lumma | b195c8a81abf7913891a8bae26d1a5ad70dc5fdc555a9b57b848a82e251160eb

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

이미지 및 영상 저작권 위반 목��.exe
Size

2.1MB
MD5

292a5af0d8d4a5803022019507a83bed
SHA1

85310ecfd16b0920977229ad87f08d1207e756e6
SHA256

b195c8a81abf7913891a8bae26d1a5ad70dc5fdc555a9b57b848a82e251160eb
SHA512

c5cdec88a0ef29f7f7fa92f73296bb6d6b7bde8ccfc600e3fb3012288997981cc1cc356675e32bab55b684ab5b8838ee6f2032cdcac888d2cea5ee681a743766
SSDEEP

24576:ZUubL6cMcjdtsnFVZ+Ghc8zTxm+6Sv/Sr4XDeErmauz5y868Vk5rzarBNz0Kpcq:ZUuGOqFVZfhc8zM+6SvTSz5y868Vk5uV

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://bordersoarmanusjuw.shop/api

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

이미지 및 영상 저작권 위반 목��.exe

pid process

2516 이미지 및 영상 저작권 위반 목��.exe

pid	process
2516	이미지 및 영상 저작권 위반 목��.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

이미지 및 영상 저작권 위반 목��.exe

description	pid	process	target process
PID 2516 wrote to memory of 3300	2516	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 2516 wrote to memory of 3300	2516	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 2516 wrote to memory of 3300	2516	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 2516 wrote to memory of 3300	2516	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 2516 wrote to memory of 3300	2516	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe
PID 2516 wrote to memory of 3300	2516	이미지 및 영상 저작권 위반 목��.exe	이미지 및 영상 저작권 위반 목��.exe

C:\Users\Admin\AppData\Local\Temp\이미지 및 영상 저작권 위반 목��.exe
"C:\Users\Admin\AppData\Local\Temp\이미지 및 영상 저작권 위반 목��.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\이미지 및 영상 저작권 위반 목��.exe
  "C:\Users\Admin\AppData\Local\Temp\이미지 및 영상 저작권 위반 목��.exe"
  2⤵
  PID:3300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2516-0-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/2516-3-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/2516-2-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/2516-1-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/2516-5-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/3300-4-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3300-8-0x0000000000620000-0x000000000066F000-memory.dmp

Filesize
316KB

Download
memory/3300-7-0x0000000000620000-0x000000000066F000-memory.dmp

Filesize
316KB

Download
memory/3300-9-0x0000000000620000-0x000000000066F000-memory.dmp

Filesize
316KB

Download