lumma | eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8

Analysis

max time kernel
124s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/03/2025, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe
Size

448KB
MD5

69a831d62d8eb89c3327538d23ea3532
SHA1

c0364914fffa90df86357489802599401b0712ec
SHA256

eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8
SHA512

21c3ca6b26bad70dff7e8c6dd26cdf89d0e311bcb6315505fc7ba068625ba8b4452dcd9ba3c714f68de7de5ed369e27b25e82438ad66fb327f1839c34a2a3877
SSDEEP

12288:tgmuiWCFstIScxuwu0iFsb9FYz6eEUFuYUgZ1jVDSFQx+:7uilFstIZMYiM923UgnDSFQx+

Score

10^/10

lumma xworm discovery execution persistence rat stealer trojan

Malware Config

Extracted

Family

lumma

Extracted

Family

xworm

Version

3.1

Mutex

aC2Uqwxt1JZnqhmD

Attributes

Install_directory
%Port%
install_file
explorer.exe
pastebin_url
https://pastebin.com/raw/jkeHBv0w

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00190000000055b1-49.dat	family_xworm
behavioral1/memory/2160-51-0x00000000002E0000-0x00000000002EE000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2644	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2548	Rimess.exe
2940	Nexol.exe
2868	Nexol.exe
2888	Nexol.exe
2160	Rimess.exe

Loads dropped DLL 5 IoCs

pid	Process
2940	Nexol.exe
2940	Nexol.exe
2736	WerFault.exe
2736	WerFault.exe
2736	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rimess = "C:\\Windows\\System32\\Rimess.exe"	Rimess.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Rimess.exe	Rimess.exe
File opened for modification	C:\Windows\System32\Rimess.exe	Rimess.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 2888	2940	Nexol.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2940	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nexol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nexol.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2644	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2160	Rimess.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2548	1964	eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe	31
PID 1964 wrote to memory of 2548	1964	eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe	31
PID 1964 wrote to memory of 2548	1964	eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe	31
PID 1964 wrote to memory of 2940	1964	eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe	32
PID 1964 wrote to memory of 2940	1964	eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe	32
PID 1964 wrote to memory of 2940	1964	eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe	32
PID 1964 wrote to memory of 2940	1964	eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe	32
PID 2940 wrote to memory of 2868	2940	Nexol.exe	33
PID 2940 wrote to memory of 2868	2940	Nexol.exe	33
PID 2940 wrote to memory of 2868	2940	Nexol.exe	33
PID 2940 wrote to memory of 2868	2940	Nexol.exe	33
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2888	2940	Nexol.exe	34
PID 2940 wrote to memory of 2736	2940	Nexol.exe	35
PID 2940 wrote to memory of 2736	2940	Nexol.exe	35
PID 2940 wrote to memory of 2736	2940	Nexol.exe	35
PID 2940 wrote to memory of 2736	2940	Nexol.exe	35
PID 2548 wrote to memory of 2644	2548	Rimess.exe	36
PID 2548 wrote to memory of 2644	2548	Rimess.exe	36
PID 2548 wrote to memory of 2644	2548	Rimess.exe	36
PID 2548 wrote to memory of 2160	2548	Rimess.exe	38
PID 2548 wrote to memory of 2160	2548	Rimess.exe	38
PID 2548 wrote to memory of 2160	2548	Rimess.exe	38

C:\Users\Admin\AppData\Local\Temp\eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe
"C:\Users\Admin\AppData\Local\Temp\eb050d5609042b0b8171889b6a34aadccab431c389e2d33a8e57afd332f69ac8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\Rimess.exe
  "C:\Users\Admin\AppData\Local\Temp\Rimess.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Rimess.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Windows\System32\Rimess.exe
    "C:\Windows\System32\Rimess.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\Users\Admin\AppData\Local\Temp\Nexol.exe
  "C:\Users\Admin\AppData\Local\Temp\Nexol.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Nexol.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexol.exe"
    3⤵
    - Executes dropped EXE
    PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Nexol.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexol.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 524
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nexol.exe

Filesize
386KB

MD5
43aea8e19d79356c18c710a09c4cf39c

SHA1
dc8e264847d5607fab57a0ba50c2f71dfd1276f0

SHA256
9e9b5607d547d627e16c25511e0538f1ceb5f1c9c3e819d5653f8bea1081b0b2

SHA512
a3f1a4c342bce7b344a1177217ce593e291cb0ae37c6371b2b45aab58ed301c555a9fac285119fdcc17c9087b6eec9dba0d9b5f7225757c4fcd19a20054d3e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rimess.exe

Filesize
29KB

MD5
a9ea8b23eb527c0a03541d5f85ec8205

SHA1
49d3357d63f633dd3f85e0b651e230c9b3d496a1

SHA256
41ba6c9a22b82e964837b99b974f6be09009d6f0dfdf32733a1380657ff84e0a

SHA512
9aa39d7f53764080461142ab64c20d75e6a6f62f76c0acee9347341e45ef5217f4bf113671e088eca4dc312bef74b6278adea44fb590ad5abf98d1fa3b800d1a

Download Submit
C:\Windows\System32\Rimess.exe

Filesize
30KB

MD5
76cdbd5ca528f810989e4ccaf2f41a37

SHA1
5082ddba41cfebd186f246ce60b01d7c8a0ba469

SHA256
d33db6a622c58b135f7a7bc5308751687b656cc7006d6d289c8b55292212bde2

SHA512
0c94936a9140da807d20a4a6bfeb2778e7d72081427394a689a6c9140d49ce767044a174e99a686a6e54985028af6694b3489616cb799a04ef5b1c590ee68208

Download Submit
memory/1964-1-0x0000000000130000-0x00000000001A6000-memory.dmp

Filesize
472KB

Download
memory/1964-14-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/1964-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/2160-51-0x00000000002E0000-0x00000000002EE000-memory.dmp

Filesize
56KB

Download
memory/2548-13-0x0000000000B10000-0x0000000000B1E000-memory.dmp

Filesize
56KB

Download
memory/2548-50-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2548-16-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2644-43-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/2644-42-0x000000001B780000-0x000000001BA62000-memory.dmp

Filesize
2.9MB

Download
memory/2888-31-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2888-23-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2888-32-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2888-21-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2888-27-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2888-29-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2888-34-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2888-25-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2940-15-0x0000000000CD0000-0x0000000000D32000-memory.dmp

Filesize
392KB

Download