Analysis

  • max time kernel
    281s
  • max time network
    282s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 12:06

General

  • Target

    04072025_1206_ChristopherCraft.exe

  • Size

    12.0MB

  • MD5

    d6a1aab8db3097d36a5282b20dd6a1bf

  • SHA1

    a89a5af5ac50adfd0c300f1b04bee70a4a5089df

  • SHA256

    df2b1b10e01cd391a3dcb08327a887b8b534f4e6ba702c72619926c74daecad5

  • SHA512

    2bc64b7ae854fbf4afa66cddafb6f006877250662c9a35a0010de4fa262302c807295f8523e79d217d0b180a89d83e8447278ea968f744abf54e96539fb653ea

  • SSDEEP

    24576:N0a1ZrvUfdXZx/mEHaSwrfyJujaB5N0uQ/mkl:NZALlUfCBnamkl

Malware Config

Extracted

Family

lumma

C2

https://mahrox.shop/towq

https://ycvduc.xyz/trie

https://nbcsfar.xyz/tpxz

https://cbakk.xyz/ajng

https://trsuv.xyz/gait

https://sqgzl.xyz/taoa

https://cexpxg.xyz/airq

https://urarfx.xyz/twox

https://liaxn.xyz/nbzh

Attributes
  • build_id

    0b919b275dc5920e130f2a71ccf287f507e09929

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04072025_1206_ChristopherCraft.exe
    "C:\Users\Admin\AppData\Local\Temp\04072025_1206_ChristopherCraft.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c copy Browsers.xls Browsers.xls.bat & Browsers.xls.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2292
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "opssvc wrsa"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3028
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1976
      • C:\Windows\SysWOW64\findstr.exe
        findstr "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set YhiTgBlLujKrjjSwyNzUWfJW=AutoIt3.exe & Set raPtRpuxzjwGYWHwTgdaszFhgVP=.a3x & Set NXFYuIdYQ=300
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4196
      • C:\Windows\SysWOW64\extrac32.exe
        extrac32 /Y Phase.xls *.*
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4456
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V "Ct" Rick
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3148
      • C:\Users\Admin\AppData\Local\Temp\542417\Threaded.com
        Threaded.com h
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5040
      • C:\Windows\SysWOW64\choice.exe
        choice /d n /t 5
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2628

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\542417\Threaded.com

          Filesize

          925KB

          MD5

          62d09f076e6e0240548c2f837536a46a

          SHA1

          26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

          SHA256

          1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

          SHA512

          32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

        • C:\Users\Admin\AppData\Local\Temp\542417\h

          Filesize

          457KB

          MD5

          1a4ab95c26df7d9baa249513a86822f8

          SHA1

          f3aeb8d2dd77b02ab0dd974f1f4ad76053023729

          SHA256

          80574740431658db73706300ac53a4cad9962f8bb5d19264ce2fd922a2638628

          SHA512

          2339cbb91f6199d5bff6110bd568c1c5a76c4d9b0564cd285622d8047b2f765cdb50073c00f8076284ec2a973418d7984147e803cafe9af1e1e4584a1436db80

        • C:\Users\Admin\AppData\Local\Temp\Ahead

          Filesize

          136KB

          MD5

          45b00ef6c0ff6b7e107ab38501aa9b8d

          SHA1

          1d7239f1ac9d2fdc68bf42cb4c922ef30f0b9ff3

          SHA256

          92c778c32620fcfa92294432fb584c0aa3387865d31ad9417c2cf410a984ec77

          SHA512

          9361d2a5eb2b540edae4bfdd2b807ca055f23edc7fda560c1197fbd7b2c7ebcb8af66c444d343fbcdd7b19e87c5a4b49e2b3ff6b9595f9398793799e087c8660

        • C:\Users\Admin\AppData\Local\Temp\Browsers.xls

          Filesize

          28KB

          MD5

          c7a5c5af0a4baceab363c56bc22df705

          SHA1

          6cab90344cc1aed4e89a2cf10c9369b8f1c65247

          SHA256

          c39fdb5696afc03d20b33ab6fcea6d1daf97e7cdee47f17d0cc2e665f1bde0a0

          SHA512

          add03f8971f6c760aa95f4b9a5a1173d2abf2a8118576dd62673b5cbba4a7d34996e752dcf5252f15eeedf88d860246c0961c10c7838e51fd8a64783d02f2bd4

        • C:\Users\Admin\AppData\Local\Temp\Closes.xls

          Filesize

          87KB

          MD5

          ca026bf277621b9558c201d296aff9fa

          SHA1

          50b4aec1db438a0abe70d1e3870b45948f9e9492

          SHA256

          040c31e1dd4726b2c22f7ceba9a613fa13b31d5a5ec665f0fe7167e2b060a8a0

          SHA512

          ed018c8e0d4c1fed340cc31c5014e1e9ae6b113922acdfa72bc0bc208925b830e8380a535484e7b2f8ba08d581a66ce9672e03a64c9c161a3cae46645ae9ae0e

