lumma | c3a3c1a964e108919e3217614ac4754fa9f4cf37f370019645aaa277547bf372

General

Target

515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe
Size

1.7MB
MD5

1bcd409bc9efcd48dfbc3dbd26e0071c
SHA1

063c673744ab5787e0087b6602332d8f7a07e039
SHA256

515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29
SHA512

257865a38693000563ee898b960ca41623b51136c786f7346de578d8c8647bfddf912fce44dcbfcdb9406e3a8f75ac36f05b3ccfe14d5f2f51f5097e02f1ed96
SSDEEP

24576:9Kk8YxJl1W4vfJnQBYxtbcR556Zcsn4slE83RwXXasZe3+yqkqBLU:0YxYkpQKQRuZccZJBwXXasZs+BkMLU

Score

10^/10

lumma stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/2188-134-0x0000000000160000-0x0000000000318000-memory.dmp	net_reactor

Suspicious use of SetThreadContext 1 IoCs

Processes:

515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe

description	pid	process	target process
PID 2188 set thread context of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5104 1296 WerFault.exe MsBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe

description pid process

Token: SeDebugPrivilege 2188 515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe

pid	pid_target	process	target process
5104	1296	WerFault.exe	MsBuild.exe

description	pid	process
Token: SeDebugPrivilege	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe

description	pid	process	target process
PID 2188 wrote to memory of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe
PID 2188 wrote to memory of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe
PID 2188 wrote to memory of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe
PID 2188 wrote to memory of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe
PID 2188 wrote to memory of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe
PID 2188 wrote to memory of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe
PID 2188 wrote to memory of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe
PID 2188 wrote to memory of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe
PID 2188 wrote to memory of 1296	2188	515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe	MsBuild.exe

C:\Users\Admin\AppData\Local\Temp\515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe
"C:\Users\Admin\AppData\Local\Temp\515006e6eecad0418c6c3980a258dfc6e9f8ff8dacc801298b445c25017beb29.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"
  2⤵
  PID:1296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 1068
    3⤵
    - Program crash
    PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1296 -ip 1296
1⤵
PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1296-165-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1296-171-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1296-170-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1296-168-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1296-167-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2188-149-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-157-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-140-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-141-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-143-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-145-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-147-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-133-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/2188-151-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-153-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-155-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-139-0x0000000004D40000-0x0000000004D50000-memory.dmp

Filesize
64KB

Download
memory/2188-159-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-161-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-163-0x0000000004CF0000-0x0000000004D05000-memory.dmp

Filesize
84KB

Download
memory/2188-164-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/2188-138-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/2188-137-0x0000000004DF0000-0x0000000004E8C000-memory.dmp

Filesize
624KB

Download
memory/2188-136-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/2188-169-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/2188-135-0x0000000004D40000-0x0000000004D50000-memory.dmp

Filesize
64KB

Download
memory/2188-134-0x0000000000160000-0x0000000000318000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads