lumma | e3a0b2039b3f4eb9222ae14b0dfe0ee34da695dbe69f9fb8338820bd9b0c84d3

Analysis

max time kernel
102s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
23/04/2025, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3a0b2039b3f4eb9222ae14b0dfe0ee34da695dbe69f9fb8338820bd9b0c84d3.ps1
Size 2KB
Sample250423-e9fnkaxsbs
SHA256 e3a0b2039b3f4eb9222ae14b0dfe0ee34da695dbe69f9fb8338820bd9b0c84d3
MD5 99e1e62a4a082d206d4bad554ab6de23
SHA1 49a85e491fbd1088054a641e7dadc2b5a5d95916
SHA512 d60929437dcb5e9a2352d9729e927deb368be19c78951751d770b937bf426a22c90a4401651fe39f735d41d0568ed790f9df6c6ada6734ba1e7037ffe124f357
MD5 SHA1 SHA512

Score

10^/10

lumma defense_evasion discovery execution persistence spyware stealer

Malware Config

Extracted

Family

lumma

https://clarmodq.top/qoxo
https://ilongitudde.digital/wizu
https://hemispherexz.top/xapp
https://equatorf.run/reiq
https://latitudert.live/teui
https://longitudde.digital/wizu
https://climatologfy.top/kbud

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://wn.sg/file.exe
exe.dropper
https://wn.sg/script.ps1

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1220	PowerShell.exe
5	3636	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3636	powershell.exe
1220	PowerShell.exe

Executes dropped EXE 2 IoCs

pid	Process
4892	updater.exe
2480	updater.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4239789418-2672923313-1754393631-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate.ps1 = "powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Roaming\\UpdateCache\\WindowsUpdate.ps1\""	PowerShell.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4968	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4892 set thread context of 4916	4892	updater.exe	80
PID 2480 set thread context of 6032	2480	updater.exe	86

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	PowerShell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	powershell.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1220	PowerShell.exe
1220	PowerShell.exe
3636	powershell.exe
3636	powershell.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
4916	MSBuild.exe
6032	MSBuild.exe
6032	MSBuild.exe
6032	MSBuild.exe
6032	MSBuild.exe
6032	MSBuild.exe
6032	MSBuild.exe
6032	MSBuild.exe
6032	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	PowerShell.exe
Token: SeDebugPrivilege	3636	powershell.exe
Token: SeImpersonatePrivilege	4916	MSBuild.exe
Token: SeImpersonatePrivilege	4916	MSBuild.exe
Token: SeImpersonatePrivilege	6032	MSBuild.exe
Token: SeImpersonatePrivilege	6032	MSBuild.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 4892	1220	PowerShell.exe	79
PID 1220 wrote to memory of 4892	1220	PowerShell.exe	79
PID 4892 wrote to memory of 4916	4892	updater.exe	80
PID 4892 wrote to memory of 4916	4892	updater.exe	80
PID 4892 wrote to memory of 4916	4892	updater.exe	80
PID 4892 wrote to memory of 4916	4892	updater.exe	80
PID 4892 wrote to memory of 4916	4892	updater.exe	80
PID 4892 wrote to memory of 4916	4892	updater.exe	80
PID 4892 wrote to memory of 4916	4892	updater.exe	80
PID 4892 wrote to memory of 4916	4892	updater.exe	80
PID 4892 wrote to memory of 4916	4892	updater.exe	80
PID 4968 wrote to memory of 3636	4968	cmd.exe	83
PID 4968 wrote to memory of 3636	4968	cmd.exe	83
PID 3636 wrote to memory of 2480	3636	powershell.exe	85
PID 3636 wrote to memory of 2480	3636	powershell.exe	85
PID 2480 wrote to memory of 6032	2480	updater.exe	86
PID 2480 wrote to memory of 6032	2480	updater.exe	86
PID 2480 wrote to memory of 6032	2480	updater.exe	86
PID 2480 wrote to memory of 6032	2480	updater.exe	86
PID 2480 wrote to memory of 6032	2480	updater.exe	86
PID 2480 wrote to memory of 6032	2480	updater.exe	86
PID 2480 wrote to memory of 6032	2480	updater.exe	86
PID 2480 wrote to memory of 6032	2480	updater.exe	86
PID 2480 wrote to memory of 6032	2480	updater.exe	86

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\e3a0b2039b3f4eb9222ae14b0dfe0ee34da695dbe69f9fb8338820bd9b0c84d3.ps1
1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\7df21c22-2799-452c-a28e-790e46dddcf2\updater.exe
  "C:\Users\Admin\AppData\Local\7df21c22-2799-452c-a28e-790e46dddcf2\updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\UpdateCache\WindowsUpdate.ps1"
1⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\UpdateCache\WindowsUpdate.ps1"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Users\Admin\AppData\Local\3e6c98d9-dcb4-429f-95f1-16d705fe2a8c\updater.exe
    "C:\Users\Admin\AppData\Local\3e6c98d9-dcb4-429f-95f1-16d705fe2a8c\updater.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Users\Admin\AppData\Local\7df21c22-2799-452c-a28e-790e46dddcf2\updater.exe
Size 1.2MB
SHA256 8e1c61f1fce22571532041fe0ef4675756a9208c94e2e4452d5020940e3c5fd9
MD5 03c460327291b0ea233019b489f66b3b
SHA1 15fe5e66877ab33b97f058f6e39bd80cc8641ed6
SHA512 51b8dd96970931c00e0534af980a89ae4ae4290d7615ee943c851145fc03331eae4c549ef5b958aada9a43356317ee797fddb6105dde47a2dd6e64d6c82a7a7c
SSDEEP 24576:nHj+EsKp6or3s90hKoR9VXMyjeAPfdYzfTZoR9VXMyjeAPfdYzfTk:nD+966uO0hpkAwrMkAwrk
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
MD5 22e796539d05c5390c21787da1fb4c2b
SHA1 55320ebdedd3069b2aaf1a258462600d9ef53a58
SHA512 d9cc0cb22df56db72a71504bb3ebc36697e0a7a1d2869e0e0ab61349bda603298fe6c667737b79bf2235314fb49b883ba4c5f137d002e273e79391038ecf9c09
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a7dd972424019b0668bf196b34e30295110a5c9378ea780675fd8f5a7caa4067
MD5 6ff68ca130fbf845f7c96be4f56f948a
SHA1 b8b3e8e95bdadb0cf3bb816987fba434b15b0e75
SHA512 2cf787777a2024802c319a480e71684ed174319551fd5d02a54ba77bbc9dcb49bd188b9b2bfa0669ce3257fa5d4613c0784c9bafdeef0d64b7733529c8c575b9
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_t0argib4.w2c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0argib4.w2c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

WindowsUpdate.ps1

Path C:\Users\Admin\AppData\Roaming\UpdateCache\WindowsUpdate.ps1
Size 2KB
SHA256 df9314e17ee8bcefb2d54f69794b60d9ee39d77f177b4b6f51f11e142a115696
MD5 fd1528db167002d258d82d8fc2e538e5
SHA1 8a35438cda3340e2df78b5eaf7f1bb13a7885815
SHA512 d592eb95149a0b234265d720c381404d3f6a6e658e54d951cdf64eef86962a1f81509bbc0f346e04f8c333e867a5ae46258dc50b226adf6c2a5d97510a553078
MD5 SHA1 SHA512

Submit Download

memory/1220-12-0x00007FFD99350000-0x00007FFD99E12000-memory.dmp

Download

memory/1220-9-0x0000017878910000-0x0000017878932000-memory.dmp

Download

memory/1220-46-0x00007FFD99353000-0x00007FFD99355000-memory.dmp

Download

memory/1220-47-0x00007FFD99350000-0x00007FFD99E12000-memory.dmp

Download

memory/1220-0-0x00007FFD99353000-0x00007FFD99355000-memory.dmp

Download

memory/1220-10-0x00007FFD99350000-0x00007FFD99E12000-memory.dmp

Download

memory/1220-11-0x00007FFD99350000-0x00007FFD99E12000-memory.dmp

Download

memory/1220-56-0x00007FFD99350000-0x00007FFD99E12000-memory.dmp

Download

memory/4916-51-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4916-50-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4916-48-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4916-103-0x0000000002C90000-0x0000000002C96000-memory.dmp

Download

memory/4916-101-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4916-102-0x0000000002C90000-0x0000000002C96000-memory.dmp

Download

memory/6032-111-0x0000000003920000-0x0000000003926000-memory.dmp

Download

memory/6032-109-0x0000000000400000-0x0000000000461000-memory.dmp

Download