lumma | 5835594a7d29cc3b25e373ab04ffe6137efccf1f10f89730d18353f43e2c60c7

Analysis

max time kernel
40s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9.7.6/9.7.6.lnk
Size

1KB
MD5

e1a00ff52e4d478249296f61b03f8058
SHA1

65ae2d5d15cafc30f29684a68e6fd77aff94f138
SHA256

ff9d3aa1b5ba533768b7b4d30e6f42d27edd12461b83a19802889276b0a4237c
SHA512

d6157c327162da38647b8c5aeeac88a9042fd73ffb7606f8dc5b9981d27defcf127f7f34d2ed937988ce35c1ecd7b713c6378d96c1c1714ddd1702deeace49d8

Score

10^/10

lumma stealer

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
94.156.8.173
Port:
21
Username:
anonymous
Password:
anonymous@

Extracted

Family

lumma

https://foodypannyjsud.shop/api

https://potterryisiw.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation cmd.exe
Executes dropped EXE 1 IoCs

Processes:

update.exe

pid process

4592 update.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

update.exe

description pid process target process

PID 4592 set thread context of 1356 4592 update.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1860 4592 WerFault.exe update.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

test.exe

pid process

4864 test.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	cmd.exe

pid	process
4592	update.exe

description	pid	process	target process
PID 4592 set thread context of 1356	4592	update.exe	RegAsm.exe

pid	pid_target	process	target process
1860	4592	WerFault.exe	update.exe

pid	process
4864	test.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

cmd.exetest.execmd.exeupdate.exe

description	pid	process	target process
PID 3716 wrote to memory of 4864	3716	cmd.exe	test.exe
PID 3716 wrote to memory of 4864	3716	cmd.exe	test.exe
PID 4864 wrote to memory of 1116	4864	test.exe	cmd.exe
PID 4864 wrote to memory of 1116	4864	test.exe	cmd.exe
PID 1116 wrote to memory of 4592	1116	cmd.exe	update.exe
PID 1116 wrote to memory of 4592	1116	cmd.exe	update.exe
PID 1116 wrote to memory of 4592	1116	cmd.exe	update.exe
PID 4592 wrote to memory of 3436	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 3436	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 3436	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 2504	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 2504	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 2504	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 1356	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 1356	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 1356	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 1356	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 1356	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 1356	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 1356	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 1356	4592	update.exe	RegAsm.exe
PID 4592 wrote to memory of 1356	4592	update.exe	RegAsm.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\9.7.6\9.7.6.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3716

C:\Users\Admin\AppData\Local\Temp\9.7.6\test.dist\test.exe
"C:\Users\Admin\AppData\Local\Temp\9.7.6\test.dist\test.exe"
2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp7fu3ohmh\update.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Local\Temp\tmp7fu3ohmh\update.exe
C:\Users\Admin\AppData\Local\Temp\tmp7fu3ohmh\update.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:3436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:2504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 328
5⤵
- Program crash
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4592 -ip 4592
1⤵
PID:4784

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7fu3ohmh\update.exe
Filesize
520KB

MD5
d4f63513d2b56e6185436de3d4f01540

SHA1
05bc1e772f50df2c9304a6c8c62f1686a7c44e32

SHA256
d3b5d0061fad4b8d09eeffdba62a4f662f64c36cd1862002a05197f76cace4c6

SHA512
6f00b734e0cc0c92406c727471eae977b187e45571ca3ad17f797d8a2a079c25384b1d4fef802cc36da7537c893b32bca89de16586317a66db5ebe83f14532a0

Download Submit
memory/1356-12-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1356-13-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4864-5-0x00007FFEF7EB0000-0x00007FFEF7EDA000-memory.dmp

Filesize
168KB

Download
memory/4864-4-0x00007FF6CAEB0000-0x00007FF6CCD5F000-memory.dmp

Filesize
30.7MB

Download
memory/4864-15-0x00007FF6CAEB0000-0x00007FF6CCD5F000-memory.dmp

Filesize
30.7MB

Download
memory/4864-18-0x00007FFEF7EB0000-0x00007FFEF7EDA000-memory.dmp

Filesize
168KB

Download
memory/4864-17-0x00007FF6CAEB0000-0x00007FF6CCD5F000-memory.dmp

Filesize
30.7MB

Download