lumma | 9fae11bbddc34f8003aff393b61a642201956696c91d0e24654bdabcf0ea8888

Analysis

max time kernel
1743s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 489KB
Sample240426-mbtfrsec55
SHA256 b022e84bd788984165f784f32a92ed179bedba490d5f13a1a0ca5efabb847cfe
MD5 5174e994652d09ba7396233c95d59619
SHA1 5a141acabda964b50bcf574a10c773a6b47700b7
SHA512 57ac8e211c782ecc47b5058d37fd4ed9b8bb61c1d86a5850474ce3105d5d1fd8b16b458f31a4b4600302aa65faa8fb9f3442dbc45bdc38e0a0a7b53b298d1a36
SSDEEP 12288:d4J4ZH65jJj3y/vZNCbkRgaUCR6THZHiO4EoEhkXRa:y4ZGji/v3CIRgaUNETB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://productivelookewr.shop/api
https://tolerateilusidjukl.shop/api
https://shatterbreathepsw.shop/api
https://shortsvelventysjo.shop/api
https://incredibleextedwj.shop/api
https://alcojoldwograpciw.shop/api
https://liabilitynighstjsko.shop/api
https://demonstationfukewko.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3740 set thread context of 2416	3740	Setup.exe	88

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 2416	3740	Setup.exe	88
PID 3740 wrote to memory of 2416	3740	Setup.exe	88
PID 3740 wrote to memory of 2416	3740	Setup.exe	88
PID 3740 wrote to memory of 2416	3740	Setup.exe	88
PID 3740 wrote to memory of 2416	3740	Setup.exe	88
PID 3740 wrote to memory of 2416	3740	Setup.exe	88
PID 3740 wrote to memory of 2416	3740	Setup.exe	88
PID 3740 wrote to memory of 2416	3740	Setup.exe	88
PID 3740 wrote to memory of 2416	3740	Setup.exe	88

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/2416-3-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/2416-4-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/2416-5-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/3740-1-0x0000000000A80000-0x0000000000AFF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads