eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
Since the beginning of August 2023, the eSentire Threat Response Unit (TRU) has observed 5 cases of Lumma Stealer infections across manufacturing, retail, and business industries.
The infostealer was delivered via drive-by downloads disguised as fake installers such as Chrome and Edge browser installers. and some of them were distributed via PrivateLoader (a loader known to drop malware such as Redline, DCRat, and RaccoonStealer in the past).
eSentire TRU recently published a TRU Positive on LummaC2 delivering Amadey and PrivateLoader; you can access the article here.
Lumma Stealer, also known as LummaC2, first appeared on Russian-speaking forums at the end of 2022. The stealer is written in C++, and the build size is approximately 150-396 KB. The pricing for the stealer is divided into three categories:
Experienced - $250/month: Includes capabilities such as downloading logs in bulk and the ability to filter the logs by specific parameters.
Professional - $500/month: Includes capabilities such as creating an unlimited number of rules for the stealer, sharing the statistics with other people, non-residential loader, etc.
Corporate - $1000/month: The developer claims that with the corporate plan, the user gets a random build by the morpher, which means each generated build is different from the other, implemented Heaven’s Gate (a technique used by malware to transition from 32-bit code execution to 64-bit code execution on x64 Windows systems, it’s used to bypass dynamic analysis by sandboxes and debuggers).
Figure 1: Stealer advertisement on Russian speaking forums
The stealer features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell:
Figure 2: Non-resident loader
Some other notable features of the stealer include:
Control Flow Flattening – code obfuscation technique used to make the program's control flow more complex and harder to analyze.
“Spreading without the crypt protection” – if the generated stealer build is not crypted, the pop-up message will show up for the user upon running the build, as shown in Figure 3.
Flexible file grabber – the ability to directly change the rules in the profile to grab specific data.
Figure 3: Pop-up message if the build is not crypted
Technical Analysis
From the previous versions of the stealer (the sample we observed in June, MD5: a4e04604c178fe4fd19996b4d48b8885), as an obfuscation method, the stealer appends strings such as “576xe” to the data.
Figure 4: String obfuscation for previous versions of LummaC2
But with the latest versions (version 4.0), the stealer obfuscates the strings with an XOR algorithm. It converts the hexadecimal characters in the string into the decimal value. The first four bytes of the byte array of the string are used as the XOR key. Each subsequent byte in the array is XORed with the mentioned four bytes in a cyclic manner. The decryption is shown algorithm is shown in the screenshot below.
Figure 5: LummaC2 decryption algorithm
We implemented the string decrypter for LummaC2 in Python, which you can access here.
Figure 6: String decrypter implementation in Python
The stealer uses MurmurHash2 hashing algorithm to resolve the APIs, in our example the seed is 0x20. The API hashing function is obfuscated with control flow flattening as the rest of the code (Figure 8).
Figure 7: Snippet of code with control flow flattening
Figure 8: API hashing function
We wrote the script
to produce the hash values based on the seed for each API call within the DLL library found in the stealer.
C2 Communication
Upon the initial infection, the stealer retrieves the configuration from the C2 (/c2conf). @Jane_0sint provided insights on decrypting the configuration using the first 32-byte of the base64-encoded string as the key. That means that the crypto wallet extensions, applications, and list of browsers are not embedded in the stealer build anymore compared to previous versions of the stealer.
Here is the example of the decrypted configuration retrieved from C2 (JSON format):
We wrote the configuration retrieval script in Python, which you can access here. You can also access the configuration extractor for the builder here.
Figure 9: Output of the configuration extractor script
Example of additional data obtained from C2: lid=KjGtqi--VIKKY&j=e799236f7a828928688bbd10d343328e&ver=4.0, where the lid is the LummaC2 ID, the value “VIKKY” is likely the build ID assigned and the stealer version (ver=). The logs are exfiltrated over the ZIP archive, as shown in the screenshot below (/c2sock).
Figure 10: Exfiltrated logs
Figure 11: Log formatting (System.txt)
Figure 12: Function responsible for collecting system information and parsing it to the System.txt file
Figure 13: The contents of the ZIP archive (Source: Dark2Web)
We also provided remediation recommendations and support to the customer.
What can you learn from this TRU positive?
LummaC2, which is written in C++, is delivered via drive-by downloads.
The new version of the stealer (4.0) uses the XOR algorithm for string encryption.
It applies control flow flattening to complicate the analysis as well as API hashing using the MurmurHash2 hashing algorithm.
LummaC2 Stealer is sold in three different tiers: Experienced, Professional, and Corporate. The last one comes with a Heaven’s Gate technique.
Recommendations from our Threat Response Unit (TRU):
Protecting against information stealers requires a multi-layered defense approach to defend endpoints from malware and detect or block unauthorized login activity against applications and remote access services. Therefore, we recommend:
Restricting access to enterprise applications from personal devices outside the scope of security monitoring.
Ensuring adequate logging is in place for remote access services such as VPNs and using modern authentication methods, which support MFA and conditional access.
Prevent web browsers from automatically saving and storing passwords.
It is recommended to use password managers instead.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.
Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of cookies. Visit our Privacy Policy to learn more.
