lumma | ffcba56c943bd2e56ccc64c5c7b2b8d30d6068ef97a2c7245b54a3281bd75d48

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

𝐒𝐞𝐭𝐮𝐩.exe
Size

11.7MB
MD5

738e599d9b27830cb7920e3cfdeabd43
SHA1

a6f7881df9c273d8e4444fb3d242c0a8b3b00965
SHA256

ffcba56c943bd2e56ccc64c5c7b2b8d30d6068ef97a2c7245b54a3281bd75d48
SHA512

60d5fd6f36a1ad60c49401425f89e36b87db5afcd968931eb4bf19bd5d6216564282ffb6ee9dd1315d09ef7fb953748f3b0949090c31dae1daf1a140bcdffd23
SSDEEP

196608:oZdc01IU22ea1ulaUHXrVua+k/P5GEVbkagWQyz0WHu+ZQINV45Wpy:UT/mHaUBzdP5/kagWSWLd4

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://rapeflowwj.lat/api

https://crosshuaht.lat/api

https://sustainskelet.lat/api

https://aspecteirs.lat/api

https://energyaffai.lat/api

https://necklacebudi.lat/api

https://discokeyus.lat/api

https://grannyejh.lat/api

https://recessiowirs.click/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	𝐒𝐞𝐭𝐮𝐩.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	𝐒𝐞𝐭𝐮𝐩.tmp

Executes dropped EXE 3 IoCs

pid	Process
2368	𝐒𝐞𝐭𝐮𝐩.tmp
2520	𝐒𝐞𝐭𝐮𝐩.tmp
928	PacketTrap.exe

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
4612	tasklist.exe
2344	tasklist.exe
4052	tasklist.exe
1000	tasklist.exe
4448	tasklist.exe
1924	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝐒𝐞𝐭𝐮𝐩.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝐒𝐞𝐭𝐮𝐩.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝐒𝐞𝐭𝐮𝐩.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PacketTrap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	𝐒𝐞𝐭𝐮𝐩.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2520	𝐒𝐞𝐭𝐮𝐩.tmp
2520	𝐒𝐞𝐭𝐮𝐩.tmp
928	PacketTrap.exe
928	PacketTrap.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4612	tasklist.exe
Token: SeDebugPrivilege	2344	tasklist.exe
Token: SeDebugPrivilege	4052	tasklist.exe
Token: SeDebugPrivilege	1000	tasklist.exe
Token: SeDebugPrivilege	4448	tasklist.exe
Token: SeDebugPrivilege	1924	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	𝐒𝐞𝐭𝐮𝐩.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 2368	684	𝐒𝐞𝐭𝐮𝐩.exe	82
PID 684 wrote to memory of 2368	684	𝐒𝐞𝐭𝐮𝐩.exe	82
PID 684 wrote to memory of 2368	684	𝐒𝐞𝐭𝐮𝐩.exe	82
PID 2368 wrote to memory of 2720	2368	𝐒𝐞𝐭𝐮𝐩.tmp	83
PID 2368 wrote to memory of 2720	2368	𝐒𝐞𝐭𝐮𝐩.tmp	83
PID 2368 wrote to memory of 2720	2368	𝐒𝐞𝐭𝐮𝐩.tmp	83
PID 2720 wrote to memory of 2520	2720	𝐒𝐞𝐭𝐮𝐩.exe	84
PID 2720 wrote to memory of 2520	2720	𝐒𝐞𝐭𝐮𝐩.exe	84
PID 2720 wrote to memory of 2520	2720	𝐒𝐞𝐭𝐮𝐩.exe	84
PID 2520 wrote to memory of 5000	2520	𝐒𝐞𝐭𝐮𝐩.tmp	85
PID 2520 wrote to memory of 5000	2520	𝐒𝐞𝐭𝐮𝐩.tmp	85
PID 2520 wrote to memory of 5000	2520	𝐒𝐞𝐭𝐮𝐩.tmp	85
PID 5000 wrote to memory of 4612	5000	cmd.exe	87
PID 5000 wrote to memory of 4612	5000	cmd.exe	87
PID 5000 wrote to memory of 4612	5000	cmd.exe	87
PID 5000 wrote to memory of 1140	5000	cmd.exe	88
PID 5000 wrote to memory of 1140	5000	cmd.exe	88
PID 5000 wrote to memory of 1140	5000	cmd.exe	88
PID 2520 wrote to memory of 668	2520	𝐒𝐞𝐭𝐮𝐩.tmp	90
PID 2520 wrote to memory of 668	2520	𝐒𝐞𝐭𝐮𝐩.tmp	90
PID 2520 wrote to memory of 668	2520	𝐒𝐞𝐭𝐮𝐩.tmp	90
PID 668 wrote to memory of 2344	668	cmd.exe	92
PID 668 wrote to memory of 2344	668	cmd.exe	92
PID 668 wrote to memory of 2344	668	cmd.exe	92
PID 668 wrote to memory of 724	668	cmd.exe	93
PID 668 wrote to memory of 724	668	cmd.exe	93
PID 668 wrote to memory of 724	668	cmd.exe	93
PID 2520 wrote to memory of 224	2520	𝐒𝐞𝐭𝐮𝐩.tmp	94
PID 2520 wrote to memory of 224	2520	𝐒𝐞𝐭𝐮𝐩.tmp	94
PID 2520 wrote to memory of 224	2520	𝐒𝐞𝐭𝐮𝐩.tmp	94
PID 224 wrote to memory of 4052	224	cmd.exe	96
PID 224 wrote to memory of 4052	224	cmd.exe	96
PID 224 wrote to memory of 4052	224	cmd.exe	96
PID 224 wrote to memory of 4244	224	cmd.exe	97
PID 224 wrote to memory of 4244	224	cmd.exe	97
PID 224 wrote to memory of 4244	224	cmd.exe	97
PID 2520 wrote to memory of 3888	2520	𝐒𝐞𝐭𝐮𝐩.tmp	98
PID 2520 wrote to memory of 3888	2520	𝐒𝐞𝐭𝐮𝐩.tmp	98
PID 2520 wrote to memory of 3888	2520	𝐒𝐞𝐭𝐮𝐩.tmp	98
PID 3888 wrote to memory of 1000	3888	cmd.exe	100
PID 3888 wrote to memory of 1000	3888	cmd.exe	100
PID 3888 wrote to memory of 1000	3888	cmd.exe	100
PID 3888 wrote to memory of 3248	3888	cmd.exe	101
PID 3888 wrote to memory of 3248	3888	cmd.exe	101
PID 3888 wrote to memory of 3248	3888	cmd.exe	101
PID 2520 wrote to memory of 5076	2520	𝐒𝐞𝐭𝐮𝐩.tmp	102
PID 2520 wrote to memory of 5076	2520	𝐒𝐞𝐭𝐮𝐩.tmp	102
PID 2520 wrote to memory of 5076	2520	𝐒𝐞𝐭𝐮𝐩.tmp	102
PID 5076 wrote to memory of 4448	5076	cmd.exe	104
PID 5076 wrote to memory of 4448	5076	cmd.exe	104
PID 5076 wrote to memory of 4448	5076	cmd.exe	104
PID 5076 wrote to memory of 1516	5076	cmd.exe	105
PID 5076 wrote to memory of 1516	5076	cmd.exe	105
PID 5076 wrote to memory of 1516	5076	cmd.exe	105
PID 2520 wrote to memory of 3864	2520	𝐒𝐞𝐭𝐮𝐩.tmp	106
PID 2520 wrote to memory of 3864	2520	𝐒𝐞𝐭𝐮𝐩.tmp	106
PID 2520 wrote to memory of 3864	2520	𝐒𝐞𝐭𝐮𝐩.tmp	106
PID 3864 wrote to memory of 1924	3864	cmd.exe	108
PID 3864 wrote to memory of 1924	3864	cmd.exe	108
PID 3864 wrote to memory of 1924	3864	cmd.exe	108
PID 3864 wrote to memory of 2672	3864	cmd.exe	109
PID 3864 wrote to memory of 2672	3864	cmd.exe	109
PID 3864 wrote to memory of 2672	3864	cmd.exe	109
PID 2520 wrote to memory of 928	2520	𝐒𝐞𝐭𝐮𝐩.tmp	110

