Lumma-Stealer-dllhost-Hollowing-C2-Domains-Payload-Extraction-Analysis

1. Setup.exe – Privacy, Driver & Memory Strings

Process Hacker memory analysis of the setup.exe dropper reveals that Lumma Stealer targets privacy settings, installs drivers, and manages memory.

Key Strings Observed:

• Privacy Camera – Attempts to access or disable camera privacy settings.
• Privacy Microphone – Attempts to access or disable microphone privacy settings.
• PreinstallDriver – Indicates driver installation for persistence or evasion.
• MapMemoryB0000 – Memory mapping operation (likely for injection).

Why This Matters:

• Privacy Bypass: The malware may disable camera/microphone privacy settings.
• Driver Installation: PreinstallDriver suggests kernel-level access.
• Memory Mapping: MapMemoryB0000 indicates memory manipulation for injection.

Visual Reference:

Process Hacker view showing setup.exe strings with Privacy Camera, Privacy Microphone, PreinstallDriver, and MapMemoryB0000.

2. Setup.exe – C2 Domain List

Process Hacker memory analysis of the setup.exe dropper reveals a list of domains that are likely used for C2 communication.

Key Domains Observed:

• zhtytomyr.ua – Potential C2 domain.
• pvt.k12.ma.us – Potential C2 domain.
• adobeaemcloud.com – Legitimate-looking domain (abused for C2).
• adobeaemcloud.net – Legitimate-looking domain (abused for C2).
• us-east-1.amazonaws.com – AWS domain (abused for hosting).
• elasticbeanstalk.com – AWS Elastic Beanstalk (abused for hosting).
• alwaysdata.net – Hosting provider (abused for C2).
• altervista.org – Hosting provider (abused for C2).

Why This Matters:

• C2 Communication: These domains are used to exfiltrate stolen data.
• Abuse of Legitimate Services: Domains like amazonaws.com and elasticbeanstalk.com are used to evade detection.
• Redundancy: Multiple domains ensure the malware remains operational if some are blocked.

Visual Reference:

Process Hacker view showing setup.exe strings with C2-like domains.

3. C2 Address – Vagrancy.virus.cc (ALPC Connection)

Binary Ninja analysis of the .bin file extracted from the ALPC-related strings in dllhost.exe reveals a potential C2 address: Vagrancy.virus.cc.

Key Observations:

• Vagrancy.virus.cc – Potential C2 server.
• Source: Extracted from the .bin dump of dllhost.exe (ALPC strings).
• Context: Found alongside NtConnectPort (inter-process communication).

Why This Matters:

• C2 Communication: The malware likely uses this domain to exfiltrate stolen data.
• ALPC Usage: The connection may be established via ALPC for stealth.
• Detection: This domain can be blocked to disrupt the malware's communication.

Visual Reference:

Binary Ninja view showing Vagrancy.virus.cc extracted from ALPC-related .bin data.

4. dllhost.exe – Process Hollowing & Native API Usage

Process Hacker memory analysis of the injected dllhost.exe process reveals that Lumma Stealer uses Process Hollowing techniques with Native API calls.

Key Native APIs Observed:

• NtCreateThreadEx – Creates a thread in a remote process (injection).
• NtWriteVirtualMemory – Writes data into another process's memory.
• NtTerminateProcess – Terminates processes (e.g., security tools).
• NtShutdownSystem – Shuts down or reboots the system.
• NtSetInformationProcess – Modifies process information (evasion).
• NtAdjustPrivilegesToken – Adjusts token privileges (escalation).
• NtSystemDebugControl – Performs system debug operations.
• SetClipboardData – Manipulates clipboard data.

Why This Matters:

• Process Hollowing: The malware injects its payload into dllhost.exe.
• Native API Usage: Bypasses user-mode hooks (EDR/AV).
• Privilege Escalation: NtAdjustPrivilegesToken enables higher access.

Visual Reference:

Process Hacker view showing dllhost.exe strings with Native APIs (NtCreateThreadEx, NtWriteVirtualMemory, etc.).

