Malware Analysis Report

2025-08-06 00:52

Sample ID 230430-tcesbsca3w
Target Setup.zip
SHA256 da0eb63691ac93a850ddbc26e9ca7ce0af481d14ca0e1c5668ebc5f299f8e6e3
Tags
lumma spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

da0eb63691ac93a850ddbc26e9ca7ce0af481d14ca0e1c5668ebc5f299f8e6e3

Threat Level: Known bad

The file Setup.zip was found to be: Known bad.

Malicious Activity Summary

lumma spyware stealer

Lumma Stealer

Detect Lumma Stealer payload V2

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-04-30 15:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-04-30 15:54

Reported

2023-04-30 15:58

Platform

win10v2004-20230220-en

Max time kernel

155s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

Signatures

Detect Lumma Stealer payload V2

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3260 set thread context of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 3260 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
AT 77.73.134.68:80 tcp
US 8.8.8.8:53 123.108.74.40.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
AT 77.73.134.68:80 tcp
US 52.152.110.14:443 tcp
US 13.89.178.26:443 tcp
AT 77.73.134.68:80 tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 44.8.109.52.in-addr.arpa udp
US 117.18.237.29:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
NL 173.223.113.164:443 tcp
AT 77.73.134.68:80 tcp
US 52.152.110.14:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
AT 77.73.134.68:80 tcp
US 52.152.110.14:443 tcp
AT 77.73.134.68:80 tcp
US 52.152.110.14:443 tcp
AT 77.73.134.68:80 tcp
US 52.152.110.14:443 tcp
AT 77.73.134.68:80 tcp
US 52.152.110.14:443 tcp

Files

memory/3260-133-0x0000000000C10000-0x0000000001B9A000-memory.dmp

memory/2896-134-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2896-136-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2896-137-0x0000000000400000-0x0000000000432000-memory.dmp

memory/2896-138-0x0000000000400000-0x0000000000432000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-04-30 15:54

Reported

2023-04-30 15:58

Platform

win7-20230220-en

Max time kernel

147s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

Signatures

Detect Lumma Stealer payload V2

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 748 set thread context of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 748 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"

Network

Country Destination Domain Proto
AT 77.73.134.68:80 tcp
AT 77.73.134.68:80 tcp
AT 77.73.134.68:80 tcp
AT 77.73.134.68:80 tcp
AT 77.73.134.68:80 tcp
AT 77.73.134.68:80 tcp
AT 77.73.134.68:80 tcp

Files

memory/748-54-0x0000000000C70000-0x0000000001BFA000-memory.dmp

memory/748-55-0x000000001C0C0000-0x000000001C31E000-memory.dmp

memory/1684-56-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1684-57-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1684-58-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1684-59-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1684-60-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1684-61-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1684-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1684-63-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1684-65-0x0000000000400000-0x0000000000432000-memory.dmp

memory/1684-66-0x0000000000400000-0x0000000000432000-memory.dmp