| File name: | FusionLoader v2.1.exe |
| Full analysis: | https://app.any.run/tasks/a4c7bad3-6cb6-4d14-bba2-ab37617b6e23 |
| Verdict: | Malicious activity |
| Threats: | Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat. |
| Analysis date: | January 22, 2025, 01:37:28 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections |
| MD5: | B679EAE26064951C411E1F56B024BC48 |
| SHA1: | 70227E033C14C9BD98464A4D7927D87E9A05FBA9 |
| SHA256: | 4A9B7488ABF73815828429DC0EBF5899CA5C35C4BBC6BEC86DAC5B6146743533 |
| SSDEEP: | 12288:8aTkq2Kl2u7lc5gC7GyVcnrGk0eVpps+LLaBsWbT:vTkq2s2ua5XGySnrGk0Kpa+LLaBsWbT |
MALICIOUS
Executing a file with an untrusted certificate
- FusionLoader v2.1.exe (PID: 2992)
- FusionLoader v2.1.exe (PID: 3608)
LUMMA mutex has been found
- FusionLoader v2.1.exe (PID: 3608)
Steals credentials from Web Browsers
- FusionLoader v2.1.exe (PID: 3608)
Actions looks like stealing of personal data
- FusionLoader v2.1.exe (PID: 3608)
LUMMA has been detected (SURICATA)
- FusionLoader v2.1.exe (PID: 3608)
- svchost.exe (PID: 2192)
Connects to the CnC server
- svchost.exe (PID: 2192)
LUMMA has been detected (YARA)
- FusionLoader v2.1.exe (PID: 3608)
SUSPICIOUS
Application launched itself
- FusionLoader v2.1.exe (PID: 2992)
Executes application which crashes
- FusionLoader v2.1.exe (PID: 2992)
Contacting a server suspected of hosting an CnC
- FusionLoader v2.1.exe (PID: 3608)
- svchost.exe (PID: 2192)
Searches for installed software
- FusionLoader v2.1.exe (PID: 3608)
There is functionality for taking screenshot (YARA)
- FusionLoader v2.1.exe (PID: 3608)
INFO
Checks supported languages
- FusionLoader v2.1.exe (PID: 2992)
- FusionLoader v2.1.exe (PID: 3608)
Reads the computer name
- FusionLoader v2.1.exe (PID: 3608)
- FusionLoader v2.1.exe (PID: 2992)
Reads the software policy settings
- FusionLoader v2.1.exe (PID: 3608)
- WerFault.exe (PID: 6296)
Creates files or folders in the user directory
- WerFault.exe (PID: 6296)
.NET Reactor protector has been detected
- FusionLoader v2.1.exe (PID: 2992)
- FusionLoader v2.1.exe (PID: 3608)
Checks proxy server information
- WerFault.exe (PID: 6296)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (61.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.6) |
| .exe | | | Win32 Executable (generic) (10) |
| .exe | | | Win16/32 Executable Delphi generic (4.6) |
| .exe | | | Generic Win/DOS Executable (4.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2040:08:19 02:06:52+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 63488 |
| InitializedDataSize: | 1024 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x117de |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
Total processes
134
Monitored processes
4
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2992 | "C:\Users\admin\AppData\Local\Temp\FusionLoader v2.1.exe" | C:\Users\admin\AppData\Local\Temp\FusionLoader v2.1.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226505 Modules
| |||||||||||||||
| 3608 | "C:\Users\admin\AppData\Local\Temp\FusionLoader v2.1.exe" | C:\Users\admin\AppData\Local\Temp\FusionLoader v2.1.exe | FusionLoader v2.1.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 6296 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2992 -s 860 | C:\Windows\SysWOW64\WerFault.exe | FusionLoader v2.1.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
3 689
Read events
3 689
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
6
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6296 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_FusionLoader v2._729a2030a020721c5e9cbaf2261b555ba99b6c88_7d7bf3ef_9a931a00-defb-4998-b6ce-f67b62e856c6\Report.wer | — | |
MD5:— | SHA256:— | |||
| 6296 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\FusionLoader v2.1.exe.2992.dmp | — | |
MD5:— | SHA256:— | |||
| 6296 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE | binary | |
MD5:FA84E4BCC92AA5DB735AB50711040CDE | SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33 | |||
| 6296 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER717A.tmp.dmp | binary | |
MD5:9911C3C5D6DFD72572291AE00AD8A113 | SHA256:D1966BE37DC68540CE1B63E1E5FBBFA199A7AE9B90C6497614557003E9221B45 | |||
| 6296 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER74A7.tmp.WERInternalMetadata.xml | binary | |
MD5:5C159803235687B4A6BA2185198E52FA | SHA256:2458C720387247AD0425C96A129E94F4C5043F69387FAAA4EDC1B65677D0F8F2 | |||
| 6296 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785 | binary | |
MD5:680B0331A3CC8FCCE16367586EC7A721 | SHA256:19F1B5D2C7F62663C14D97578411DC610E5F33E6CE4165977314442435F15305 | |||
| 6296 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785 | binary | |
MD5:6439BEA2B0BBE89506345567DAB6823D | SHA256:A6B052062A44BA525E6A4AA96A674B54BA5621C18277B96354962FA56C64A1BA | |||
| 6296 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER74E7.tmp.xml | xml | |
MD5:505B0AC6689C0DEFBB324282E5C4D467 | SHA256:A43193BADA7A51BBDC4EA4A9F73B5BD09D2406ECF09DCFE1F2F86C9724502ABD | |||
| 6296 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE | binary | |
MD5:0D28B492117D4E9C0795377A7EE15178 | SHA256:508CAC6E391B93B103E6DBBA87A9C979F205E3FA2E9153D58E916864A9087322 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
38
DNS requests
15
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6296 | WerFault.exe | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6296 | WerFault.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5876 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5876 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6752 | backgroundTaskHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3608 | FusionLoader v2.1.exe | 104.21.32.1:443 | supplyedtwoz.click | CLOUDFLARENET | — | malicious |
5696 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6296 | WerFault.exe | 20.189.173.22:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6296 | WerFault.exe | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6296 | WerFault.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
supplyedtwoz.click |
| malicious |
settings-win.data.microsoft.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (supplyedtwoz .click) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (supplyedtwoz .click in TLS SNI) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (supplyedtwoz .click in TLS SNI) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (supplyedtwoz .click in TLS SNI) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (supplyedtwoz .click in TLS SNI) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (supplyedtwoz .click in TLS SNI) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (supplyedtwoz .click in TLS SNI) |