lumma | adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c

General

Target

file.exe
Size

1.9MB
MD5

ffc87cf5de85e0a6a3941bc91780d928
SHA1

6029ea950091d269d9626343a8defefd1b6c5c1c
SHA256

adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c
SHA512

98a8f5b8073267e1435a7df8bbc2249f226cb82cda16a18a4e8525d8b068f93aeeca577cff3faf2bacda4493028ae4232189ba98c22883ec9face8cd29105556
SSDEEP

49152:XKcEqlms7r6WKt3iS/rmEPM/u0iEV9IHuxJxruCD:66lms3a3iS/rmOMVVqHuvYCD

Score

10^/10

lumma spyware stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 412 set thread context of 3864 412 file.exe jsc.exe

description	pid	process	target process
PID 412 set thread context of 3864	412	file.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

file.exe

pid	process
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe
412	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 412 file.exe

description	pid	process
Token: SeDebugPrivilege	412	file.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

file.exe

description	pid	process	target process
PID 412 wrote to memory of 1952	412	file.exe	mscorsvw.exe
PID 412 wrote to memory of 1952	412	file.exe	mscorsvw.exe
PID 412 wrote to memory of 2940	412	file.exe	Microsoft.Workflow.Compiler.exe
PID 412 wrote to memory of 2940	412	file.exe	Microsoft.Workflow.Compiler.exe
PID 412 wrote to memory of 3084	412	file.exe	ComSvcConfig.exe
PID 412 wrote to memory of 3084	412	file.exe	ComSvcConfig.exe
PID 412 wrote to memory of 3764	412	file.exe	AddInProcess32.exe
PID 412 wrote to memory of 3764	412	file.exe	AddInProcess32.exe
PID 412 wrote to memory of 3764	412	file.exe	AddInProcess32.exe
PID 412 wrote to memory of 3896	412	file.exe	ServiceModelReg.exe
PID 412 wrote to memory of 3896	412	file.exe	ServiceModelReg.exe
PID 412 wrote to memory of 3672	412	file.exe	ngentask.exe
PID 412 wrote to memory of 3672	412	file.exe	ngentask.exe
PID 412 wrote to memory of 4052	412	file.exe	RegSvcs.exe
PID 412 wrote to memory of 4052	412	file.exe	RegSvcs.exe
PID 412 wrote to memory of 4820	412	file.exe	aspnet_regbrowsers.exe
PID 412 wrote to memory of 4820	412	file.exe	aspnet_regbrowsers.exe
PID 412 wrote to memory of 1336	412	file.exe	aspnet_state.exe
PID 412 wrote to memory of 1336	412	file.exe	aspnet_state.exe
PID 412 wrote to memory of 1224	412	file.exe	cvtres.exe
PID 412 wrote to memory of 1224	412	file.exe	cvtres.exe
PID 412 wrote to memory of 4980	412	file.exe	RegAsm.exe
PID 412 wrote to memory of 4980	412	file.exe	RegAsm.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe
PID 412 wrote to memory of 3864	412	file.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
2⤵
PID:1952

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
2⤵
PID:2940

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
2⤵
PID:3084

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
2⤵
PID:3764

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
2⤵
PID:3896

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
2⤵
PID:3672

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
2⤵
PID:4052

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
2⤵
PID:4820

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
2⤵
PID:1336

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
2⤵
PID:1224

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
2⤵
PID:4980

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:3864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-133-0x0000022E3BB10000-0x0000022E3BCFE000-memory.dmp

Filesize
1.9MB

Download
memory/412-134-0x0000022E573F0000-0x0000022E57400000-memory.dmp

Filesize
64KB

Download
memory/3864-135-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/3864-137-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/3864-138-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/3864-139-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/3864-140-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/3864-141-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing