Overview

overview

10

Static

static

3

353ed3726f...c8.exe

windows7-x64

1

353ed3726f...c8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-04-2024 01:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    353ed3726f653a8e19c5c1511088ae21f3673d992a1781c100dec7e8418a7fc8.exe

  • Size

    5.9MB

  • MD5

    817c11005ca185252e666c25769a2591

  • SHA1

    e52ec29d0e10c63b378b919fa1f5839b714be07c

  • SHA256

    353ed3726f653a8e19c5c1511088ae21f3673d992a1781c100dec7e8418a7fc8

  • SHA512

    b7cb060c4cabbb926e8a40adf797f9b082f6bac87a97b984aa6a636d82cf873b5657026b43d17359ffa1cee1f9eacced591f6c03e747b3d63090a4bc3d0fbf9b

  • SSDEEP

    49152:W/Ce4+1N237v0gM68DXYDqwLvws0EdRGtVpT1kTNkbNbQWSxR9DzNJyEv5j/ujOJ:je4PLs6VKOQpyJWSxR9vBEAm8dJT1

Score
10/10
lummastealer

Malware Config

Extracted

Family

lumma

C2

https://stripmarrystresew.shop/api

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://bordersoarmanusjuw.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\353ed3726f653a8e19c5c1511088ae21f3673d992a1781c100dec7e8418a7fc8.exe
    "C:\Users\Admin\AppData\Local\Temp\353ed3726f653a8e19c5c1511088ae21f3673d992a1781c100dec7e8418a7fc8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      2⤵
        PID:2024

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2024-5-0x0000000000BF0000-0x0000000000C3F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/2024-8-0x0000000000BF0000-0x0000000000C3F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/2024-9-0x0000000000BF0000-0x0000000000C3F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/2024-10-0x0000000000BF0000-0x0000000000C3F000-memory.dmp
      Filesize

      316KB

      Download
    • memory/4508-4-0x00007FF729990000-0x00007FF729FD3000-memory.dmp
      Filesize

      6.3MB

      Download
    • memory/4508-6-0x00007FF729990000-0x00007FF729FD3000-memory.dmp
      Filesize

      6.3MB

      Download