lumma | 9be996d05ae8fe2a551bb367571a8c013cf79cef6b08b0ddba00d513b4d6c55e

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe
Size

755KB
MD5

b0517305850d5be8e02a648bb90a3c6d
SHA1

24e75c0ea6b07fd3c4e03c6661ed911632f3e784
SHA256

5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204
SHA512

17207aec32a872ad024fb2c67e272830454ca69b095c8b43a1db46c842c6e8530b10a3cc9f1c4d596757949d8a2c448bae44d058f614f037cbf93cb036ca26af
SSDEEP

12288:IsjWYqfNTYmessZerchdW7lRA3aDloJZsjudEDT26qh+kB:IsjWYGYnZQchI83mlamGv6a

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

gstatic-node.io

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe

description	pid	process	target process
PID 3740 set thread context of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

MSBuild.exe

pid	process
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe
3844	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe

description pid process

Token: SeDebugPrivilege 3740 5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe

description	pid	process
Token: SeDebugPrivilege	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe

description	pid	process	target process
PID 3740 wrote to memory of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe
PID 3740 wrote to memory of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe
PID 3740 wrote to memory of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe
PID 3740 wrote to memory of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe
PID 3740 wrote to memory of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe
PID 3740 wrote to memory of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe
PID 3740 wrote to memory of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe
PID 3740 wrote to memory of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe
PID 3740 wrote to memory of 3844	3740	5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe
"C:\Users\Admin\AppData\Local\Temp\5c180cd34694c91bc7f4ecaf67d4f462f10254d190d181e02a2a2a7e03d44204.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  #cmd
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3740-168-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-142-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-172-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-136-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/3740-137-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-138-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-140-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-170-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-144-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-146-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-148-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-150-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-134-0x00000000750F0000-0x00000000758A0000-memory.dmp

Filesize
7.7MB

Download
memory/3740-154-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-156-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-158-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-160-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-162-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-164-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-166-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-152-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-133-0x0000000000620000-0x00000000006E2000-memory.dmp

Filesize
776KB

Download
memory/3740-135-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/3740-174-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-176-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-178-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-180-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-182-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-184-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-186-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-188-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-190-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-192-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-194-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-196-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-198-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-200-0x0000000005020000-0x0000000005051000-memory.dmp

Filesize
196KB

Download
memory/3740-369-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/3740-375-0x00000000750F0000-0x00000000758A0000-memory.dmp

Filesize
7.7MB

Download
memory/3844-374-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3844-376-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3844-377-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download