lumma | 4f71eb4bec38a472385e9beb974680c5bdf05371afa9db17d71897b04fe55668

Analysis

max time kernel
73s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2023, 16:18

Target

DOC8329085932098537923054099643.exe
Size

2.3MB
MD5

7e74e4fc4c0cf08a409f147d01a45490
SHA1

3a741dfce27da889492c4df6078c333db933f6b8
SHA256

4f71eb4bec38a472385e9beb974680c5bdf05371afa9db17d71897b04fe55668
SHA512

236673b9078b839eb4f70d4daa70c32b74025f6b2d0a3c653d37a74a7088f0ce27bf1d5d6bc4f25849ada25300db9aa3d56eda5a7afa2e96cb0cce0ef97e3e09
SSDEEP

24576:igTVeVR+XaXkWHI4/wBm6j6/9KPqihiaKcRkkk9j:dwoaUsIVBRj6/9KPqf

Score

10^/10

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 2180	1816	DOC8329085932098537923054099643.exe	80

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1816	DOC8329085932098537923054099643.exe
2180	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2180	1816	DOC8329085932098537923054099643.exe	80
PID 1816 wrote to memory of 2180	1816	DOC8329085932098537923054099643.exe	80
PID 1816 wrote to memory of 2180	1816	DOC8329085932098537923054099643.exe	80
PID 1816 wrote to memory of 2180	1816	DOC8329085932098537923054099643.exe	80
PID 2180 wrote to memory of 1780	2180	cmd.exe	82
PID 2180 wrote to memory of 1780	2180	cmd.exe	82
PID 2180 wrote to memory of 1780	2180	cmd.exe	82
PID 2180 wrote to memory of 1780	2180	cmd.exe	82
PID 2180 wrote to memory of 1780	2180	cmd.exe	82

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\1504fbd1

Filesize
741KB

MD5
b839f467dce15571311f8f798d0652d6

SHA1
518104d6baf52380eb0cf241fc5fe1dcf542dbdb

SHA256
e10b6333b96ef9c09627b1f781de08a46a4e1dac1b21c1d1b83c8b297d5afa86

SHA512
29f2dd6a3882cddf015e098fe32af0ed5f14f7194f97d12eec5c9ad7b1e580cd4e83d17cafff529dcc22995ed9de9e81e74bc7783728244fc2ef488cdcd3e0e4

Download Submit
memory/1780-139-0x00007FFAB8C90000-0x00007FFAB8E85000-memory.dmp

Filesize
2.0MB

Download
memory/1780-140-0x00000000003F0000-0x0000000000447000-memory.dmp

Filesize
348KB

Download
memory/1780-141-0x00000000003F0000-0x0000000000447000-memory.dmp

Filesize
348KB

Download
memory/1780-142-0x00000000003F0000-0x0000000000447000-memory.dmp

Filesize
348KB

Download
memory/1780-143-0x00000000003F0000-0x0000000000447000-memory.dmp

Filesize
348KB

Download
memory/1816-133-0x00007FFA9A7F0000-0x00007FFA9BE67000-memory.dmp

Filesize
22.5MB

Download
memory/1816-134-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/2180-138-0x00007FFAB8C90000-0x00007FFAB8E85000-memory.dmp

Filesize
2.0MB

Download