lumma | b225282af8e6d46594acdd8f59a356718ed3217032f1fcb1b5d01dd2c4cc7cda

Analysis

max time kernel
258s
max time network
277s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
21-01-2025 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FusionHacks/FusionLoader v2.1.exe
Size

389KB
MD5

a296f08e999926fc187c79a0ea7d7c14
SHA1

a5f2cc6207321f03d20f602b349bb0ae2f410bed
SHA256

421e096bf07259fc4978f027a8cf4c9e7b530df5c0f73dc9a20f41f1942560e3
SHA512

4c1966624f3b5c2dc9d7bc89f10171ebd869d37c62ef388b611364b5d6c466206257799c96b873ba6ded24bf7e6e070d865f09fedfdc3bdbb690b47f227f7eb0
SSDEEP

6144:Crt64EkclEsXje7XgYRVxKsfbdSGcP+J123ucxkOni3oMG+45xu7jV6RnlwceTuZ:2RAMwYRb/SGcGKk14qAEQlwcKugb2J

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://supplyedtwoz.click/api

https://suggestyuoz.biz/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 4648	2228	FusionLoader v2.1.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3696	2228	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FusionLoader v2.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FusionLoader v2.1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4704	2228	FusionLoader v2.1.exe	81
PID 2228 wrote to memory of 4704	2228	FusionLoader v2.1.exe	81
PID 2228 wrote to memory of 4704	2228	FusionLoader v2.1.exe	81
PID 2228 wrote to memory of 4648	2228	FusionLoader v2.1.exe	82
PID 2228 wrote to memory of 4648	2228	FusionLoader v2.1.exe	82
PID 2228 wrote to memory of 4648	2228	FusionLoader v2.1.exe	82
PID 2228 wrote to memory of 4648	2228	FusionLoader v2.1.exe	82
PID 2228 wrote to memory of 4648	2228	FusionLoader v2.1.exe	82
PID 2228 wrote to memory of 4648	2228	FusionLoader v2.1.exe	82
PID 2228 wrote to memory of 4648	2228	FusionLoader v2.1.exe	82
PID 2228 wrote to memory of 4648	2228	FusionLoader v2.1.exe	82
PID 2228 wrote to memory of 4648	2228	FusionLoader v2.1.exe	82

C:\Users\Admin\AppData\Local\Temp\FusionHacks\FusionLoader v2.1.exe
"C:\Users\Admin\AppData\Local\Temp\FusionHacks\FusionLoader v2.1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\FusionHacks\FusionLoader v2.1.exe
  "C:\Users\Admin\AppData\Local\Temp\FusionHacks\FusionLoader v2.1.exe"
  2⤵
  PID:4704
- C:\Users\Admin\AppData\Local\Temp\FusionHacks\FusionLoader v2.1.exe
  "C:\Users\Admin\AppData\Local\Temp\FusionHacks\FusionLoader v2.1.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 800
  2⤵
  - Program crash
  PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2228 -ip 2228
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-0-0x00000000743AE000-0x00000000743AF000-memory.dmp

Filesize
4KB

Download
memory/2228-1-0x0000000000220000-0x0000000000286000-memory.dmp

Filesize
408KB

Download
memory/2228-2-0x00000000050E0000-0x0000000005686000-memory.dmp

Filesize
5.6MB

Download
memory/2228-7-0x00000000743A0000-0x0000000074B51000-memory.dmp

Filesize
7.7MB

Download
memory/4648-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4648-6-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4648-8-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4648-9-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download