Analysis
- max time kernel
103s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
28/07/2025, 14:16
General
- Target setup.exe
- Size 90.0MB
- Sample250728-rlgbeaywbs
- SHA256 57ff83b1389cb1e6bd677b08f523e3c934c94b9ae474d5f02546d1adcab6e38a
Malware Config
Extracted
-
lumma
-
https://t.me/sadv1323v13q4as
-
https://conaqr.click/qokl
-
https://mastwin.in/qsaz/api
-
https://precisionbiomeds.com/ikg
-
https://physicianusepeptides.com/opu
-
https://inkermen.top/nuxe
-
https://htsfhtdrjbyy1bgxbv.cfd/vcd
-
https://xurekodip.com/qpdl
-
https://utvp1.net/zkaj
-
https://orienderi.com/xori
-
build_id
9f716d5b54971f4379fa987f6ca1af7991d63e33a17556
Signatures
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /k cmd < Bonds.pub & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "opssvc wrsa"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set SuLrhTacSMMQs=AutoIt3.exe & Set BAGeehcjrpxckw=.a3x & Set NKBzBhyDfIwI=3004⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\extrac32.exeextrac32 /Y Voyeurweb.pub *.*4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "mercy" Emma4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\364029\Detected.comDetected.com l4⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 54⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Detected.com
l
Accessible
Ago
Bonds.pub
Chances.pub
Checking.pub
Day.pub
Emma
Fwd.pub
Gamma
Hamilton
Innovation.pub
Je.pub
Li
Rachel
To.pub
Voyeurweb.pub
Wc
Welfare
nsExec.dll
memory/5080-67-0x00000000042F0000-0x000000000434E000-memory.dmp
memory/5080-68-0x00000000042F0000-0x000000000434E000-memory.dmp
memory/5080-69-0x00000000042F0000-0x000000000434E000-memory.dmp
memory/5080-71-0x00000000042F0000-0x000000000434E000-memory.dmp
memory/5080-70-0x00000000042F0000-0x000000000434E000-memory.dmp