Analysis
- max time kernel
104s - max time network
141s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20250619-en - resource tags
- submitted
14/07/2025, 18:14
General
- Target AutomáticosAutoPáraPC_patched.exe
- Size 7.0MB
- Sample250714-wvb59swtft
- SHA256 f973cfe37510b144d313faa545954367870d3193e35c8426cfd4553262f08377
Malware Config
Extracted
-
lumma
-
https://t.me/dikwujx
-
https://ungryo.shop/gnbw
-
https://prvqhm.shop/zaus
-
https://sorrij.top/adjh
-
https://bardj.xyz/tieq
-
https://annwt.xyz/xkan
-
https://greqjfu.xyz/uhbf
-
https://vervzv.xyz/xmgr
-
https://dryzc.xyz/apxe
-
build_id
116ac9889fbaa8a2772e47aec2f341e8891354a0
Signatures
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Drops startup file 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\AutomáticosAutoPáraPC_patched.exe"C:\Users\Admin\AppData\Local\Temp\AutomáticosAutoPáraPC_patched.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c copy Will.jpg Will.jpg.cmd & Will.jpg.cmd3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "opssvc wrsa"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set GVjCSBhCeTgbGAhocrOnGsoBGCPGhPdyNZ=AutoIt3.exe & Set gxHEENlQICNXsOsWRRNRtlAYWDfYXtrsv=.a3x & Set pzVmRNDJrNYGBXbrzAGDIydEe=3004⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\extrac32.exeextrac32 /Y Attention.jpg *.*4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "ed" Threat4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\817818\Vampire.comVampire.com Q4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 54⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DemeterMapper.url" & echo URL="C:\Users\Admin\AppData\Local\EcoVision Solutions\DemeterMapper.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DemeterMapper.url" & exit2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
Q
Vampire.com
Adapted.jpg
Asian
Attention.jpg
Begin.jpg
Biography
Canon.jpg
Decor.jpg
Estimate
Implied
Involves
Nuke
Other
Pale
Same.jpg
Shakira
Temporarily
Tgp.jpg
Threat
Trim.jpg
Will.jpg
nsExec.dll
memory/4928-82-0x00000000004A0000-0x00000000004FF000-memory.dmp
memory/4928-83-0x00000000004A0000-0x00000000004FF000-memory.dmp
memory/4928-84-0x00000000004A0000-0x00000000004FF000-memory.dmp
memory/4928-85-0x00000000004A0000-0x00000000004FF000-memory.dmp
memory/4928-86-0x00000000004A0000-0x00000000004FF000-memory.dmp