lumma | 1d0ee4fb10121259812fdcae737e3dd342c7a2543fd15ce50094df90e3ef40f8

General

Target

6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe
Size

1.3MB
MD5

e6b8cfb15c6fce9abcea7a716345d537
SHA1

c56b60c650439c124b403e31aced45c584ecdd7b
SHA256

6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277
SHA512

e0163f07a996590e04340b61c3facbc2b5030936028f2ae6bb648b57fadaf2a74d2e8aea29a6eb1b6ff33058feb878f5003609b4bba018c7312c5762f1c84cc1
SSDEEP

24576:fk+bHOG7WsijczZPUIuAYfc48SCkbNY/:s+buG7B6cmHAYfgsY

Score

10^/10

lumma stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2468 set thread context of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2852	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2468 wrote to memory of 2852	2468	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	28
PID 2852 wrote to memory of 2704	2852	RegSvcs.exe	30
PID 2852 wrote to memory of 2704	2852	RegSvcs.exe	30
PID 2852 wrote to memory of 2704	2852	RegSvcs.exe	30
PID 2852 wrote to memory of 2704	2852	RegSvcs.exe	30

C:\Users\Admin\AppData\Local\Temp\6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe
"C:\Users\Admin\AppData\Local\Temp\6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 744
    3⤵
    - Program crash
    PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-77-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-81-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-56-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/2468-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2468-58-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-59-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-61-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-65-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-63-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-69-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-67-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-73-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-71-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-75-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2468-55-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/2468-97-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/2468-54-0x0000000000F80000-0x00000000010D4000-memory.dmp

Filesize
1.3MB

Download
memory/2468-82-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download
memory/2468-83-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2468-79-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2852-84-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-88-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-89-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-91-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-92-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2852-94-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-96-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-86-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-98-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2852-99-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads