lumma | 96eaf33c7af5b34c5c273533d36f256e4ff071f2853d6de5b68856031551d67a

Analysis

max time kernel
147s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ad3746fa6d0a05ca727f10562543167.exe
Size

211KB
MD5

0ad3746fa6d0a05ca727f10562543167
SHA1

cd268e5498a014649b0391c91896a482685d3855
SHA256

96eaf33c7af5b34c5c273533d36f256e4ff071f2853d6de5b68856031551d67a
SHA512

bd8198769b0d999c07c9eb37bd7e2047866dd6ec9b69299515d27a1c45c59f73ce1fb32b02808ac3cf990b66b4c2597d74a8609537eeef5d7f7532eb3248b8c7
SSDEEP

3072:Z9vT46HqojWslVqRtHn02RICB6WBU+ea60Z2cqIlg0negQeV1OmTC1fcX:T46rWgqPH02RICB6IUa60ZK6hQECpy

Score

10^/10

lumma stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 13 IoCs

resource	yara_rule
behavioral1/memory/2028-19-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral1/memory/2748-26-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral1/memory/2228-38-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral1/memory/2228-44-0x0000000002CF0000-0x0000000002DCE000-memory.dmp	family_lumma_v4
behavioral1/memory/240-52-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral1/memory/2724-65-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral1/memory/1900-79-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral1/memory/1900-83-0x0000000003110000-0x00000000031EE000-memory.dmp	family_lumma_v4
behavioral1/memory/1100-92-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral1/memory/1100-95-0x0000000003150000-0x000000000322E000-memory.dmp	family_lumma_v4
behavioral1/memory/2436-106-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral1/memory/1568-121-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral1/memory/1568-125-0x0000000003090000-0x000000000316E000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 9 IoCs

pid	Process
2748	jusched.exe
2228	jusched.exe
240	jusched.exe
2724	jusched.exe
1900	jusched.exe
1100	jusched.exe
2436	jusched.exe
1568	jusched.exe
1676	jusched.exe

Loads dropped DLL 18 IoCs

pid	Process
2028	0ad3746fa6d0a05ca727f10562543167.exe
2028	0ad3746fa6d0a05ca727f10562543167.exe
2748	jusched.exe
2748	jusched.exe
2228	jusched.exe
2228	jusched.exe
240	jusched.exe
240	jusched.exe
2724	jusched.exe
2724	jusched.exe
1900	jusched.exe
1900	jusched.exe
1100	jusched.exe
1100	jusched.exe
2436	jusched.exe
2436	jusched.exe
1568	jusched.exe
1568	jusched.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	0ad3746fa6d0a05ca727f10562543167.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	0ad3746fa6d0a05ca727f10562543167.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2748	2028	0ad3746fa6d0a05ca727f10562543167.exe	28
PID 2028 wrote to memory of 2748	2028	0ad3746fa6d0a05ca727f10562543167.exe	28
PID 2028 wrote to memory of 2748	2028	0ad3746fa6d0a05ca727f10562543167.exe	28
PID 2028 wrote to memory of 2748	2028	0ad3746fa6d0a05ca727f10562543167.exe	28
PID 2748 wrote to memory of 2228	2748	jusched.exe	29
PID 2748 wrote to memory of 2228	2748	jusched.exe	29
PID 2748 wrote to memory of 2228	2748	jusched.exe	29
PID 2748 wrote to memory of 2228	2748	jusched.exe	29
PID 2228 wrote to memory of 240	2228	jusched.exe	32
PID 2228 wrote to memory of 240	2228	jusched.exe	32
PID 2228 wrote to memory of 240	2228	jusched.exe	32
PID 2228 wrote to memory of 240	2228	jusched.exe	32
PID 240 wrote to memory of 2724	240	jusched.exe	33
PID 240 wrote to memory of 2724	240	jusched.exe	33
PID 240 wrote to memory of 2724	240	jusched.exe	33
PID 240 wrote to memory of 2724	240	jusched.exe	33
PID 2724 wrote to memory of 1900	2724	jusched.exe	34
PID 2724 wrote to memory of 1900	2724	jusched.exe	34
PID 2724 wrote to memory of 1900	2724	jusched.exe	34
PID 2724 wrote to memory of 1900	2724	jusched.exe	34
PID 1900 wrote to memory of 1100	1900	jusched.exe	35
PID 1900 wrote to memory of 1100	1900	jusched.exe	35
PID 1900 wrote to memory of 1100	1900	jusched.exe	35
PID 1900 wrote to memory of 1100	1900	jusched.exe	35
PID 1100 wrote to memory of 2436	1100	jusched.exe	36
PID 1100 wrote to memory of 2436	1100	jusched.exe	36
PID 1100 wrote to memory of 2436	1100	jusched.exe	36
PID 1100 wrote to memory of 2436	1100	jusched.exe	36
PID 2436 wrote to memory of 1568	2436	jusched.exe	37
PID 2436 wrote to memory of 1568	2436	jusched.exe	37
PID 2436 wrote to memory of 1568	2436	jusched.exe	37
PID 2436 wrote to memory of 1568	2436	jusched.exe	37
PID 1568 wrote to memory of 1676	1568	jusched.exe	38
PID 1568 wrote to memory of 1676	1568	jusched.exe	38
PID 1568 wrote to memory of 1676	1568	jusched.exe	38
PID 1568 wrote to memory of 1676	1568	jusched.exe	38

