lumma | 61706481faf4ee1a6fd735fb9ce735bbba1f42f62989ad3ec536ea22e6ad962c

Analysis

max time kernel
206s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10-02-2023 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe
Size

857KB
MD5

3d52d171523e07600e30ad60d67fcc45
SHA1

a5d89cb745695d0c0d4b8116bdc9a7b892756b95
SHA256

7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc
SHA512

929867e7a5ae311a3b7ed6a2b973fa17f39bdeb14c953f7dc45805898b8bd2056e97f0bc1ea391fdf1a7e1fc131de24356a331769b52c98aa5a1b8ff32fb2bc1
SSDEEP

24576:vuq/ZM4+TNTXYAlCDuIL0JIYAlCDuIL0rS:6TRIAl3u0JAl3u0r

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

77.73.134.68

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe

description	pid	process	target process
PID 2380 set thread context of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe

pid	process
2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe
2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe

description pid process

Token: SeDebugPrivilege 2380 7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe

description	pid	process
Token: SeDebugPrivilege	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe

description	pid	process	target process
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe
PID 2380 wrote to memory of 2832	2380	7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe
"C:\Users\Admin\AppData\Local\Temp\7355b4d748f2e77a4087d687cf3d7827ad14be62ddcedee3ffff3d7271684ecc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:2832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-132-0x0000000000C50000-0x0000000000D2C000-memory.dmp

Filesize
880KB

Download
memory/2380-133-0x0000000005920000-0x00000000059BC000-memory.dmp

Filesize
624KB

Download
memory/2380-134-0x0000000005FA0000-0x0000000006544000-memory.dmp

Filesize
5.6MB

Download
memory/2380-135-0x0000000005A90000-0x0000000005B22000-memory.dmp

Filesize
584KB

Download
memory/2380-136-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

Filesize
40KB

Download
memory/2832-137-0x0000000000000000-mapping.dmp

Download
memory/2832-138-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2832-139-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2832-140-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2832-141-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2832-142-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download