lumma | da22eb0174e81cb798bbf716dff3b0742c802dc763e5a0f10504cc77ef234094

General

Target
885ac23d2485e64d331094a48fe9bf6c.exe
Size 2.0MB
Sample250324-vbraeasydw
SHA256 da22eb0174e81cb798bbf716dff3b0742c802dc763e5a0f10504cc77ef234094
MD5 885ac23d2485e64d331094a48fe9bf6c
SHA1 46f9e5803c3e6e8410db0ee95ec3a8a973cf0e37
SHA512 f4b1048ea61da24b57a8bd4a7fa8928a8c7cdc37b3c1f9a1786be6d5ae66073e2c3a1b57c3a646d7daa1ebe0f15a89b6bee149192bf376435d5461c99688c6a5
SSDEEP 49152:XDExqteUA+lDN/rHvlbOB87c6KZg8wiH7:XDExPb+x1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

C2

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	885ac23d2485e64d331094a48fe9bf6c.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	885ac23d2485e64d331094a48fe9bf6c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	885ac23d2485e64d331094a48fe9bf6c.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Wine	885ac23d2485e64d331094a48fe9bf6c.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4512	885ac23d2485e64d331094a48fe9bf6c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	885ac23d2485e64d331094a48fe9bf6c.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs