lumma | 513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de

Analysis

max time kernel
150s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
Size

5.0MB
MD5

093a6b458ebfb428efac9ee417e36621
SHA1

4fd0540e92c0fca6147492839ac9d2faf9bbcf1a
SHA256

513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de
SHA512

d807544739947899739eba573e0b3d938a322f4a5d63278e4917187323c794b46965b331be49c32c91c91bdfb4afebf872a02c338c24fdc367037c9aa3b2ab6b
SSDEEP

98304:IsQ19IoMpBeqdtkGjbk8HdG3x25jtqjHqA2VptdmZ8633CTL6P:c19IoMfeqsG/kkkxEyx2pt0AW

Score

10^/10

lumma stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 8 IoCs

resource	yara_rule
behavioral1/memory/1092-8693-0x0000000010000000-0x000000001080D000-memory.dmp	family_lumma_v4
behavioral1/memory/1092-8694-0x0000000010000000-0x000000001080D000-memory.dmp	family_lumma_v4
behavioral1/memory/1092-8695-0x0000000010000000-0x000000001080D000-memory.dmp	family_lumma_v4
behavioral1/memory/1092-8696-0x0000000010000000-0x000000001080D000-memory.dmp	family_lumma_v4
behavioral1/memory/1092-8697-0x0000000010000000-0x000000001080D000-memory.dmp	family_lumma_v4
behavioral1/memory/1092-8701-0x0000000010000000-0x000000001080D000-memory.dmp	family_lumma_v4
behavioral1/memory/1092-8702-0x0000000010000000-0x000000001080D000-memory.dmp	family_lumma_v4
behavioral1/memory/1092-8703-0x0000000010000000-0x000000001080D000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\H:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\O:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\P:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\W:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\Z:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\I:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\L:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\R:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\S:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\Y:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\A:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\J:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\K:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\M:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\N:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\Q:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\B:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\G:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\T:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\U:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\V:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
File opened (read-only)	\??\X:	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
1092	513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe

C:\Users\Admin\AppData\Local\Temp\513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe
"C:\Users\Admin\AppData\Local\Temp\513a7075ffc6246fc87514a530f423693a04e6428d1e2de9d054630e5e1863de.exe"
1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-0-0x0000000010000000-0x000000001080D000-memory.dmp

Filesize
8.1MB

Download
memory/1092-1-0x0000000075B40000-0x0000000075B87000-memory.dmp

Filesize
284KB

Download
memory/1092-811-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-812-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-814-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-816-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-818-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-820-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-822-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-824-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-826-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-828-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-830-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-832-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-834-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-836-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-838-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-840-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-842-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-844-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-846-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-848-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-850-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-852-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-854-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-856-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-858-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-860-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-862-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-864-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-866-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-868-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-870-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-872-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-2547-0x0000000001F90000-0x0000000002111000-memory.dmp

Filesize
1.5MB

Download
memory/1092-8686-0x0000000002120000-0x0000000002231000-memory.dmp

Filesize
1.1MB

Download
memory/1092-8693-0x0000000010000000-0x000000001080D000-memory.dmp

Filesize
8.1MB

Download
memory/1092-8694-0x0000000010000000-0x000000001080D000-memory.dmp

Filesize
8.1MB

Download
memory/1092-8695-0x0000000010000000-0x000000001080D000-memory.dmp

Filesize
8.1MB

Download
memory/1092-8696-0x0000000010000000-0x000000001080D000-memory.dmp

Filesize
8.1MB

Download
memory/1092-8697-0x0000000010000000-0x000000001080D000-memory.dmp

Filesize
8.1MB

Download
memory/1092-8701-0x0000000010000000-0x000000001080D000-memory.dmp

Filesize
8.1MB

Download
memory/1092-8702-0x0000000010000000-0x000000001080D000-memory.dmp

Filesize
8.1MB

Download
memory/1092-8703-0x0000000010000000-0x000000001080D000-memory.dmp

Filesize
8.1MB

Download