lumma | 64b5712a8c70246666bb8f150afc104a213b5847f762819d0418dbc10d6fa4f2

General

Target

e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe
Size

1.7MB
MD5

b329525d2d62f10d7a8fdb25bb9d9a43
SHA1

43190e85312bd69cda8c094a0085ea188832bbbc
SHA256

e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7
SHA512

053f1ff542bf1ac0bbbfc4f320c62cc5b63092f7ff0b882c0d7d8bf7b3a3609c42b817d2d527f9f8841035d5883eea91676b93fbc60779d68d119ee1e1460ad1
SSDEEP

6144:8GeEeHycW2dJDPEu0asM763jnJioXhbDJOTulPkkKeYBtEloF:

Score

10^/10

lumma stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe

pid	process
912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe
912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe
912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe
912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe
912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe

description pid process

Token: SeDebugPrivilege 912 e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe

description	pid	process
Token: SeDebugPrivilege	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe

description	pid	process	target process
PID 912 wrote to memory of 1884	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 1884	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 1884	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 1884	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 1884	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 1884	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 1884	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 576	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 576	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 576	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 576	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 576	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 576	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 576	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 432	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 432	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 432	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 432	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 432	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 432	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 432	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 564	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 564	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 564	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 564	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 564	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 564	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 564	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 588	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 588	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 588	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 588	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 588	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 588	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 912 wrote to memory of 588	912	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe
"C:\Users\Admin\AppData\Local\Temp\e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:564

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-54-0x00000000000E0000-0x0000000000296000-memory.dmp

Filesize
1.7MB

Download
memory/912-55-0x0000000001F30000-0x0000000001F8A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing