lumma | d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2023 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe
Size

1.5MB
MD5

c0495cb1e372a65254ddaf43736cadff
SHA1

a51ac30d1719516dfe5c93a35600de04ca467b1a
SHA256

d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02
SHA512

0888ac46ca6329e5d7d53c5dfd4a65c98ea58daa48423dddd5c1658dfe7240a2a733dec0f34493a229bc0197134bab132dbebce2d4f9ffe4186d79f7db9163d4
SSDEEP

24576:/spUqF2JAwTDWLGf7ROqn2qepppWuedVrB/TI8beGQKM1:/awPWLGf7MqnEpuTVrdk8bHRM1

Score

10^/10

lumma spyware stealer

Malware Config

Signatures

Detect Lumma Stealer payload V2 1 IoCs

resource	yara_rule
behavioral2/memory/1668-4-0x0000000000400000-0x0000000000481000-memory.dmp	family_lumma_V2

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3592 set thread context of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe
1668	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91
PID 3592 wrote to memory of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91
PID 3592 wrote to memory of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91
PID 3592 wrote to memory of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91
PID 3592 wrote to memory of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91
PID 3592 wrote to memory of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91
PID 3592 wrote to memory of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91
PID 3592 wrote to memory of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91
PID 3592 wrote to memory of 1668	3592	d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe	91

C:\Users\Admin\AppData\Local\Temp\d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe
"C:\Users\Admin\AppData\Local\Temp\d8b6bf6b66f9db15567b43e5b725a2cd5fa74854f4b2e715f58ee6ae44488f02.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-0-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1668-1-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1668-2-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1668-3-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1668-4-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download