lumma | fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
Size

374KB
MD5

62d88827fb9ccfc3f5d7597e2b6883b1
SHA1

0f1389d5e715b82a992edc6512af12724f6450f9
SHA256

fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697
SHA512

f4f9b14eb6c60d50dc8de71fc0a3a3214df5c21d20a9a2f9e824878f22d7f36ca92f711c0267ee9d1c0afe91b420ec304f31fcab311c558a2234fb0ae927c9ca
SSDEEP

6144:tpIctLgefOPfgJlWm0w+1Jv0ao9b0L3ibpl/UPBxT:tpIctLgefO3ST0w+1Kzu3ibaD

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://strollheavengwu.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe

description	pid	process	target process
PID 1624 set thread context of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe

description	pid	process	target process
PID 1624 wrote to memory of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 1624 wrote to memory of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 1624 wrote to memory of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 1624 wrote to memory of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 1624 wrote to memory of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 1624 wrote to memory of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 1624 wrote to memory of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 1624 wrote to memory of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
PID 1624 wrote to memory of 4996	1624	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe	fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe

C:\Users\Admin\AppData\Local\Temp\fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
"C:\Users\Admin\AppData\Local\Temp\fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe
  "C:\Users\Admin\AppData\Local\Temp\fcc107c7aae9e1079a072e5c29e26460a1594ff5f213c797dd064965f2dbd697.exe"
  2⤵
  PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-1-0x0000000004190000-0x0000000004290000-memory.dmp

Filesize
1024KB

Download
memory/1624-2-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Filesize
304KB

Download
memory/4996-3-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4996-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4996-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4996-7-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download