lumma | 8c09b0520cd0a587ccdab5f16b202ef013d9bf3b4fc7653b5afdf480417d33f1

Analysis

max time kernel
83s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

5.8MB
MD5

c34e8f27e5e41acc13f476298be901f5
SHA1

1857dfcf2bbb4e91fed3595395cc6ea1b6e5e425
SHA256

8c09b0520cd0a587ccdab5f16b202ef013d9bf3b4fc7653b5afdf480417d33f1
SHA512

ccc416d96d36b792c59bdfd23c5e2e3b2c08c3498e43af7e0e5b873e0828c23fb30c1f21428fb8f984df99255d232e718422ce95acc8bba888da082f465c6709
SSDEEP

98304:vsMDHDRm8rcgEqQQ5izvWtb2ZaQ9kclxrg/bYzO6TEYJYEHjHO:RHDRLrcgEq55izvWtDaxbBOLYJYmu

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://prettilikeopwp.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 1388 set thread context of 1084 1388 Setup.exe more.com

description	pid	process	target process
PID 1388 set thread context of 1084	1388	Setup.exe	more.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

Setup.exemore.comtaskmgr.exe

pid	process
1388	Setup.exe
1388	Setup.exe
1084	more.com
1084	more.com
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Setup.exemore.com

pid process

1388 Setup.exe
1084 more.com

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	1732	taskmgr.exe
Token: SeSystemProfilePrivilege	1732	taskmgr.exe
Token: SeCreateGlobalPrivilege	1732	taskmgr.exe
Token: 33	1732	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1732	taskmgr.exe

Suspicious use of FindShellTrayWindow 44 IoCs

Processes:

taskmgr.exe

pid	process
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe

Suspicious use of SendNotifyMessage 43 IoCs

Processes:

taskmgr.exe

pid	process
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe
1732	taskmgr.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Setup.exemore.com

description	pid	process	target process
PID 1388 wrote to memory of 1084	1388	Setup.exe	more.com
PID 1388 wrote to memory of 1084	1388	Setup.exe	more.com
PID 1388 wrote to memory of 1084	1388	Setup.exe	more.com
PID 1388 wrote to memory of 1084	1388	Setup.exe	more.com
PID 1084 wrote to memory of 2688	1084	more.com	SearchIndexer.exe
PID 1084 wrote to memory of 2688	1084	more.com	SearchIndexer.exe
PID 1084 wrote to memory of 2688	1084	more.com	SearchIndexer.exe
PID 1084 wrote to memory of 2688	1084	more.com	SearchIndexer.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\SearchIndexer.exe
C:\Windows\SysWOW64\SearchIndexer.exe
3⤵
PID:2688

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1732

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8d84fe78
Filesize
1.2MB

MD5
d85456bc93bc20de97041fb8f7f79247

SHA1
d155e82d273925a86ef370c9f3fda0a0cb1112ef

SHA256
9046bbd0bcb00410590ff77db0766c8c26f26afa4eb6431b4fb7d5e5aa8d00bf

SHA512
c6ca930fe9f95058c05ec1c2852645c4c2c967e9423bb058633503541e09bd59bdd42b8eb4a1c11892adf73e2774ce11e90303b01f1f31798d56e5ae23f9de7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\90840a4a
Filesize
1016KB

MD5
30667d9b2c908cf171f74229e4296bd8

SHA1
9fa5ad48815ddeccbd822dce52e2d9db71abb6ee

SHA256
eba253804a830da8f6d53d4d22f9753e7591c1841af72a527e8fb7a07f153352

SHA512
66ae30aac37f89bad0052e3c2f847acab51eecbd00b9a23b9d9c30ae757fe313ca088fc94c8d61bc8e25c20bd259ba31f998c75fb7b7830da7fef733e92dc93f

Download Submit
memory/1084-12-0x0000000074BF0000-0x0000000074C42000-memory.dmp

Filesize
328KB

Download
memory/1084-18-0x0000000074BF0000-0x0000000074C42000-memory.dmp

Filesize
328KB

Download
memory/1084-16-0x0000000074BF0000-0x0000000074C42000-memory.dmp

Filesize
328KB

Download
memory/1084-15-0x0000000074BF0000-0x0000000074C42000-memory.dmp

Filesize
328KB

Download
memory/1084-14-0x00007FF834430000-0x00007FF834625000-memory.dmp

Filesize
2.0MB

Download
memory/1388-10-0x0000000074BF0000-0x0000000074C42000-memory.dmp

Filesize
328KB

Download
memory/1388-0-0x0000000000D00000-0x00000000012DB000-memory.dmp

Filesize
5.9MB

Download
memory/1388-8-0x0000000074C02000-0x0000000074C04000-memory.dmp

Filesize
8KB

Download
memory/1388-9-0x0000000074BF0000-0x0000000074C42000-memory.dmp

Filesize
328KB

Download
memory/1388-7-0x00007FF834430000-0x00007FF834625000-memory.dmp

Filesize
2.0MB

Download
memory/1388-6-0x0000000074BF0000-0x0000000074C42000-memory.dmp

Filesize
328KB

Download
memory/1732-35-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/1732-32-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/1732-29-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/1732-30-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/1732-23-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/1732-25-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/1732-24-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/1732-31-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/1732-34-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/1732-33-0x0000025475390000-0x0000025475391000-memory.dmp

Filesize
4KB

Download
memory/2688-20-0x00000000007B0000-0x000000000080A000-memory.dmp

Filesize
360KB

Download
memory/2688-19-0x00007FF834430000-0x00007FF834625000-memory.dmp

Filesize
2.0MB

Download
memory/2688-22-0x00000000007B0000-0x000000000080A000-memory.dmp

Filesize
360KB

Download
memory/2688-21-0x000000000050B000-0x0000000000512000-memory.dmp

Filesize
28KB

Download