C:\Users\Admin\AppData\Local\Temp\0ad3746fa6d0a05ca727f10562543167.exe
"C:\Users\Admin\AppData\Local\Temp\0ad3746fa6d0a05ca727f10562543167.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\jusched.exe
  C:\Windows\system32\jusched.exe 628 "C:\Users\Admin\AppData\Local\Temp\0ad3746fa6d0a05ca727f10562543167.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\jusched.exe
    C:\Windows\system32\jusched.exe 620 "C:\Windows\SysWOW64\jusched.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\SysWOW64\jusched.exe
      C:\Windows\system32\jusched.exe 624 "C:\Windows\SysWOW64\jusched.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:240
    - - C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 636 "C:\Windows\SysWOW64\jusched.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2724
      - C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 632 "C:\Windows\SysWOW64\jusched.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 644 "C:\Windows\SysWOW64\jusched.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 640 "C:\Windows\SysWOW64\jusched.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 648 "C:\Windows\SysWOW64\jusched.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 652 "C:\Windows\SysWOW64\jusched.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\jusched.exe

Filesize
211KB

MD5
0ad3746fa6d0a05ca727f10562543167

SHA1
cd268e5498a014649b0391c91896a482685d3855

SHA256
96eaf33c7af5b34c5c273533d36f256e4ff071f2853d6de5b68856031551d67a

SHA512
bd8198769b0d999c07c9eb37bd7e2047866dd6ec9b69299515d27a1c45c59f73ce1fb32b02808ac3cf990b66b4c2597d74a8609537eeef5d7f7532eb3248b8c7

Download Submit
memory/240-51-0x00000000002E0000-0x0000000000304000-memory.dmp

Filesize
144KB

Download
memory/240-52-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/240-61-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/240-45-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/240-47-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/240-50-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/240-56-0x00000000030F0000-0x00000000031CE000-memory.dmp

Filesize
888KB

Download
memory/1100-88-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/1100-99-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/1100-91-0x00000000002E0000-0x0000000000304000-memory.dmp

Filesize
144KB

Download
memory/1100-92-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1100-95-0x0000000003150000-0x000000000322E000-memory.dmp

Filesize
888KB

Download
memory/1100-86-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1100-90-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1568-116-0x0000000000550000-0x0000000000597000-memory.dmp

Filesize
284KB

Download
memory/1568-118-0x00000000001D0000-0x00000000001D4000-memory.dmp

Filesize
16KB

Download
memory/1568-119-0x00000000003B0000-0x00000000003D4000-memory.dmp

Filesize
144KB

Download
memory/1568-128-0x0000000000550000-0x0000000000597000-memory.dmp

Filesize
284KB

Download
memory/1568-117-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1568-125-0x0000000003090000-0x000000000316E000-memory.dmp

Filesize
888KB

Download
memory/1568-113-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1568-121-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1676-130-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1676-131-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/1676-133-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1676-134-0x00000000002E0000-0x0000000000304000-memory.dmp

Filesize
144KB

Download
memory/1900-77-0x0000000000360000-0x0000000000364000-memory.dmp

Filesize
16KB

Download
memory/1900-78-0x00000000003A0000-0x00000000003C4000-memory.dmp

Filesize
144KB

Download
memory/1900-83-0x0000000003110000-0x00000000031EE000-memory.dmp

Filesize
888KB

Download
memory/1900-74-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/1900-72-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1900-79-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1900-85-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/2028-21-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/2028-2-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/2028-4-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/2028-3-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2028-5-0x00000000002F0000-0x0000000000314000-memory.dmp

Filesize
144KB

Download
memory/2028-10-0x0000000002FB0000-0x000000000308E000-memory.dmp

Filesize
888KB

Download
memory/2028-19-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2028-1-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2228-35-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2228-44-0x0000000002CF0000-0x0000000002DCE000-memory.dmp

Filesize
888KB

Download
memory/2228-33-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/2228-37-0x0000000000310000-0x0000000000334000-memory.dmp

Filesize
144KB

Download
memory/2228-36-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2228-42-0x0000000002CF0000-0x0000000002DCE000-memory.dmp

Filesize
888KB

Download
memory/2228-38-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2228-48-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/2436-106-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2436-104-0x00000000003C0000-0x00000000003E4000-memory.dmp

Filesize
144KB

Download
memory/2436-103-0x00000000002A0000-0x00000000002A4000-memory.dmp

Filesize
16KB

Download
memory/2436-110-0x0000000003140000-0x000000000321E000-memory.dmp

Filesize
888KB

Download
memory/2436-98-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2436-114-0x00000000002F0000-0x0000000000337000-memory.dmp

Filesize
284KB

Download
memory/2436-101-0x00000000002F0000-0x0000000000337000-memory.dmp

Filesize
284KB

Download
memory/2436-102-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2724-58-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2724-75-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/2724-59-0x0000000000270000-0x00000000002B7000-memory.dmp

Filesize
284KB

Download
memory/2724-62-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2724-63-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2724-64-0x00000000002E0000-0x0000000000304000-memory.dmp

Filesize
144KB

Download
memory/2724-65-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2724-69-0x00000000031C0000-0x000000000329E000-memory.dmp

Filesize
888KB

Download
memory/2724-71-0x00000000031C0000-0x000000000329E000-memory.dmp

Filesize
888KB

Download
memory/2748-32-0x0000000000330000-0x0000000000377000-memory.dmp

Filesize
284KB

Download
memory/2748-31-0x0000000002FF0000-0x00000000030CE000-memory.dmp

Filesize
888KB

Download
memory/2748-26-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2748-25-0x00000000004E0000-0x0000000000504000-memory.dmp

Filesize
144KB

Download
memory/2748-23-0x0000000000240000-0x0000000000244000-memory.dmp

Filesize
16KB

Download
memory/2748-22-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2748-20-0x0000000000330000-0x0000000000377000-memory.dmp

Filesize
284KB

Download
memory/2748-17-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download