        • C:\Users\Admin\AppData\Local\Temp\Cope

          Filesize

          125KB

          MD5

          20895547fa3a515d2bbfbd0481e22461

          SHA1

          8b87cb53cf1d9861e24378034bc2d0d241f8f250

          SHA256

          22129e2365e88107e08d24c42a9bfc1686cf535c48fc5833221fe9625f213f7b

          SHA512

          dd5c8d2c2fcbe7b2ec70c0867530f959303f2e7dc73ad7b1605f19ce41164d379a9582dd37a5fb75bb7f2ae8d60df721dd3a63c6ec1445746395d1240da00153

        • C:\Users\Admin\AppData\Local\Temp\Enjoyed.xls

          Filesize

          85KB

          MD5

          d429c47f0cc10ad4611eca4e3af6b175

          SHA1

          87464cd046524092d076cd8493a87e6ef437164e

          SHA256

          30167494f93fe884630f33d0db988794f24bf7cd1e4677f6b98da99c7fcbe4c5

          SHA512

          4e2c6ce9a3b1ca703874cfba03c74344fc936773a6333cc6b786db828541b3e46b28fedf84591562ab14150587eaa1542b43c41ff45960e8c584d736e2f9b0f0

        • C:\Users\Admin\AppData\Local\Temp\Euro.xls

          Filesize

          94KB

          MD5

          d469b9ac05657dcc68db99926bcef248

          SHA1

          0f806e115a21ae525576c38ec249edc2a7c7b7c5

          SHA256

          a87eca97001728a9f08f7a01e4af5962315a31206757bbd844ee132f1b284b77

          SHA512

          0a4ddbeddb2931c545f7c9924e42679298457b6f7336196d0608c6ba4337666e74abd7aa480c1e692e0d516cc8738cf9f2d3bb1989dd4d01408bc536c4ffe3d4

        • C:\Users\Admin\AppData\Local\Temp\Hay

          Filesize

          138KB

          MD5

          b86aeeb94a759d50dd82253e3b35b189

          SHA1

          a5e8c674d431eea13d2edb209983692f0be8e4c2

          SHA256

          10b13f92c9445cf1a5ccf7b33cce66796018a4ffe7a6d9dba6e52a27eafc1013

          SHA512

          30b6a21443ac2b4de56d7c7db0ac01283d09f3e820ccf5de9cc2add76a2bf1bf6b4a8b8c4feb6e5be332ba0b8f6f4c21050a4658985da41ea091e85836cea965

        • C:\Users\Admin\AppData\Local\Temp\Observer.xls

          Filesize

          52KB

          MD5

          44c2060e55b67e3a1e6c1c6d9718732a

          SHA1

          0517ad7625d36b11a8ce2bb8f10d9ff196d5dc20

          SHA256

          c71df96688a046f890fa005f28b89b9a806e4519db689f55914aeb3ac04390e5

          SHA512

          087b07b06a84ea9b93779028aa80423624d8a038d5f8f2e8b57397d2afd2046230d31ede1bf40f1ca778a4af7a8d89d4cddd97fd025fbe0d48dfff3c12465312

        • C:\Users\Admin\AppData\Local\Temp\Opinion.xls

          Filesize

          68KB

          MD5

          2b5fcb3cd72546ec42e467574044d822

          SHA1

          253ba53ed24d55c422e38f5bd66ff4448de08c93

          SHA256

          ddfd3dc555d81c08940e0632d7ad5c21891999d4e005361069f8a2beacfd3228

          SHA512

          79d2ffdb33766b62201ee356d5b4ebcdbad9587a2bcc5e33c3dd258fad5a54aaf509668a324a4789ebb6bad0e4a131eebf8822561f2d3a52a4afb9ce9b549e59

        • C:\Users\Admin\AppData\Local\Temp\Phase.xls

          Filesize

          478KB

          MD5

          ec519420fd100373a7450c8daf7952ba

          SHA1

          cd8db08264eb1f570a401e3f9ec4ca8a0b687b1a

          SHA256

          4ff2c534d0f12312f600e5f296b02922b5c722ba26a7ed56264450d694bf72fc

          SHA512

          9075e9e4586d0e687f78534e716981e1cd1a29c056d89cac372dc1e8e286ca99750cc31b671240a5616df9ad401c9106cefcdf7f917158b7086d74aa7271ee68

        • C:\Users\Admin\AppData\Local\Temp\Porsche

          Filesize

          106KB

          MD5

          b27e76bc94bfb17550ffad69c60875d3

          SHA1

          d164ed43ba3cdb396356747809ffd59d5d65a063

          SHA256

          81b591ffd26a28580a3898883ecd14123f58523c78513100b1154218e8bbe92d

          SHA512

          139793af16e1db6e3e05017e307b20b55a984a706946b43715f21b11c40b9ddb034610e0fb28ba98778392ce32530c91b58edfada87f22c33dccfa63c5af669c

        • C:\Users\Admin\AppData\Local\Temp\Rick

          Filesize

          1KB

          MD5

          52f053245da34f90d9181baac6d23e12

          SHA1

          0c42c0879918787e4f8dbbe57b4d3f7938a86d76

          SHA256

          0cdfd1b79ee6288a175792cbf1727a2c20253e89cbf8b5ce22c82a7cd2ea535a

          SHA512

          937b86ecdf543597e6304f32730ff4392cae4e8c927b3fae62058e940aa9b9b1418b7b9f5dfc98193814ad10fd942d4ce471a703596cd644b6ceb286241cb445

        • C:\Users\Admin\AppData\Local\Temp\Saying

          Filesize

          143KB

          MD5

          2efb121a4f18c03ecd7793f19c035c81

          SHA1

          3fb5891056d17deaf8024717800b98caf26bcb18

          SHA256

          19c38507f88adef9dde548e215b01549a306ec3bb2c75b142fe389eb216cbf8f

          SHA512

          2967164bf30ce30e4be7517d0f3f87b20c102f27b15c85501806e46caa04f3eb91d77fba76085742500a40d9674508ab942b03c04417a9f8ba94d189f19220e3

        • C:\Users\Admin\AppData\Local\Temp\Suck

          Filesize

          146KB

          MD5

          d26e449dbd419e33b1649d281120e95d

          SHA1

          2536fbcca7a6a50f18dafd52b55c868265ffcb1e

          SHA256

          1925e81e6f9d510c21859ac048f1f70b6e14f8e993748d0284c2ad86f3a46a6a

          SHA512

          37675505b66e5dd223e5b7b64310c9df860e331cd5acae1af2dfdffaf57306324360808b6da12e4e620699c58b2609e02fda75ca6b9ef64d2037330eb923f8b8

        • C:\Users\Admin\AppData\Local\Temp\Tell

          Filesize

          17KB

          MD5

          8ebbdd0335faa715a3738576f0f36f83

          SHA1

          94117f75ce3f4376ae6726ca91b2cf815592ffc9

          SHA256

          d60935ad257a55db709ea03f4decc6cb54a8dcabb50e0aa22c8b6ec528e41686

          SHA512

          21bc1437b26cfc917a8d91db33ccd0272f5cb008ab5e6b235ae7e0e79fcb14855a3b380c2461668c869c270f712df6525e68f23f88c18481ff3629df1f1e70fd

        • C:\Users\Admin\AppData\Local\Temp\Together

          Filesize

          112KB

          MD5

          896cc5596dbc99b96e537e1ba2669f9a

          SHA1

          81e503420f174312ce3b8931fb65bcceede1c578

          SHA256

          b13e4895353432809d061efb5d593dc5d3b612697f69cabb78f99e43c344d53f

          SHA512

          a80b9c84b7508d1bfbe108a4b93df3ee7881aff80eaaddfcddcdba7b5b73435f3758adc1d7287d1880ad51d85c1227cdb24457da95572e31bd1f7d34785fa062

        • C:\Users\Admin\AppData\Local\Temp\V.xls

          Filesize

          71KB

          MD5

          dd293664223c227fa5a3502f021449cb

          SHA1

          5a91a61c061f3e148e65c06e2f9bd5ebea131327

          SHA256

          4b68746f26924785b0648f91b165808d06b9ce74e6f07f69b2a634728923b784

          SHA512

          5efff838a94a15def500819bfc7d21e2f77330eb2e3c262bad521f5f1aaa9db9634e37cbc2e6bb03781a20fa463fd431c79fb06a358b9d9c2c8c41bc36b5a8de

        • memory/5040-703-0x00000000041C0000-0x000000000421E000-memory.dmp

          Filesize

          376KB

        • memory/5040-704-0x00000000041C0000-0x000000000421E000-memory.dmp

          Filesize

          376KB

        • memory/5040-705-0x00000000041C0000-0x000000000421E000-memory.dmp

          Filesize

          376KB

        • memory/5040-706-0x00000000041C0000-0x000000000421E000-memory.dmp

          Filesize

          376KB

        • memory/5040-707-0x00000000041C0000-0x000000000421E000-memory.dmp

          Filesize

          376KB