lumma | fbc69cde665d75e1154235b29eeded396dbdcd492113781fa76a5622251b43a5

Analysis

max time kernel
140s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2023 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbc69cde665d75e1154235b29eeded396dbdcd492113781fa76a5622251b43a5.exe
Size

251KB
MD5

e9ca526b7e18f493f53b389da14ce14c
SHA1

aaa8d2ac17b5ae940fd56422b0325a5cf334469d
SHA256

fbc69cde665d75e1154235b29eeded396dbdcd492113781fa76a5622251b43a5
SHA512

1dfe8e1f38e1b1982eaeb4cb0325584cbbf6e01fe46242e99b879f46e61a23c8cdfb585bfd0d9ff96882caa9df4e096413ef1bc8f9e40ba6b5dbe9e22b1367e6
SSDEEP

6144:kpTOhL5lvtJUYMLRslTkLf9SOnRY9D7ndDHXyUC:kpTwdJtiLRwTkLxyi

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

77.73.134.68

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1248 1976 WerFault.exe fbc69cde665d75e1154235b29eeded396dbdcd492113781fa76a5622251b43a5.exe

pid	pid_target	process	target process
1248	1976	WerFault.exe	fbc69cde665d75e1154235b29eeded396dbdcd492113781fa76a5622251b43a5.exe

C:\Users\Admin\AppData\Local\Temp\fbc69cde665d75e1154235b29eeded396dbdcd492113781fa76a5622251b43a5.exe
"C:\Users\Admin\AppData\Local\Temp\fbc69cde665d75e1154235b29eeded396dbdcd492113781fa76a5622251b43a5.exe"
1⤵
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 1332
2⤵
- Program crash
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1976 -ip 1976
1⤵
PID:3400

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-132-0x000000000065E000-0x0000000000678000-memory.dmp

Filesize
104KB

Download
memory/1976-133-0x00000000005E0000-0x000000000060A000-memory.dmp

Filesize
168KB

Download
memory/1976-134-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1976-135-0x000000000065E000-0x0000000000678000-memory.dmp

Filesize
104KB

Download
memory/1976-136-0x00000000005E0000-0x000000000060A000-memory.dmp

Filesize
168KB

Download
memory/1976-137-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1976-138-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download