lumma | e343adb1b48b092c8d7b7ba23c3c31d63e2e7b2642b7ee9c4002c4edb5ddb430

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30-03-2023 08:03

Target

Full-Best_version/Full-Best_version.exe
Size

688.3MB
MD5

0e9d06ed4761310d5cdf869618aa1fa6
SHA1

f0ec5a8c1f366b1cc47e3038d55625394be3e007
SHA256

da2fa0bdd83853e87d871d18a8e2daa42caca51de4310db06485f901078590c2
SHA512

47b5e9e764084fe7fb8f72a5e3b46719dc67fa4212afce8bfab7b6fda713c1e425870f405972eceeae10b7df4e931d738682641a018f8361867d750081b2605a
SSDEEP

98304:meXAdbSnlC0VEhisk/h1Qf0fk+6uvkyNNsKV:gSGWlnz

Score

10^/10

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Full-Best_version.exe

description pid process target process

PID 2800 set thread context of 964 2800 Full-Best_version.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4572 2800 WerFault.exe Full-Best_version.exe

description	pid	process	target process
PID 2800 set thread context of 964	2800	Full-Best_version.exe	RegSvcs.exe

pid	pid_target	process	target process
4572	2800	WerFault.exe	Full-Best_version.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Full-Best_version.exe

description	pid	process	target process
PID 2800 wrote to memory of 964	2800	Full-Best_version.exe	RegSvcs.exe
PID 2800 wrote to memory of 964	2800	Full-Best_version.exe	RegSvcs.exe
PID 2800 wrote to memory of 964	2800	Full-Best_version.exe	RegSvcs.exe
PID 2800 wrote to memory of 964	2800	Full-Best_version.exe	RegSvcs.exe
PID 2800 wrote to memory of 964	2800	Full-Best_version.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 240
2⤵
- Program crash
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2800 -ip 2800
1⤵
PID:224

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/964-133-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download