lumma | adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c

General

Target

adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
Size

1.9MB
MD5

ffc87cf5de85e0a6a3941bc91780d928
SHA1

6029ea950091d269d9626343a8defefd1b6c5c1c
SHA256

adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c
SHA512

98a8f5b8073267e1435a7df8bbc2249f226cb82cda16a18a4e8525d8b068f93aeeca577cff3faf2bacda4493028ae4232189ba98c22883ec9face8cd29105556
SSDEEP

49152:XKcEqlms7r6WKt3iS/rmEPM/u0iEV9IHuxJxruCD:66lms3a3iS/rmOMVVqHuvYCD

Score

10^/10

lumma spyware stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe

description	pid	process	target process
PID 3628 set thread context of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe

pid	process
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe

description pid process

Token: SeDebugPrivilege 3628 adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe

description	pid	process
Token: SeDebugPrivilege	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe

description	pid	process	target process
PID 3628 wrote to memory of 4260	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	InstallUtil.exe
PID 3628 wrote to memory of 4260	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	InstallUtil.exe
PID 3628 wrote to memory of 4232	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	csc.exe
PID 3628 wrote to memory of 4232	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	csc.exe
PID 3628 wrote to memory of 4024	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	RegSvcs.exe
PID 3628 wrote to memory of 4024	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	RegSvcs.exe
PID 3628 wrote to memory of 4036	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	AppLaunch.exe
PID 3628 wrote to memory of 4036	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	AppLaunch.exe
PID 3628 wrote to memory of 4556	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ComSvcConfig.exe
PID 3628 wrote to memory of 4556	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ComSvcConfig.exe
PID 3628 wrote to memory of 4624	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ngentask.exe
PID 3628 wrote to memory of 4624	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ngentask.exe
PID 3628 wrote to memory of 3928	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	WsatConfig.exe
PID 3628 wrote to memory of 3928	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	WsatConfig.exe
PID 3628 wrote to memory of 3952	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	cvtres.exe
PID 3628 wrote to memory of 3952	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	cvtres.exe
PID 3628 wrote to memory of 5076	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ilasm.exe
PID 3628 wrote to memory of 5076	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ilasm.exe
PID 3628 wrote to memory of 5092	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	AddInProcess.exe
PID 3628 wrote to memory of 5092	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	AddInProcess.exe
PID 3628 wrote to memory of 2408	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	EdmGen.exe
PID 3628 wrote to memory of 2408	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	EdmGen.exe
PID 3628 wrote to memory of 3924	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	dfsvc.exe
PID 3628 wrote to memory of 3924	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	dfsvc.exe
PID 3628 wrote to memory of 4284	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	vbc.exe
PID 3628 wrote to memory of 4284	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	vbc.exe
PID 3628 wrote to memory of 4068	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ServiceModelReg.exe
PID 3628 wrote to memory of 4068	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ServiceModelReg.exe
PID 3628 wrote to memory of 2028	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	aspnet_wp.exe
PID 3628 wrote to memory of 2028	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	aspnet_wp.exe
PID 3628 wrote to memory of 2068	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	aspnet_regsql.exe
PID 3628 wrote to memory of 2068	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	aspnet_regsql.exe
PID 3628 wrote to memory of 1700	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 1700	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 3112	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	mscorsvw.exe
PID 3628 wrote to memory of 3112	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	mscorsvw.exe
PID 3628 wrote to memory of 2056	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	SMSvcHost.exe
PID 3628 wrote to memory of 2056	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	SMSvcHost.exe
PID 3628 wrote to memory of 4620	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ngen.exe
PID 3628 wrote to memory of 4620	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	ngen.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe
PID 3628 wrote to memory of 4664	3628	adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe
"C:\Users\Admin\AppData\Local\Temp\adfb9a94a162120159f2b496ff473ee14024f24192cc13cf9f829bbae6c4023c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
2⤵
PID:4260

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
2⤵
PID:4232

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
2⤵
PID:4024

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
2⤵
PID:4036

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
2⤵
PID:4556

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
2⤵
PID:4624

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
2⤵
PID:3928

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
2⤵
PID:3952

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
2⤵
PID:5076

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
2⤵
PID:5092

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
2⤵
PID:2408

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
2⤵
PID:3924

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
2⤵
PID:4284

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
2⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
2⤵
PID:2028

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
2⤵
PID:2068

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
2⤵
PID:1700

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
2⤵
PID:3112

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
2⤵
PID:2056

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
2⤵
PID:4620

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
2⤵
PID:4664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3628-120-0x00000139A2400000-0x00000139A25EE000-memory.dmp

Filesize
1.9MB

Download
memory/3628-121-0x00000139A42C0000-0x00000139A42D0000-memory.dmp

Filesize
64KB

Download
memory/3628-122-0x00000139BCC70000-0x00000139BCE0E000-memory.dmp

Filesize
1.6MB

Download
memory/4664-123-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4664-125-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4664-126-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4664-127-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4664-128-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4664-129-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads