lumma | 2aee3815033edf7afcad97979a053982be9c03d4c3fb5f5f746366af347699c5

Analysis

max time kernel
73s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
17-02-2023 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddd45726a5e5583927416b931cafa2c3.exe
Size

285KB
MD5

ddd45726a5e5583927416b931cafa2c3
SHA1

e9fe34a62be1576e3c31f92ac561ac62585e80bb
SHA256

2aee3815033edf7afcad97979a053982be9c03d4c3fb5f5f746366af347699c5
SHA512

2d9a04c0a23195f721cbe6780a94b00f52e59cbe2b776bd729082678a833f2c27cfd25351394ff8f936954a6d5d936d9da73ca99cf8e2cc0085b3519566a5000
SSDEEP

3072:kbaWraMEL9pECJ4boo4gpiPABEApj7Ucs7gskqkttnjLXe8JmsmiTYwXwaJHPVoR:qPra5L7JOvoPej7Oeqk7X8L6wyH6b

Score

10^/10

lumma discovery spyware stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4428 4652 WerFault.exe ddd45726a5e5583927416b931cafa2c3.exe

pid	pid_target	process	target process
4428	4652	WerFault.exe	ddd45726a5e5583927416b931cafa2c3.exe

C:\Users\Admin\AppData\Local\Temp\ddd45726a5e5583927416b931cafa2c3.exe
"C:\Users\Admin\AppData\Local\Temp\ddd45726a5e5583927416b931cafa2c3.exe"
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 988
2⤵
- Program crash
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4652 -ip 4652
1⤵
PID:4740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4652-132-0x000000000076E000-0x000000000078C000-memory.dmp

Filesize
120KB

Download
memory/4652-133-0x00000000006B0000-0x00000000006E1000-memory.dmp

Filesize
196KB

Download
memory/4652-134-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/4652-135-0x000000000076E000-0x000000000078C000-memory.dmp

Filesize
120KB

Download
memory/4652-136-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download