	SbieCtrl.exe	84
PID 3004 wrote to memory of 2468	3004	SbieCtrl.exe	84
PID 3004 wrote to memory of 2468	3004	SbieCtrl.exe	84
PID 2468 wrote to memory of 5056	2468	cmd.exe	99
PID 2468 wrote to memory of 5056	2468	cmd.exe	99
PID 2468 wrote to memory of 5056	2468	cmd.exe	99
PID 2468 wrote to memory of 5056	2468	cmd.exe	99
PID 2468 wrote to memory of 5056	2468	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\SbieCtrl.exe
"C:\Users\Admin\AppData\Local\Temp\SbieCtrl.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Roaming\quickSecurity\SbieCtrl.exe
  C:\Users\Admin\AppData\Roaming\quickSecurity\SbieCtrl.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\27c318f2

Filesize
1.0MB

MD5
1528f4b90ad7a4f2f06bda1591031c97

SHA1
6752ca53be8e2044c784ee7f68f6299eeed4d9f4

SHA256
639b9be058400ee38b78871e16e8623409a79c3abd22e658aa70bccaf667fc6c

SHA512
9d57fcce34e9e792e656f45b9aa11631ab3e994638b1609cce173de8f67b41d2493b575cd62afaa55fa50d2486f2fbcf4564e20a828c346a9b1796540f900536

Download Submit
C:\Users\Admin\AppData\Roaming\quickSecurity\SbieCtrl.exe

Filesize
3.2MB

MD5
b258355c6111fc69e4fba1c4c9c7ad44

SHA1
4fc0ad0b5246ef80e94929104483d8264c673481

SHA256
a1dfdadb5d8aa92efb1edb2ff281f205d14d10526b1b70272af121a5ed64f1fa

SHA512
d586baa499a27772631972ba5b5afa6ae7b0b94709c04e67b9b5a15ca7fd73788d0919e09be3873ab1956449dfbbc27eccbff4b506d61012f3ce2f162392f0a2

Download Submit
C:\Users\Admin\AppData\Roaming\quickSecurity\SbieDll.dll

Filesize
856KB

MD5
cd327c365959c281d561ff224ebb3fab

SHA1
1528b10d3d04e95d722bc9443c20522dd4e89e0e

SHA256
dc4f7b5aeb5b15a72ea230112986db9b2f8ef6c970fb74930cdd2188a4397e1b

SHA512
ec8c4be844ba0f50f070d1e533c165d30c3a90b38b837e58c4ed966a9e9cc4fd41ece013458fcf7c3d3c244024f8b4cb213d39f0819210334430d39a4452c955

Download Submit
C:\Users\Admin\AppData\Roaming\quickSecurity\boche.tif

Filesize
791KB

MD5
0efa9cd7b301e983f6e3b412f14f6252

SHA1
1fd1d2338bd41d4a3ef2545da8e19f67f9775c80

SHA256
b773e68c4801f933becf780b260bfb0d00094ca61df33feae4b52bf49772a07e

SHA512
92c52b03234256fdd6371853625e83c97048a7abb8602a52d73d63217e85d52832f60b6cb4f6b1d86b78c73c2169a748e0ae1a6f4ec38386267b23ef5193ff3f

Download Submit
C:\Users\Admin\AppData\Roaming\quickSecurity\medina.rtf

Filesize
37KB

MD5
d125cedbbfe725a94948561401f0a555

SHA1
3b2484f8600f42ebbeb89093b8efeab4cb173c37

SHA256
c10719865726f362838d5ac424bfb83679e9c8e27743894faeccc5c2d55dc07f

SHA512
18280f1741ff0f3d93d7f476974d736fdf67678fd0e53b277459203679e43fdea48423e4c43122ecc7cf605ca0a197788bb446753f52c24820b1fc1870d9fef5

Download Submit
memory/2468-19-0x00000000754D0000-0x000000007564B000-memory.dmp

Filesize
1.5MB

Download
memory/2468-20-0x00000000754DE000-0x00000000754E0000-memory.dmp

Filesize
8KB

Download
memory/2468-26-0x00000000754DE000-0x00000000754E0000-memory.dmp

Filesize
8KB

Download
memory/2468-25-0x00000000754D0000-0x000000007564B000-memory.dmp

Filesize
1.5MB

Download
memory/2468-21-0x00000000754D0000-0x000000007564B000-memory.dmp

Filesize
1.5MB

Download
memory/2468-18-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

Filesize
2.0MB

Download
memory/3004-12-0x00007FFA39B90000-0x00007FFA39D02000-memory.dmp

Filesize
1.4MB

Download
memory/3004-13-0x00007FFA39BA9000-0x00007FFA39BAA000-memory.dmp

Filesize
4KB

Download
memory/3004-15-0x00007FFA39B90000-0x00007FFA39D02000-memory.dmp

Filesize
1.4MB

Download
memory/3004-14-0x00007FFA39B90000-0x00007FFA39D02000-memory.dmp

Filesize
1.4MB

Download
memory/3040-0-0x00007FFA39B90000-0x00007FFA39D02000-memory.dmp

Filesize
1.4MB

Download
memory/5056-27-0x0000000000A50000-0x0000000000AA8000-memory.dmp

Filesize
352KB

Download
memory/5056-28-0x00007FFA57950000-0x00007FFA57B45000-memory.dmp

Filesize
2.0MB

Download
memory/5056-29-0x0000000000A50000-0x0000000000AA8000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing