lumma | 1d0ee4fb10121259812fdcae737e3dd342c7a2543fd15ce50094df90e3ef40f8

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe
Size

1.3MB
MD5

e6b8cfb15c6fce9abcea7a716345d537
SHA1

c56b60c650439c124b403e31aced45c584ecdd7b
SHA256

6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277
SHA512

e0163f07a996590e04340b61c3facbc2b5030936028f2ae6bb648b57fadaf2a74d2e8aea29a6eb1b6ff33058feb878f5003609b4bba018c7312c5762f1c84cc1
SSDEEP

24576:fk+bHOG7WsijczZPUIuAYfc48SCkbNY/:s+buG7B6cmHAYfgsY

Score

10^/10

lumma stealer

Malware Config

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3124	4856	WerFault.exe	90

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90
PID 1588 wrote to memory of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90
PID 1588 wrote to memory of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90
PID 1588 wrote to memory of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90
PID 1588 wrote to memory of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90
PID 1588 wrote to memory of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90
PID 1588 wrote to memory of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90
PID 1588 wrote to memory of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90
PID 1588 wrote to memory of 4856	1588	6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe	90

C:\Users\Admin\AppData\Local\Temp\6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe
"C:\Users\Admin\AppData\Local\Temp\6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 1280
    3⤵
    - Program crash
    PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4856 -ip 4856
1⤵
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-152-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-146-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-135-0x00000000058E0000-0x000000000597C000-memory.dmp

Filesize
624KB

Download
memory/1588-136-0x0000000075220000-0x00000000759D0000-memory.dmp

Filesize
7.7MB

Download
memory/1588-137-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-138-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-140-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-142-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-144-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-154-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-148-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-150-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-134-0x0000000000E10000-0x0000000000F64000-memory.dmp

Filesize
1.3MB

Download
memory/1588-156-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-133-0x0000000075220000-0x00000000759D0000-memory.dmp

Filesize
7.7MB

Download
memory/1588-158-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-160-0x0000000005850000-0x0000000005865000-memory.dmp

Filesize
84KB

Download
memory/1588-161-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/1588-162-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1588-168-0x0000000075220000-0x00000000759D0000-memory.dmp

Filesize
7.7MB

Download
memory/4856-165-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4856-164-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4856-166-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4856-163-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4856-169-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads