lumma | d59bc73103668278d2831c989d841bc931edda65b0ea30c710fb33be0145fd89

Analysis

max time kernel
101s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2025, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Extreme Injector.exe
Size

120.5MB
MD5

9465dfab9cfd6274566a8c9827d7b9b8
SHA1

9e09efedff13c628c4c4e3a1f1312db131950545
SHA256

b35d90ba8353265bcb6eb46afd27bca25cbffc4cc3cba19e659fb72ac2d20446
SHA512

c476903eea21d12a91aa6d741bd21490e99e29d4cd47e508fdff940725ff0309005a8ed3e18d3b54a9ae6f179fdc7d435a8b061172c17638bf80082c0f936516
SSDEEP

12288:zAJ0SiRi56OdcPe1Ja4AUL/t+ijFju2qsuVo:80S492/hB+ijFHduu

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://cmenuedgarli.shop/api

https://w-crosshairc.life/api

https://mrodularmall.top/api

https://3vjowinjoinery.icu/api

https://legenassedk.top/api

https://thtardwarehu.icu/api

https://cjlaspcorne.icu/api

https://2bugildbett.top/api

https://weaponrywo.digital/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4232 set thread context of 4916	4232	Extreme Injector.exe	88

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeImpersonatePrivilege	4916	MSBuild.exe
Token: SeImpersonatePrivilege	4916	MSBuild.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4908	4232	Extreme Injector.exe	87
PID 4232 wrote to memory of 4908	4232	Extreme Injector.exe	87
PID 4232 wrote to memory of 4908	4232	Extreme Injector.exe	87
PID 4232 wrote to memory of 4916	4232	Extreme Injector.exe	88
PID 4232 wrote to memory of 4916	4232	Extreme Injector.exe	88
PID 4232 wrote to memory of 4916	4232	Extreme Injector.exe	88
PID 4232 wrote to memory of 4916	4232	Extreme Injector.exe	88
PID 4232 wrote to memory of 4916	4232	Extreme Injector.exe	88
PID 4232 wrote to memory of 4916	4232	Extreme Injector.exe	88
PID 4232 wrote to memory of 4916	4232	Extreme Injector.exe	88
PID 4232 wrote to memory of 4916	4232	Extreme Injector.exe	88
PID 4232 wrote to memory of 4916	4232	Extreme Injector.exe	88

C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Extreme Injector.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4916-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/4916-2-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/4916-3-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/4916-6-0x0000000003150000-0x0000000003155000-memory.dmp

Filesize
20KB

Download
memory/4916-5-0x0000000003150000-0x0000000003155000-memory.dmp

Filesize
20KB

Download
memory/4916-4-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download