lumma | 64b5712a8c70246666bb8f150afc104a213b5847f762819d0418dbc10d6fa4f2

Analysis

max time kernel
79s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe
Size

1.7MB
MD5

b329525d2d62f10d7a8fdb25bb9d9a43
SHA1

43190e85312bd69cda8c094a0085ea188832bbbc
SHA256

e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7
SHA512

053f1ff542bf1ac0bbbfc4f320c62cc5b63092f7ff0b882c0d7d8bf7b3a3609c42b817d2d527f9f8841035d5883eea91676b93fbc60779d68d119ee1e1460ad1
SSDEEP

6144:8GeEeHycW2dJDPEu0asM763jnJioXhbDJOTulPkkKeYBtEloF:

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

45.9.74.78

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe

description	pid	process	target process
PID 4680 set thread context of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe

description	pid	process	target process
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe
PID 4680 wrote to memory of 4660	4680	e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe
"C:\Users\Admin\AppData\Local\Temp\e7cf16e7e4fac1aafb98e10b36c5b129df9a372d03bdebcc5cb77f7bb1139be7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:4660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4660-134-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4660-136-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4660-137-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4660-138-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4660-139-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4680-133-0x0000000000250000-0x0000000000406000-memory.dmp

Filesize
1.7MB

Download