5. Lumma Stealer – Clipboard & Keylogger Capabilities

Binary Ninja analysis of the extracted .bin file from dllhost.exe reveals that Lumma Stealer has clipboard hijacking and keylogging capabilities.

Key Functions Observed:

• SetClipboardData – Writes data to the clipboard (hijacking).
• NtUserGetClipboardData – Reads data from the clipboard.
• NtUserGetKeyState – Gets keyboard state (keylogging).
• NtUserGetAsyncKeyState – Gets async key state (keylogging).
• NtUserPostThreadMessage – Posts thread messages (communication).
• NtUserBlockInput – Blocks user input (evasion).
• NtUserSetWindowsHookEx – Sets Windows hooks (keylogging).
• NtUserMoveWindow – Moves windows (UI manipulation).

Why This Matters:

• Clipboard Theft: Steals copied text (passwords, crypto addresses).
• Keylogging: Captures keystrokes (passwords, messages).
• Evasion: NtUserBlockInput can freeze the user's input.
• Persistence: NtUserSetWindowsHookEx can set global hooks.

Visual Reference:

Binary Ninja view showing SetClipboardData, NtUserGetClipboardData, and keylogging functions.

6. dllhost.exe – ALPC, Section & Driver Management

Process Hacker memory analysis of the injected dllhost.exe process reveals that Lumma Stealer uses ALPC, section management, and driver loading for communication and persistence.

Key Native APIs Observed:

• NtAlpcSendWaitReceivePort – ALPC communication (inter-process communication).
• NtConnectPort – Connects to a port (likely C2 or system).
• NtCreateSection – Creates a memory section (for code injection).
• NtOpenSection – Opens an existing memory section.
• NtLoadDriver – Loads a kernel driver (deep system access).
• NtCreateThread – Creates a thread (for payload execution).
• NtCreateEvent – Creates an event object (synchronization).
• NtCreateMutant – Creates a mutex (to avoid duplicate execution).

Why This Matters:

• Inter-Process Communication: ALPC is used for stealthy communication.
• Memory Manipulation: NtCreateSection and NtOpenSection are used for injection.
• Kernel Access: NtLoadDriver provides deep system access.
• Persistence: Mutex prevents multiple instances.

Visual Reference:

Process Hacker view showing dllhost.exe strings with NtAlpcSendWaitReceivePort, NtCreateSection, and NtLoadDriver.

Conclusion

This analysis uncovered Lumma Stealer, a sophisticated info-stealer that uses a multi-stage infection chain involving a dropper (setup.exe) and process injection into dllhost.exe.

Key Takeaways:

• Dropper (setup.exe): Contains privacy-related strings (Privacy Camera, Privacy Microphone), driver installation (PreinstallDriver), and C2 domain candidates (e.g., zhtytomyr.ua, adobeaemcloud.com).
• Process Injection (dllhost.exe): Uses Process Hollowing with Native APIs (NtCreateThreadEx, NtWriteVirtualMemory).
• Advanced Communication: Employs ALPC (NtAlpcSendWaitReceivePort), section management (NtCreateSection), and driver loading (NtLoadDriver).
• Data Theft Capabilities: Includes clipboard hijacking (SetClipboardData) and keylogging ().

Detection Recommendations:

• Block C2 domains: zhtytomyr.ua, adobeaemcloud.com, Vagrancy.virus.cc.
• Monitor for NtCreateThreadEx and NtWriteVirtualMemory calls in dllhost.exe.
• Detect NtAlpcSendWaitReceivePort and NtLoadDriver usage.
• Monitor for clipboard and keylogging API calls (SetClipboardData, NtUserGetKeyState).

Sample Download

The analyzed Lumma Stealer sample is available on MalwareBazaar for those who wish to conduct their own analysis:

🔗 Lumma Stealer Sample on MalwareBazaar

Tools Used: Process Hacker, Binary Ninja, x64dbg