lumma | 96eaf33c7af5b34c5c273533d36f256e4ff071f2853d6de5b68856031551d67a

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ad3746fa6d0a05ca727f10562543167.exe
Size

211KB
MD5

0ad3746fa6d0a05ca727f10562543167
SHA1

cd268e5498a014649b0391c91896a482685d3855
SHA256

96eaf33c7af5b34c5c273533d36f256e4ff071f2853d6de5b68856031551d67a
SHA512

bd8198769b0d999c07c9eb37bd7e2047866dd6ec9b69299515d27a1c45c59f73ce1fb32b02808ac3cf990b66b4c2597d74a8609537eeef5d7f7532eb3248b8c7
SSDEEP

3072:Z9vT46HqojWslVqRtHn02RICB6WBU+ea60Z2cqIlg0negQeV1OmTC1fcX:T46rWgqPH02RICB6IUa60ZK6hQECpy

Score

10^/10

lumma stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 9 IoCs

resource	yara_rule
behavioral2/memory/880-14-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral2/memory/4792-19-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral2/memory/5052-28-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral2/memory/1940-38-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral2/memory/4400-47-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral2/memory/1616-56-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral2/memory/3300-65-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral2/memory/4612-75-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4
behavioral2/memory/4960-85-0x0000000000400000-0x00000000004DE000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 9 IoCs

pid	Process
4792	jusched.exe
5052	jusched.exe
1940	jusched.exe
4400	jusched.exe
1616	jusched.exe
3300	jusched.exe
4612	jusched.exe
4960	jusched.exe
336	jusched.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	0ad3746fa6d0a05ca727f10562543167.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe
File opened for modification	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\jusched.exe	0ad3746fa6d0a05ca727f10562543167.exe
File created	C:\Windows\SysWOW64\jusched.exe	jusched.exe
File created	C:\Windows\SysWOW64\.bat	jusched.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
396	880	WerFault.exe	86
3980	4792	WerFault.exe	94
3852	5052	WerFault.exe	103
4328	1940	WerFault.exe	110
3080	4400	WerFault.exe	115
2504	1616	WerFault.exe	120
1368	3300	WerFault.exe	126
3492	4612	WerFault.exe	129
3256	4960	WerFault.exe	132
2892	336	WerFault.exe	135

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4792	880	0ad3746fa6d0a05ca727f10562543167.exe	94
PID 880 wrote to memory of 4792	880	0ad3746fa6d0a05ca727f10562543167.exe	94
PID 880 wrote to memory of 4792	880	0ad3746fa6d0a05ca727f10562543167.exe	94
PID 4792 wrote to memory of 5052	4792	jusched.exe	103
PID 4792 wrote to memory of 5052	4792	jusched.exe	103
PID 4792 wrote to memory of 5052	4792	jusched.exe	103
PID 5052 wrote to memory of 1940	5052	jusched.exe	110
PID 5052 wrote to memory of 1940	5052	jusched.exe	110
PID 5052 wrote to memory of 1940	5052	jusched.exe	110
PID 1940 wrote to memory of 4400	1940	jusched.exe	115
PID 1940 wrote to memory of 4400	1940	jusched.exe	115
PID 1940 wrote to memory of 4400	1940	jusched.exe	115
PID 4400 wrote to memory of 1616	4400	jusched.exe	120
PID 4400 wrote to memory of 1616	4400	jusched.exe	120
PID 4400 wrote to memory of 1616	4400	jusched.exe	120
PID 1616 wrote to memory of 3300	1616	jusched.exe	126
PID 1616 wrote to memory of 3300	1616	jusched.exe	126
PID 1616 wrote to memory of 3300	1616	jusched.exe	126
PID 3300 wrote to memory of 4612	3300	jusched.exe	129
PID 3300 wrote to memory of 4612	3300	jusched.exe	129
PID 3300 wrote to memory of 4612	3300	jusched.exe	129
PID 4612 wrote to memory of 4960	4612	jusched.exe	132
PID 4612 wrote to memory of 4960	4612	jusched.exe	132
PID 4612 wrote to memory of 4960	4612	jusched.exe	132
PID 4960 wrote to memory of 336	4960	jusched.exe	135
PID 4960 wrote to memory of 336	4960	jusched.exe	135
PID 4960 wrote to memory of 336	4960	jusched.exe	135

C:\Users\Admin\AppData\Local\Temp\0ad3746fa6d0a05ca727f10562543167.exe
"C:\Users\Admin\AppData\Local\Temp\0ad3746fa6d0a05ca727f10562543167.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 384
  2⤵
  - Program crash
  PID:396
- C:\Windows\SysWOW64\jusched.exe
  C:\Windows\system32\jusched.exe 1388 "C:\Users\Admin\AppData\Local\Temp\0ad3746fa6d0a05ca727f10562543167.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 388
    3⤵
    - Program crash
    PID:3980
- - C:\Windows\SysWOW64\jusched.exe
    C:\Windows\system32\jusched.exe 1280 "C:\Windows\SysWOW64\jusched.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 356
      4⤵
      Program crash
      PID:3852
  - - C:\Windows\SysWOW64\jusched.exe
      C:\Windows\system32\jusched.exe 1364 "C:\Windows\SysWOW64\jusched.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 364
        5⤵
        Program crash
        
        PID:4328
    - - C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 1376 "C:\Windows\SysWOW64\jusched.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 356
        6⤵
        Program crash
        
        PID:3080
      - C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 1380 "C:\Windows\SysWOW64\jusched.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 356
        7⤵
        Program crash
        
        PID:2504
        
        C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 1396 "C:\Windows\SysWOW64\jusched.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 360
        8⤵
        Program crash
        
        PID:1368
        
        C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 1260 "C:\Windows\SysWOW64\jusched.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 356
        9⤵
        Program crash
        
        PID:3492
        
        C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 1412 "C:\Windows\SysWOW64\jusched.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 356
        10⤵
        Program crash
        
        PID:3256
        
        C:\Windows\SysWOW64\jusched.exe
        
        C:\Windows\system32\jusched.exe 1356 "C:\Windows\SysWOW64\jusched.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 376
        11⤵
        Program crash
        
        PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 880 -ip 880
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4792 -ip 4792
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5052 -ip 5052
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1940 -ip 1940
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4400 -ip 4400
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1616 -ip 1616
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3300 -ip 3300
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4612 -ip 4612
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4960 -ip 4960
1⤵
PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 336 -ip 336
1⤵
PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\jusched.exe

Filesize
211KB

MD5
0ad3746fa6d0a05ca727f10562543167

SHA1
cd268e5498a014649b0391c91896a482685d3855

SHA256
96eaf33c7af5b34c5c273533d36f256e4ff071f2853d6de5b68856031551d67a

SHA512
bd8198769b0d999c07c9eb37bd7e2047866dd6ec9b69299515d27a1c45c59f73ce1fb32b02808ac3cf990b66b4c2597d74a8609537eeef5d7f7532eb3248b8c7

Download Submit
C:\Windows\SysWOW64\jusched.exe

Filesize
159KB

MD5
b1180772eefa06f0d2e9ca4a58cdc6ef

SHA1
a83344c12c75953ab8796290aa301502e1a39ed8

SHA256
b99e79a618c8bdb806af086401629d52eb61faa976875d7a679b3f6ca5efd1f2

SHA512
eed852dc1a3a5ba3e664d78ef37d1ac8613b3207900eaebd08e39c21f2dc2229edb74b629dfe429c9e249b16a019ef94275fbe995c9b6408e39e0026eae79d96

Download Submit
memory/336-93-0x0000000002810000-0x0000000002834000-memory.dmp

Filesize
144KB

Download
memory/336-88-0x0000000000650000-0x0000000000697000-memory.dmp

Filesize
284KB

Download
memory/336-91-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/336-92-0x0000000000700000-0x0000000000704000-memory.dmp

Filesize
16KB

Download
memory/880-15-0x0000000000740000-0x0000000000787000-memory.dmp

Filesize
284KB

Download
memory/880-14-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/880-4-0x0000000002750000-0x0000000002754000-memory.dmp

Filesize
16KB

Download
memory/880-5-0x0000000002BD0000-0x0000000002BF4000-memory.dmp

Filesize
144KB

Download
memory/880-3-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/880-0-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/880-2-0x0000000000740000-0x0000000000787000-memory.dmp

Filesize
284KB

Download
memory/1616-61-0x0000000000630000-0x0000000000677000-memory.dmp

Filesize
284KB

Download
memory/1616-56-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1616-54-0x0000000000700000-0x0000000000704000-memory.dmp

Filesize
16KB

Download
memory/1616-55-0x0000000002860000-0x0000000002884000-memory.dmp

Filesize
144KB

Download
memory/1616-53-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1616-50-0x0000000000630000-0x0000000000677000-memory.dmp

Filesize
284KB

Download
memory/1940-43-0x0000000000730000-0x0000000000777000-memory.dmp

Filesize
284KB

Download
memory/1940-32-0x0000000000730000-0x0000000000777000-memory.dmp

Filesize
284KB

Download
memory/1940-31-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1940-35-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1940-36-0x00000000022A0000-0x00000000022A4000-memory.dmp

Filesize
16KB

Download
memory/1940-37-0x0000000002A60000-0x0000000002A84000-memory.dmp

Filesize
144KB

Download
memory/1940-38-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/3300-62-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/3300-59-0x0000000000600000-0x0000000000647000-memory.dmp

Filesize
284KB

Download
memory/3300-63-0x00000000021A0000-0x00000000021A4000-memory.dmp

Filesize
16KB

Download
memory/3300-64-0x0000000002760000-0x0000000002784000-memory.dmp

Filesize
144KB

Download
memory/3300-65-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/3300-71-0x0000000000600000-0x0000000000647000-memory.dmp

Filesize
284KB

Download
memory/4400-44-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4400-45-0x00000000021A0000-0x00000000021A4000-memory.dmp

Filesize
16KB

Download
memory/4400-46-0x0000000002A30000-0x0000000002A54000-memory.dmp

Filesize
144KB

Download
memory/4400-47-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4400-41-0x0000000000740000-0x0000000000787000-memory.dmp

Filesize
284KB

Download
memory/4400-52-0x0000000000740000-0x0000000000787000-memory.dmp

Filesize
284KB

Download
memory/4612-72-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4612-75-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4612-81-0x0000000000620000-0x0000000000667000-memory.dmp

Filesize
284KB

Download
memory/4612-74-0x0000000002860000-0x0000000002884000-memory.dmp

Filesize
144KB

Download
memory/4612-73-0x0000000002220000-0x0000000002224000-memory.dmp

Filesize
16KB

Download
memory/4612-69-0x0000000000620000-0x0000000000667000-memory.dmp

Filesize
284KB

Download
memory/4612-67-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4792-24-0x0000000000650000-0x0000000000697000-memory.dmp

Filesize
284KB

Download
memory/4792-13-0x0000000000650000-0x0000000000697000-memory.dmp

Filesize
284KB

Download
memory/4792-16-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4792-19-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4792-17-0x00000000006C0000-0x00000000006C4000-memory.dmp

Filesize
16KB

Download
memory/4792-18-0x0000000002200000-0x0000000002224000-memory.dmp

Filesize
144KB

Download
memory/4960-84-0x0000000002860000-0x0000000002884000-memory.dmp

Filesize
144KB

Download
memory/4960-77-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4960-79-0x0000000000600000-0x0000000000647000-memory.dmp

Filesize
284KB

Download
memory/4960-82-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4960-83-0x0000000002220000-0x0000000002224000-memory.dmp

Filesize
16KB

Download
memory/4960-85-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/4960-90-0x0000000000600000-0x0000000000647000-memory.dmp

Filesize
284KB

Download
memory/5052-28-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/5052-34-0x0000000000560000-0x00000000005A7000-memory.dmp

Filesize
284KB

Download
memory/5052-27-0x0000000002A10000-0x0000000002A34000-memory.dmp

Filesize
144KB

Download
memory/5052-26-0x0000000002A00000-0x0000000002A04000-memory.dmp

Filesize
16KB

Download
memory/5052-22-0x0000000000560000-0x00000000005A7000-memory.dmp

Filesize
284KB

Download
memory/5052-25-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download