lumma | 114682c8e5db2c28ff8d8caf1e99ed0781b0555f30a5bd34ba11c50472a9adda

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2023 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

114682c8e5db2c28ff8d8caf1e99ed0781b0555f30a5bd34ba11c50472a9adda.exe
Size

224KB
MD5

9f12ba134af9e047bc4aeec1b72d0ca1
SHA1

18aa6574ec21d39fdf8f66a32a848a72150c6fb7
SHA256

114682c8e5db2c28ff8d8caf1e99ed0781b0555f30a5bd34ba11c50472a9adda
SHA512

75e8caf6594833f9b9fd225ae9a3551dc5ae01cff95746095f9997ce2f8bdf27c52e41623d4a0dc7a74d3a2d4df505e592f3890bb2bc0ad00a1e65f96e414685
SSDEEP

3072:r/X3YyQBnQwHOxs51/0QDHtEbbZKBIMmSIM/J5zQigj1NGP5:TgOrQD0sBXmdMLzQigj/G

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

77.73.134.68

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1892 1776 WerFault.exe 114682c8e5db2c28ff8d8caf1e99ed0781b0555f30a5bd34ba11c50472a9adda.exe

pid	pid_target	process	target process
1892	1776	WerFault.exe	114682c8e5db2c28ff8d8caf1e99ed0781b0555f30a5bd34ba11c50472a9adda.exe

C:\Users\Admin\AppData\Local\Temp\114682c8e5db2c28ff8d8caf1e99ed0781b0555f30a5bd34ba11c50472a9adda.exe
"C:\Users\Admin\AppData\Local\Temp\114682c8e5db2c28ff8d8caf1e99ed0781b0555f30a5bd34ba11c50472a9adda.exe"
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 1360
2⤵
- Program crash
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1776 -ip 1776
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-132-0x0000000002C18000-0x0000000002C32000-memory.dmp

Filesize
104KB

Download
memory/1776-133-0x00000000048D0000-0x00000000048FA000-memory.dmp

Filesize
168KB

Download
memory/1776-134-0x0000000000400000-0x0000000002B9F000-memory.dmp

Filesize
39.6MB

Download
memory/1776-135-0x0000000002C18000-0x0000000002C32000-memory.dmp

Filesize
104KB

Download
memory/1776-136-0x0000000000400000-0x0000000002B9F000-memory.dmp

Filesize
39.6MB

Download