lumma | 5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16-07-2023 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C4A17DBA.exe
Size

755KB
MD5

b0517305850d5be8e02a648bb90a3c6d
SHA1

24e75c0ea6b07fd3c4e03c6661ed911632f3e784
SHA256

5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204
SHA512

17207aec32a872ad024fb2c67e272830454ca69b095c8b43a1db46c842c6e8530b10a3cc9f1c4d596757949d8a2c448bae44d058f614f037cbf93cb036ca26af
SSDEEP

12288:IsjWYqfNTYmessZerchdW7lRA3aDloJZsjudEDT26qh+kB:IsjWYGYnZQchI83mlamGv6a

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

gstatic-node.io

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

C4A17DBA.exe

description pid process target process

PID 1692 set thread context of 524 1692 C4A17DBA.exe MSBuild.exe

description	pid	process	target process
PID 1692 set thread context of 524	1692	C4A17DBA.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

MSBuild.exe

pid	process
524	MSBuild.exe
524	MSBuild.exe
524	MSBuild.exe
524	MSBuild.exe
524	MSBuild.exe
524	MSBuild.exe
524	MSBuild.exe
524	MSBuild.exe
524	MSBuild.exe
524	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

C4A17DBA.exe

description pid process

Token: SeDebugPrivilege 1692 C4A17DBA.exe

description	pid	process
Token: SeDebugPrivilege	1692	C4A17DBA.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

C4A17DBA.exe

description	pid	process	target process
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe
PID 1692 wrote to memory of 524	1692	C4A17DBA.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\C4A17DBA.exe
"C:\Users\Admin\AppData\Local\Temp\C4A17DBA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-300-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/524-304-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/524-303-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1692-87-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-121-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-58-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-59-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-61-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-65-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-89-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-67-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-69-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-71-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-73-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-75-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-77-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-79-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-81-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-83-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-85-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-93-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-63-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-57-0x00000000007F0000-0x0000000000828000-memory.dmp

Filesize
224KB

Download
memory/1692-53-0x0000000000860000-0x0000000000922000-memory.dmp

Filesize
776KB

Download
memory/1692-95-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-97-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-99-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-101-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-103-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-105-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-107-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-109-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-111-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-113-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-115-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-117-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-119-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-91-0x00000000007F0000-0x0000000000821000-memory.dmp

Filesize
196KB

Download
memory/1692-290-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1692-301-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/1692-56-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1692-55-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/1692-54-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download