Overview

overview

10

Static

static

1

Bootstrapper.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2025, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Bootstrapper.exe
  • Size 1.1MB
  • Sample250706-e8zeaabr4s
  • SHA256 1bf8fbfc44c5875285af1653fe8e2ce6ee4bc90bdbf732df92adef21bf1f493b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lummadiscoveryspywarestealer

Malware Config

Extracted

Family

  • lumma

C2

  • https://concvek.shop/gfhj

  • https://ycvduc.xyz/trie

  • https://nbcsfar.xyz/tpxz

  • https://cbakk.xyz/ajng

  • https://trsuv.xyz/gait

  • https://sqgzl.xyz/taoa

  • https://cexpxg.xyz/airq

  • https://urarfx.xyz/twox

  • https://liaxn.xyz/nbzh

Attributes
  • build_id

    21fc98253dc7386febc65c5af937c6c730b8adb776168d3781

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c copy Mac.aifc Mac.aifc.bat & Mac.aifc.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5256
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5740
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "opssvc wrsa"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2684
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2376
      • C:\Windows\SysWOW64\findstr.exe
        findstr "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set pZzROeZPqaHMxcOpJNZRBaLGpyVXUgiol=AutoIt3.exe & Set WkDwZpIOdNBgV=.a3x & Set DnRo=300
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6080
      • C:\Windows\SysWOW64\extrac32.exe
        extrac32 /Y Belfast.aifc *.*
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2568
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V "Brilliant" Analyze
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4708
      • C:\Users\Admin\AppData\Local\Temp\432348\Govt.com
        Govt.com d
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5000
      • C:\Windows\SysWOW64\choice.exe
        choice /d n /t 5
        3⤵
        • System Location Discovery: System Language Discovery
        PID:940

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Govt.com
        • Path C:\Users\Admin\AppData\Local\Temp\432348\Govt.com
        • Size 925KB
        • SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        d
        • Path C:\Users\Admin\AppData\Local\Temp\432348\d
        • Size 459KB
        • SHA256 092f85e25cc80ce2c5b554136f1ca9bb795368fbf2c404ec7a732d10680da71d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Achieved.aifc
        • Path C:\Users\Admin\AppData\Local\Temp\Achieved.aifc
        • Size 61KB
        • SHA256 7b32032851f62ab976532d137c8532cadac600500a6b1cbf44eb88e1bee1a4db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Analyze
        • Path C:\Users\Admin\AppData\Local\Temp\Analyze
        • Size 1KB
        • SHA256 740b5660932e459c88f76d8fc3098645ab8be5bae6e896c529025dbe3f4627aa
        • MD5 SHA1 SHA512
        Submit Download

        Artwork
        • Path C:\Users\Admin\AppData\Local\Temp\Artwork
        • Size 107KB
        • SHA256 6b1a59a50443ee93087a4337c3c2a8ebf1ae4b738799ca20da659fa8e17bfb15
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Belfast.aifc
        • Path C:\Users\Admin\AppData\Local\Temp\Belfast.aifc
        • Size 478KB
        • SHA256 c6bee0e758426abd130841883157554c3a3104accad72be7c24d01de57e2f58d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Central.aifc
        • Path C:\Users\Admin\AppData\Local\Temp\Central.aifc
        • Size 17KB
        • SHA256 9bc0cc61ad709051693a2be40e62c3b7c7a14ca9f041056fe9db03f182061076
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Customize.aifc
        • Path C:\Users\Admin\AppData\Local\Temp\Customize.aifc
        • Size 64KB
        • SHA256 315f27d308303c1271e9874b96a619dfc2db29ead55e6fbc453baccf7e541e5d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Dave.aifc
        • Path C:\Users\Admin\AppData\Local\Temp\Dave.aifc
        • Size 62KB
        • SHA256 81870499c10a6b97aef9999e0cc6e6ba617025ec2c1e49783c5d39ee05b4ff79
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Dining
        • Path C:\Users\Admin\AppData\Local\Temp\Dining
        • Size 53KB
        • SHA256 ade5bf5f4d08bf99160a27a6f15434310421a7109f39db021c2b0097f1ae506a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Dust
        • Path C:\Users\Admin\AppData\Local\Temp\Dust
        • Size 140KB
        • SHA256 482b13a513a7e8b3a24727e61d120d75a5b1d00378046a7d9f89c290d75a378c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Implementation
        • Path C:\Users\Admin\AppData\Local\Temp\Implementation
        • Size 59KB
        • SHA256 280ce092313b7ee5821a138b4a0f9ee2f53710eab30b96c669d0d7ac8b14ba5e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Mac.aifc
        • Path C:\Users\Admin\AppData\Local\Temp\Mac.aifc
        • Size 24KB
        • SHA256 bc0f04a2e51f4363e59aa646bb781efd7ddaf1427976dbef11cf98001ef36d72
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Minolta.aifc
        • Path C:\Users\Admin\AppData\Local\Temp\Minolta.aifc
        • Size 87KB
        • SHA256 7e3353db9e649dd7d8bb115c41ecfae63cdc4793b4aac4b9ef4ff5db35b20290
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Pe.aifc
        • Path C:\Users\Admin\AppData\Local\Temp\Pe.aifc
        • Size 77KB
        • SHA256 9589c2bf0a6560b6e88f6ca0d179d146b65516b1fe292f549d57a9a18b970f4c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Perry
        • Path C:\Users\Admin\AppData\Local\Temp\Perry
        • Size 2KB
        • SHA256 dc1c92f7a729305f27a35005c4d7e85d53b5a83a60f301ae8ef0112a4e11c029
        • MD5 SHA1 SHA512
        Submit Download

        Personalized
        • Path C:\Users\Admin\AppData\Local\Temp\Personalized
        • Size 111KB
        • SHA256 615cff454608a644f6878e4946c05664cdc8fbc95c943570a0ca80e1c020c84b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Reach
        • Path C:\Users\Admin\AppData\Local\Temp\Reach
        • Size 97KB
        • SHA256 f1e64e57dde435027c491e2610c246688d1a8ba7e73f8af3548724ad3cfe037e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Richardson
        • Path C:\Users\Admin\AppData\Local\Temp\Richardson
        • Size 60KB
        • SHA256 1ae5a342203cf1103a5cb7613df9af4ef98a9ea9f95b5922bf3d75e220a2d30c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Significantly.aifc
        • Path C:\Users\Admin\AppData\Local\Temp\Significantly.aifc
        • Size 91KB
        • SHA256 50d6b62a45039bf9642b597e0c63e1430ff383e29cab8b17f26d4e156468a3e4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Supplies
        • Path C:\Users\Admin\AppData\Local\Temp\Supplies
        • Size 94KB
        • SHA256 54e1d5965879216e29d333c733c4a3ce3bb9d5db6113397c2fc0203159595931
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Thanks
        • Path C:\Users\Admin\AppData\Local\Temp\Thanks
        • Size 130KB
        • SHA256 94a691697614e49bf4c5ecdf6aec77a491497ae55510af92c774af936e44503c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Timothy
        • Path C:\Users\Admin\AppData\Local\Temp\Timothy
        • Size 70KB
        • SHA256 63149b7ca025c3c999e9919dd78b01e8860567fac4be7a9acf44a636201054fa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/5000-594-0x0000000004A30000-0x0000000004A8E000-memory.dmp
        Download

        memory/5000-595-0x0000000004A30000-0x0000000004A8E000-memory.dmp
        Download

        memory/5000-596-0x0000000004A30000-0x0000000004A8E000-memory.dmp
        Download

        memory/5000-597-0x0000000004A30000-0x0000000004A8E000-memory.dmp
        Download

        memory/5000-598-0x0000000004A30000-0x0000000004A8E000-memory.dmp
        Download