lumma | e7bf5558d5445eb2f7e3d0cd4001a54281293f98230b23522f6d444afa4bc9eb

Analysis

max time kernel
93s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Set-up.exe
Size 3.3MB
Sample240228-crpgmsha72
SHA256 e3cb1b8edb969533e9299c4169b12df17a01d7516df943b486a785c986ceda30
MD5 55076afc8f8de2df8f91fb2742bcda61
SHA1 c848bb01e859163b08ce4f58994b3d814dfdf700
SHA512 70bf3d76b86b28aa4209a51469a4b2161c4253313849217b5e1267cb17f6279235b9ed18cd975aa48227401b48887f594b3be149531750638091afc51a425d26
SSDEEP 98304:WNdaWWhvT90MSGmHUkC+UH9txcv0HGM62OQy:WNdaWWhvZ0MhmHUkxUH9tx1HA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://forknegotationaow.shop/api
https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4948 set thread context of 940	4948	Set-up.exe	90

Loads dropped DLL 1 IoCs

pid	Process
740	wkhtmltopdf.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4948	Set-up.exe
4948	Set-up.exe
940	netsh.exe
940	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4948	Set-up.exe
940	netsh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 940	4948	Set-up.exe	90
PID 4948 wrote to memory of 940	4948	Set-up.exe	90
PID 4948 wrote to memory of 940	4948	Set-up.exe	90
PID 4948 wrote to memory of 940	4948	Set-up.exe	90
PID 940 wrote to memory of 740	940	netsh.exe	94
PID 940 wrote to memory of 740	940	netsh.exe	94
PID 940 wrote to memory of 740	940	netsh.exe	94
PID 940 wrote to memory of 740	940	netsh.exe	94

C:\Users\Admin\AppData\Local\Temp\Set-up.exe
"C:\Users\Admin\AppData\Local\Temp\Set-up.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\SysWOW64\netsh.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exe
    C:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exe
    3⤵
    - Loads dropped DLL
    PID:740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

abb5d72f

Path C:\Users\Admin\AppData\Local\Temp\abb5d72f
Size 22.8MB
SHA256 df05d696998abf010b1bb0e7f6e18cd674aa009603fb8f4c6cb73683df4f9e26
MD5 0a762496e15953ae55f7f1aa97553328
SHA1 1d5821cada1937dd990a92573d099c735fe0fc4e
SHA512 743e3cde19e677e2e25d986ba2291c74c420706f756690142f24dae988d40504abd092b7ea9d564e71d63de527d8dd42577af8883ade6f7f018f07ec61d15311
SSDEEP 393216:pzTJimqOQjfZBViAGGfdcI7gBf8vkLFgb2B:BJi/OShBVxVcImLFgiB
MD5 SHA1 SHA512 SSDEEP

Submit Download

wkhtmltopdf.exe

Path C:\Users\Admin\AppData\Local\Temp\wkhtmltopdf.exe
Size 21.8MB
SHA256 fbf6c62e7c680b70ee867ba4c5d32511b2388d1bf32a485468ce3e2ba64e6814
MD5 ae7df0630c783b933e62e5acfddd5fba
SHA1 3353f7e76c241c261f3658070aefd5c3ab702e98
SHA512 839d40aaae261b7d0fae4343a4525c3420ee33cb15f93fdf63fd7af44d0e89d40ab627fc3f15789011fe13c12568a12c7f35cadc9ec3b11652df540e2224a817
SSDEEP 196608:fzHfiR+PhfgFByzvEv0q97suSZKsQoygNJsv6tWKFdu9CM+wNC:fza8PhIFBkEl7zp0Jsv6tWKFdu9CM+eC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/740-46-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Download

memory/740-45-0x0000000000C60000-0x0000000000C61000-memory.dmp

Download

memory/740-44-0x0000000000DD0000-0x00000000023B8000-memory.dmp

Download

memory/740-43-0x0000000000C80000-0x0000000000CC6000-memory.dmp

Download

memory/740-42-0x00007FF98EF90000-0x00007FF98F185000-memory.dmp

Download

memory/940-33-0x00007FF98EF90000-0x00007FF98F185000-memory.dmp

Download

memory/940-39-0x00000000753A0000-0x000000007551B000-memory.dmp

Download

memory/940-21-0x00000000753A0000-0x000000007551B000-memory.dmp

Download

memory/940-36-0x00000000753A0000-0x000000007551B000-memory.dmp

Download

memory/940-35-0x00000000753A0000-0x000000007551B000-memory.dmp

Download

memory/4948-22-0x000000006E010000-0x000000006E02C000-memory.dmp

Download

memory/4948-24-0x000000006C370000-0x000000006C4B3000-memory.dmp

Download

memory/4948-25-0x000000006DC50000-0x000000006DC5D000-memory.dmp

Download

memory/4948-30-0x000000006DAB0000-0x000000006DACE000-memory.dmp

Download

memory/4948-32-0x000000006DBE0000-0x000000006DBED000-memory.dmp

Download

memory/4948-28-0x000000006DC20000-0x000000006DC48000-memory.dmp

Download

memory/4948-31-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download

memory/4948-27-0x000000006DBF0000-0x000000006DBFE000-memory.dmp

Download

memory/4948-26-0x000000006DBD0000-0x000000006DBDE000-memory.dmp

Download

memory/4948-29-0x000000006DBC0000-0x000000006DBCF000-memory.dmp

Download

memory/4948-23-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download

memory/4948-0-0x00000000753A0000-0x000000007551B000-memory.dmp

Download

memory/4948-19-0x0000000000400000-0x0000000000787000-memory.dmp

Download

memory/4948-17-0x00000000753A0000-0x000000007551B000-memory.dmp

Download

memory/4948-16-0x00000000753A0000-0x000000007551B000-memory.dmp

Download

memory/4948-15-0x00000000753A0000-0x000000007551B000-memory.dmp

Download

memory/4948-1-0x00007FF98EF90000-0x00007FF98F185000-memory.dmp

Download