C:\Users\Admin\AppData\Local\Temp\𝐒𝐞𝐭𝐮𝐩.exe
"C:\Users\Admin\AppData\Local\Temp\𝐒𝐞𝐭𝐮𝐩.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Local\Temp\is-IPCHA.tmp\𝐒𝐞𝐭𝐮𝐩.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IPCHA.tmp\𝐒𝐞𝐭𝐮𝐩.tmp" /SL5="$E004A,11804158,244224,C:\Users\Admin\AppData\Local\Temp\𝐒𝐞𝐭𝐮𝐩.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\𝐒𝐞𝐭𝐮𝐩.exe
    "C:\Users\Admin\AppData\Local\Temp\𝐒𝐞𝐭𝐮𝐩.exe" /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\is-OS0G7.tmp\𝐒𝐞𝐭𝐮𝐩.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-OS0G7.tmp\𝐒𝐞𝐭𝐮𝐩.tmp" /SL5="$B0044,11804158,244224,C:\Users\Admin\AppData\Local\Temp\𝐒𝐞𝐭𝐮𝐩.exe" /VERYSILENT
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5000
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4612
      - C:\Windows\SysWOW64\find.exe
        
        find /I "wrsa.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1140
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:668
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
      - C:\Windows\SysWOW64\find.exe
        
        find /I "opssvc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:724
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:224
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
      - C:\Windows\SysWOW64\find.exe
        
        find /I "avastui.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4244
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3888
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
      - C:\Windows\SysWOW64\find.exe
        
        find /I "avgui.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3248
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5076
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4448
      - C:\Windows\SysWOW64\find.exe
        
        find /I "nswscsvc.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3864
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
      - C:\Windows\SysWOW64\find.exe
        
        find /I "sophoshealth.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
    - - C:\Users\Admin\AppData\Local\Temp\is-1HQH3.tmp\PacketTrap.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-1HQH3.tmp\PacketTrap.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-IPCHA.tmp\𝐒𝐞𝐭𝐮𝐩.tmp

Filesize
1.2MB

MD5
fcc59fa8d3bcb703650668ffdc1cb675

SHA1
6ef70bd8b8fd3b7306e2a4b7d8fb8a74f9e3a605

SHA256
9bb88ac378511a2e2953304a40077d3ccd22446d65f3dcdf79cee8cd998ba88f

SHA512
9b700fa1213970e89cd8ea541e234b1ad02b295ae4384e28e7cfad09567c2df1bfa9ccdf9e518ebd3103b3c778777bb4ea9e2ce81774ee807351d13ddc1094bb

Download Submit
memory/684-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/684-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/684-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/928-43-0x0000000000950000-0x00000000009A3000-memory.dmp

Filesize
332KB

Download
memory/2368-6-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2368-13-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2520-26-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2520-20-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2520-39-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2520-25-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2720-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2720-23-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2720-42-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2720-9-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download