lumma | f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478

General

Target
Memenite.exe
Size 490KB
Sample260727-2qlrsssfpd
SHA256 f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
MD5 9c9245810bad661af3d6efec543d34fd
SHA1 93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d
SHA512 90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767
SSDEEP 6144:3PkcFUUUQHs5TlOhDuy4VjmSO6/tU4j06xeJyCjvhsXZ4m05d0qCsfBLuWWCV/rr:3McWUUysz/NhKjJPhM4/5bV/rvgE3
TLSH
T11DB4CF09724740F1E27A9AF20648F93C873AD928CFF669575F714A3D97E214C0B7862E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery lumma spyware stealer trojan

Malware Config

Extracted

Family

lumma

C2

https://pillowbrocccolipe.shop/api
https://communicationgenerwo.shop/api
https://diskretainvigorousiw.shop/api
https://affordcharmcropwo.shop/api
https://dismissalcylinderhostw.shop/api
https://enthusiasimtitleow.shop/api
https://worryfillvolcawoi.shop/api
https://cleartotalfisherwo.shop/api
https://sideindexfollowragelrew.pw/api

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Memenite.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\27E6663299D340DFE54571CECCEC01BE74495DC6\Blob = 03000000010000001400000027e6663299d340dfe54571ceccec01be74495dc61400000001000000140000000639f056d1ed90c836a3a00f94fe6294a7e6fc370400000001000000100000009594980a801baf457183e059640af9470f00000001000000300000000f09198c44c70a123fd30e935382f0c987b23f68b6687787b22f6bed53b83c55ccda23ed620c80b20895d1f76efea6be190000000100000010000000e9aec682faf1b2f7c1a9a35177ee9d895c0000000100000004000000001000001800000001000000100000007a3313065037973cd918f1d646af966a2000000001000000bc070000308207b8308205a0a0030201020213330000000e42938f25dc51a99b00000000000e300d06092a864886f70d01010c05003051310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31223020060355040313194d6963726f736f667420544c532052534120526f6f74204732301e170d3235303830313230303330325a170d3239303630333230303330325a3057310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420544c5320473220525341204341204f43535020313630820222300d06092a864886f70d01010105000382020f003082020a028202010093725fb0fca07a11dd6fce139bf34f442e3feca6e2bfaf2fc80799cce3d5874d5b33a7e55947c51d947be85347a3f17ce422a5b847fe001e5ebd70779604d57657fc83b3795157f424144d79499ab7dc4792f63ca6352ad1b66f5f1bd660bed182a26f3785e56a2454e78887f03ed7005edae7d534e30eafe1d4f8775a55d46713f741485f4f2c60752801a8b35a7085c7588506dfa14c2ba157d9a96cba1c86ba01f6d0141a05f88b31e595f23137d511a2989d3fef722f5110405ee2e31b429606376805e4fab8d5545d1ee194daf251a3e43e7bbec3aea54142163d91da90bd08ad4a2ac84518302e50f7caa647c3ef03cf4a3d7e6c7cb2a7b9461a27129a99124ca22b5aa5e5a3bba1cace72ef4763b0be734947cec2a9d544b4418df34737cc6c07631cd89682e43f6e7653649ddcf8c233ae8bcb5b1474402d08084fa0f20394cf82c7e2338850a91fd2c17a502c21c6cdc06231b6fed102e653a4b1527996ee655939d1dba234a306be216ae299ae2d2ae82d083a905a88e7f001a9ebd004c421690f3dc9a67ef1bf3972829097384cb6ef257e61f2ff0cbef5bded7d477556f8f6f3a8e16d8332c8515ffd269281dfc89414328096aea609de4cd7642891325a27926964844aa11ebcc411bb15551dd08ca716672047445a676c18ba01de943cda826d577154436cf2cabccdbb801755ced97b8c2d9d504ff6efe8870203010001a38202813082027d300e0603551d0f0101ff040403020186301006092b06010401823715010403020100301d0603551d0e041604140639f056d1ed90c836a3a00f94fe6294a7e6fc3730130603551d20040c300a3008060667810c01020230130603551d25040c300a06082b06010505070301301906092b0601040182371402040c1e0a0053007500620043004130120603551d130101ff040830060101ff020100301f0603551d23041830168014de918648b7a1315931f14b5f07a9dc8879daa8763081ab0603551d1f0481a33081a030819da0819aa081978649687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322e63726c864a687474703a2f2f63726c322e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322e63726c3082011006082b06010505070101048201023081ff306306082b060105050730028657687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322532302d253230787369676e2e637274306906082b06010505073002865d687474703a2f2f6361697373756572732e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322532302d253230787369676e2e637274302d06082b060105050730018621687474703a2f2f6f6e656f6373702e6d6963726f736f66742e636f6d2f6f637370300d06092a864886f70d01010c050003820201008186235256b3ddd33ba832a5cee7dc7ed5e508a6852f2754513763764d746eeeb49bf2af10203b577bab9da4060c0b67533c95c96e4c39ab7c2219bbebecf94c8d999e8987e9002601b099328f0aa4e285b27f875d23892a16e097ed16ee503258d9749d785252eb413c307d81b1addd10567ab3af84bc43facfff60d30504908ffb8b6ae2816952a83d02f5d08c4891cb888fcdc2d1a32a3d40d95a35e0cbc74111e8fcb4c2a00652b73b99cde5991700f9178c8d4521944bd37403f1b7ac2ccf956f8b6572f6f693c5dd42912fd112bc6e3798eba23e4366a73aad24408ea8889e1cfd0144a052d57098824d8f3a8599934b0d62e13b27c61c32e4ded4b4aed2189de624027085dc32de5acc3e04a1c36cb32e56db383198ab06bb073a433d012d10755d6caefc42fd374d61ffc3a2901afd8816daa35626df267b101208e6b349abea144e0ece06d0b21f06a0ece090b6a390270dcfcddbf08386755d7c76ccaef6dcd9fa8dc71ff84d07af481962339a4de6cde7411d7ae8209399abe1f76378f729046f743e88763a841908efa7bf0dbe1b75a7aaec875a5c43185111b9923de49fbd0ae12637714087a1135d91043335707b3885b98e01bae472fd175b9287d07b2a6263115cfd2b387f2b1f72dca1266f8791ca2e2d73d0ad124158dc2996d206e90578709b31061d0e93d3c6284a88910e947d6ae5e2562b47f36148	Memenite.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184	Memenite.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184\Blob = 030000000100000014000000b5ee89e77326ab2bf1775bd99c19a28947ff8184140000000100000014000000de918648b7a1315931f14b5f07a9dc8879daa876040000000100000010000000404cec03f94fcadd4ca3048e787ea2690f000000010000003000000086a8cab49724c4dc183b07f383b4e29f93939bdafc40c1cf8396320f734bd585b00363cd979b85341813a145537033f91900000001000000100000007a3313065037973cd918f1d646af966a5c00000001000000040000000010000018000000010000001000000014c3bd3549ee225aece13734ad8ca0b820000000010000008d0500003082058930820471a00302010202100b0c6b2c466917b04773c647d4afc0c8300d06092a864886f70d01010c05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3235303532313030303030305a170d3239303631393233353935395a3051310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31223020060355040313194d6963726f736f667420544c532052534120526f6f7420473230820222300d06092a864886f70d01010105000382020f003082020a0282020100dfea8b9f47e1281071af41d619db9257de6babe62edead3a6083b71398ac5bb9320b7beb9f72276b5d40abbe180693b20dd212edb874f57f2feaa81794f63316578ade207c21ddb7daacde4e64b05acd4b75f3ef02644ded52daa38f04e891f8d7fb3f19fd4e45395ee829c3d6f267afb30094c18de1f04a189839fac009843341050305abf475e153a521925c444ce66057a4900297c7d5d89304324aed8551edd6c5baa03f368a2f6f4c39a8046922843b7514f7d93eb4a9d0074138817e46481de819e670b8a0aa18dd72bf7e7db56c4e19701184041381d462fd9c6bf11cddffeca7e0e6c78d314bbff26b33ccd18cb6feb11ba34aa85f0e7f3176383f07476c01a8aca514da82b05f1f6cbc891ac0122acb7b971f282e31168a534c7566f97d01d6c260aa658f319e72cbcc9b2de544199357ab6e8ec2d92e65b0722de7a1c3a17e491d5967d609d418126dc0954578c9f1606ae4f6ee06243b734a5a11c23e9761c078eeef13a730e24a382dee58171320b7362adf0b32b4c238b191dd12b045b67cc0b11d62a19ddd71121596019d0a09f5b1ddb3d9e0384234f669b6c3af1673fed443f843e458f94fb3f3ecd63d943a403815ab0c86d064ce1a63e8849455095ab604b6d13e9a15c7641180d01b820e4dff459eb26507251fdb9ac8c6ecd65b8550049f1ccb5d2082679e79e2dfe8f2e86fc420723086e59d7527350203010001a382014b30820147300f0603551d130101ff040530030101ff301d0603551d0e04160414de918648b7a1315931f14b5f07a9dc8879daa876301f0603551d230418301680144e2254201895e6e36ee60ffafab912ed06178f39300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070301307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63726c30130603551d20040c300a3008060667810c010202300d06092a864886f70d01010c050003820101000bbcb42b3774c54ba7360236c6afe113cc8a9a971bfce3448cee5400e5e4411a46f00b7634ff99556235aaad8a9c0c5a62cc43c0cbea4a1dbd6b1dafb11925669cf7796e5b2580248185c7792d355f420978ed9fe265d5c4205082108f6a3aed188e4889aba609f8e180fc06751627255a8fb83a706c1847f063f4530ed9153520f3913d1301a0e2fa2408455677d167a93142d057ff1a26bec543d857a963ffaff33ad8f67b4b10a297a1cf66be676709f9b54ce7ab192bbf223d7ddec6f7ef63382cdd56c4f90952dadfe3886fd56d6bf708412f8e3e86319ff17c4af5d661a4464628ef57bab06f92d8d27725ed7ba629ce3b727911d4e0a7546d352ba47a	Memenite.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\DA6D0400641B45AECC595D24E5037AA6BC09C358	Memenite.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\DA6D0400641B45AECC595D24E5037AA6BC09C358\Blob = 030000000100000014000000da6d0400641b45aecc595d24e5037aa6bc09c358140000000100000014000000540cbcec18f77df103e284be34644467cf751f650400000001000000100000008006d64d9f8f5aadc43418f442b88fe40f0000000100000030000000328449c5fee65f44c3fb7ba1560fb1d18a5e82527c31f47a33cb8937b3868ff662207cbaa21b7e69e623f113bcb627f919000000010000001000000001f3df139c9b07ad46a8dd01190294f25c0000000100000004000000001000001800000001000000100000007a3313065037973cd918f1d646af966a2000000001000000bc070000308207b8308205a0a0030201020213330000000b13e5667d4a9b558000000000000b300d06092a864886f70d01010c05003051310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31223020060355040313194d6963726f736f667420544c532052534120526f6f74204732301e170d3235303830313230303235395a170d3239303630333230303235395a3057310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420544c5320473220525341204341204f43535020303430820222300d06092a864886f70d01010105000382020f003082020a02820201009c3a24085a1892f29ed560cde2e6fb8047db44ae2bdd6d107021154529aad2c7dce6c442b1a08d52e04f5c395506364d17c1586634e285529fe2a4fec6dec2c23b86bfcaad872906eb1d491d5f81dbb7a4ac561ad61287fd5f4049e2a00c6a84c64e6fdf24b89a95745a597fade93c13157840ccecdaef88364a90deea630794c3836a1aae98e6f164805a296704e856f421a6c5468dc8dd02abbc06f06c477823bb38b0bbfb4d71b0df22c37f1a7ef99daa412ad1de68dd9574253866c91611c5593d2ab168b9933b66e83ce1fca7ff2c6b50e0c0b9c8717393b177bfedaa4d0e0a55db139c72e069ad814cda23f906cb3fed428a868c0dd20c1525d08668eb7856aa2e5c08b34d33804eee353c2fc37a7dc16672606890f4ebf608ec13d789925f5c52f4879578b136e1b342536e3a373707c873751ebb5d6e67c99a7ccb4af3c6cdf04ef586fb143519463d97867264dd4336efd4578200220ca33aedb3657065f982a5bab8d2eac0688a3537a040f5fe028966a830f89447625747b27b9b8cc795bceb9af6c68c4489db16e61efde789fc81353530ea2f7d896452b3461934e33b574f0a182031efc5fdb9b127f6975935fb0ac244d6d0b2ed554d1d57487512d7f29860169ec4069cd4ae7e2e65c753e422251830636a9057c594b4f7e54d4c0d54c71fa93d4d0a460962d0232251e38e374cc5f40140990582d3a2b0530203010001a38202813082027d300e0603551d0f0101ff040403020186301006092b06010401823715010403020100301d0603551d0e04160414540cbcec18f77df103e284be34644467cf751f6530130603551d20040c300a3008060667810c01020230130603551d25040c300a06082b06010505070301301906092b0601040182371402040c1e0a0053007500620043004130120603551d130101ff040830060101ff020100301f0603551d23041830168014de918648b7a1315931f14b5f07a9dc8879daa8763081ab0603551d1f0481a33081a030819da0819aa081978649687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322e63726c864a687474703a2f2f63726c322e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322e63726c3082011006082b06010505070101048201023081ff306306082b060105050730028657687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322532302d253230787369676e2e637274306906082b06010505073002865d687474703a2f2f6361697373756572732e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d6963726f736f6674253230544c53253230525341253230526f6f7425323047322532302d253230787369676e2e637274302d06082b060105050730018621687474703a2f2f6f6e656f6373702e6d6963726f736f66742e636f6d2f6f637370300d06092a864886f70d01010c050003820201007c4871c2b6c045ab740fc63f49e2fc0fd675fdcd50d1e04bb3b3d1a8995ffe5d350d6c0bddd0ad6160188938e2f0b735d2b5213a0c0e5899387cd4d7dd024dd4dcf5ee90e37b6793a8acd41b50bbc54fe6d3f1b51ef0ff99bc2333b0c8a8a627d6d15bed6f14de4b071a0c50fd0edfbeeb4fb29810cb222ae61dd74ba7ae15d10136090b86434f4ee7c57e5ca36b832e493e9488998b52d3963f7198242f3782fa6c74f2bcdb0621bbb85067702415b60b228ff7b927e4037c8495b76604a99255c2bd11c7210a727f65c060a65049e9f62348203a8e9226a8178c98af14a73dce4cadc08e8c3c44f17ffb13f914d77b333d105e64e7273d0c4ce271d766ceaef74eb664ba542bb7fd03d798679837b20a6320e5b0fbd8a48d3a2e42229a22f42655833015c7a242b3bfd036c53652a773677a736e54acbce989d8a5eb1f6dac2750c4c8ebd41c54294dbbb6deabd7c7f11f1464ba7f473165ef797d14c4f019e48076e73b28009b446f2457f507dc8e5ab400589756b10bfa087571de1b53c8eebdf0ab224cbd6bba5d8a44593c246baabce97d8b5f4a4dd78c54b0ab769b80284d457465106021f98e795fda92fb178400dbc4ae8259813c27779e56f707c8bdbe3d91c5978ae69c0f591658486c7da41632ed16c92da796f5e4fdc5cf65a4ddd700e8c90ef49db2a40280cc1bf028ebb03177349ec3ccd7c89b36bbc525e2	Memenite.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\27E6663299D340DFE54571CECCEC01BE74495DC6	Memenite.exe

C:\Users\Admin\AppData\Local\Temp\Memenite.exe
"C:\Users\Admin\AppData\Local\Temp\Memenite.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x00000000009B0000-0x00000000009FB000-memory.dmp

Download

memory/2416-5-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

Download

memory/2416-10-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/2416-9-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/2416-8-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/2416-7-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/2416-6-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

Download

memory/2416-17-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

Download

memory/2416-18-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

Download

memory/2416-19-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/2416-20-0x00000000009B0000-0x00000000009FB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads