lumma | 538c15e2ef697a6df0e325be5536e0e7c88f1faf9cbd583cd054f43282a1ba85

General

Target

file.exe
Size

2.4MB
MD5

2f1c7433a00d30601e7c917054410f18
SHA1

77b00246cb930221bed6240a8ee54108831b3817
SHA256

538c15e2ef697a6df0e325be5536e0e7c88f1faf9cbd583cd054f43282a1ba85
SHA512

ad0c508a0f858ff5c263bd1077bebaf1cb77b2e8edc89bed00e6c49ef0f8f08d7a37fdd05c16a7896270b00a298b2b75e5cedd533ecf42afe19ea86f73ac403a
SSDEEP

49152:GCWafkAugEDgzEApyWBO1qymUVUtPcmcwd:LV5EDK/kqyZVUtPcb4

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

C2

gstatic-node.io

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 1568 set thread context of 1708 1568 file.exe MsBuild.exe

description	pid	process	target process
PID 1568 set thread context of 1708	1568	file.exe	MsBuild.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

MsBuild.exe

pid	process
1708	MsBuild.exe
1708	MsBuild.exe
1708	MsBuild.exe
1708	MsBuild.exe
1708	MsBuild.exe
1708	MsBuild.exe
1708	MsBuild.exe
1708	MsBuild.exe
1708	MsBuild.exe
1708	MsBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 1568 file.exe

description	pid	process
Token: SeDebugPrivilege	1568	file.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

file.exe

description	pid	process	target process
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe
PID 1568 wrote to memory of 1708	1568	file.exe	MsBuild.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-75-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-61-0x0000000000300000-0x000000000031C000-memory.dmp

Filesize
112KB

Download
memory/1568-56-0x0000000004F90000-0x0000000004FD0000-memory.dmp

Filesize
256KB

Download
memory/1568-54-0x0000000000360000-0x00000000005C0000-memory.dmp

Filesize
2.4MB

Download
memory/1568-58-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/1568-59-0x0000000004F90000-0x0000000004FD0000-memory.dmp

Filesize
256KB

Download
memory/1568-60-0x0000000004E30000-0x0000000004F78000-memory.dmp

Filesize
1.3MB

Download
memory/1568-81-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-62-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-63-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-65-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-69-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-67-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-79-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-71-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-77-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-57-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1568-55-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/1568-73-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-85-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-83-0x0000000000300000-0x0000000000315000-memory.dmp

Filesize
84KB

Download
memory/1568-86-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1568-101-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/1708-89-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1708-91-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1708-93-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1708-97-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1708-95-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1708-98-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1708-87-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1708-100-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1708-102-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1708-104-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download

Analysis

Sharing