lumma | e343adb1b48b092c8d7b7ba23c3c31d63e2e7b2642b7ee9c4002c4edb5ddb430

Analysis

max time kernel
26s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-03-2023 08:03

Target

Full-Best_version/Full-Best_version.exe
Size

688.3MB
MD5

0e9d06ed4761310d5cdf869618aa1fa6
SHA1

f0ec5a8c1f366b1cc47e3038d55625394be3e007
SHA256

da2fa0bdd83853e87d871d18a8e2daa42caca51de4310db06485f901078590c2
SHA512

47b5e9e764084fe7fb8f72a5e3b46719dc67fa4212afce8bfab7b6fda713c1e425870f405972eceeae10b7df4e931d738682641a018f8361867d750081b2605a
SSDEEP

98304:meXAdbSnlC0VEhisk/h1Qf0fk+6uvkyNNsKV:gSGWlnz

Score

10^/10

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Full-Best_version.exe

description pid process target process

PID 1532 set thread context of 1564 1532 Full-Best_version.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1748 1532 WerFault.exe Full-Best_version.exe

description	pid	process	target process
PID 1532 set thread context of 1564	1532	Full-Best_version.exe	RegSvcs.exe

pid	pid_target	process	target process
1748	1532	WerFault.exe	Full-Best_version.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Full-Best_version.exe

description	pid	process	target process
PID 1532 wrote to memory of 1564	1532	Full-Best_version.exe	RegSvcs.exe
PID 1532 wrote to memory of 1564	1532	Full-Best_version.exe	RegSvcs.exe
PID 1532 wrote to memory of 1564	1532	Full-Best_version.exe	RegSvcs.exe
PID 1532 wrote to memory of 1564	1532	Full-Best_version.exe	RegSvcs.exe
PID 1532 wrote to memory of 1564	1532	Full-Best_version.exe	RegSvcs.exe
PID 1532 wrote to memory of 1564	1532	Full-Best_version.exe	RegSvcs.exe
PID 1532 wrote to memory of 1564	1532	Full-Best_version.exe	RegSvcs.exe
PID 1532 wrote to memory of 1564	1532	Full-Best_version.exe	RegSvcs.exe
PID 1532 wrote to memory of 1564	1532	Full-Best_version.exe	RegSvcs.exe
PID 1532 wrote to memory of 1748	1532	Full-Best_version.exe	WerFault.exe
PID 1532 wrote to memory of 1748	1532	Full-Best_version.exe	WerFault.exe
PID 1532 wrote to memory of 1748	1532	Full-Best_version.exe	WerFault.exe
PID 1532 wrote to memory of 1748	1532	Full-Best_version.exe	WerFault.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 48
2⤵
- Program crash
PID:1748

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/1564-54-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1564-55-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1564-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download