Analysis
- max time kernel
5s - max time network
12s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/04/2024, 10:32
General
- Target f54e415240b21e386b79cd1118866b91.exe
- Size 299KB
- Sample240404-mkyf3sdb35
- SHA256 96cf5fb8cf4d86ee52881f2e6bbba868b94babe0049e6b828158264720ee3c1f
Malware Config
Extracted
-
lumma
-
https://appliedgrandyjuiw.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54e415240b21e386b79cd1118866b91.exe"C:\Users\Admin\AppData\Local\Temp\f54e415240b21e386b79cd1118866b91.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2412 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:31⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SCT Auditing Pending Reports
memory/1524-19-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-3-0x0000000000400000-0x0000000002B74000-memory.dmp
memory/1524-4-0x0000000004910000-0x0000000004911000-memory.dmp
memory/1524-5-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-6-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-8-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-7-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-9-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-10-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-12-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-13-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-11-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-14-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-15-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-17-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-16-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-1-0x0000000002DE0000-0x0000000002EE0000-memory.dmp
memory/1524-18-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-36-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-21-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-22-0x0000000000400000-0x0000000002B74000-memory.dmp
memory/1524-2-0x00000000048C0000-0x0000000004906000-memory.dmp
memory/1524-29-0x0000000002DE0000-0x0000000002EE0000-memory.dmp
memory/1524-30-0x00000000048C0000-0x0000000004906000-memory.dmp
memory/1524-31-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-32-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-34-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-33-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-20-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-35-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-37-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-38-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-39-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-40-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-41-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/1524-42-0x0000000004A70000-0x0000000004A71000-memory.dmp