lumma | 11eaa4685ef6b2ad1a5a5e0658db510304050f0560337a1a6353355aed768719

General

Target

Stealer/C4A17DBA.exe
Size

755KB
MD5

b0517305850d5be8e02a648bb90a3c6d
SHA1

24e75c0ea6b07fd3c4e03c6661ed911632f3e784
SHA256

5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204
SHA512

17207aec32a872ad024fb2c67e272830454ca69b095c8b43a1db46c842c6e8530b10a3cc9f1c4d596757949d8a2c448bae44d058f614f037cbf93cb036ca26af
SSDEEP

12288:IsjWYqfNTYmessZerchdW7lRA3aDloJZsjudEDT26qh+kB:IsjWYGYnZQchI83mlamGv6a

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

C2

gstatic-node.io

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

C4A17DBA.exe

description pid process target process

PID 2848 set thread context of 1340 2848 C4A17DBA.exe MSBuild.exe

description	pid	process	target process
PID 2848 set thread context of 1340	2848	C4A17DBA.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

MSBuild.exe

pid	process
1340	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe
1340	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

C4A17DBA.exe

description pid process

Token: SeDebugPrivilege 2848 C4A17DBA.exe

description	pid	process
Token: SeDebugPrivilege	2848	C4A17DBA.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

C4A17DBA.exe

description	pid	process	target process
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe
PID 2848 wrote to memory of 1340	2848	C4A17DBA.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Stealer\C4A17DBA.exe
"C:\Users\Admin\AppData\Local\Temp\Stealer\C4A17DBA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
#cmd
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-302-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1340-306-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1340-305-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2848-88-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-122-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-60-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-59-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-62-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-64-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-90-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-68-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-70-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-72-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-74-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-76-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-78-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-80-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-82-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-84-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-86-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-94-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-66-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-58-0x0000000000420000-0x0000000000458000-memory.dmp

Filesize
224KB

Download
memory/2848-54-0x0000000000DF0000-0x0000000000EB2000-memory.dmp

Filesize
776KB

Download
memory/2848-96-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-98-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-100-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-102-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-104-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-106-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-108-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-110-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-112-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-114-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-116-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-118-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-120-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-92-0x0000000000420000-0x0000000000451000-memory.dmp

Filesize
196KB

Download
memory/2848-291-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/2848-303-0x0000000074ED0000-0x00000000755BE000-memory.dmp

Filesize
6.9MB

Download
memory/2848-57-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2848-56-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/2848-55-0x0000000074ED0000-0x00000000755BE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing