General
- Target 66694f7dcb467cd242471f76c58bc236c458761d22bcb4682a07605e0d7bd384
- Size 2.4MB
- Sample240119-amfb3aaeaj
- SHA256 66694f7dcb467cd242471f76c58bc236c458761d22bcb4682a07605e0d7bd384
Score
10/10
Malware Config
Targets
-
- Target 66694f7dcb467cd242471f76c58bc236c458761d22bcb4682a07605e0d7bd384
- Size 2.4MB
- SHA256 66694f7dcb467cd242471f76c58bc236c458761d22bcb4682a07605e0d7bd384
Score10/10Detect Lumma Stealer payload V4
Detected google phishing page
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
Modifies Windows Defender Real-time Protection settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Windows security modification
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1