lumma | 99271882f5d61c2e705f9cceb2bd5f911f104cfdb837ce7b14466ea62f825834

Analysis

max time kernel
75s
max time network
79s
platform
windows10-1703_x64
resource
win10-20240404-es
resource tags

arch:x64arch:x86image:win10-20240404-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
28-04-2024 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$RD2LRHZ.exe
Size

71.3MB
MD5

1035fb8f30ba91c842559b5468f5d119
SHA1

b260c17c7294252ce1b95906abfa7a5341d7d047
SHA256

99271882f5d61c2e705f9cceb2bd5f911f104cfdb837ce7b14466ea62f825834
SHA512

7a0763fe682a3728e5cb4a27e373bf29bac172ac6d9332775394d2bd7671680f0f19385bb95b6d84b14a3fd88b84e91c8e11a592649d5fd31eebe33c76708017
SSDEEP

393216:pRQU5PZcx+p4C7tvgDwB1JshHA52LpXopwswkV8:pRn5Pix+yDwqa5WlfswkV8

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://bowelunitrydoorsko.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 raw.githubusercontent.com
2 raw.githubusercontent.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

$RD2LRHZ.exe

description pid process target process

PID 1040 set thread context of 3456 1040 $RD2LRHZ.exe BitLockerToGo.exe

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

description	pid	process	target process
PID 1040 set thread context of 3456	1040	$RD2LRHZ.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

$RD2LRHZ.exe

description	pid	process	target process
PID 1040 wrote to memory of 3456	1040	$RD2LRHZ.exe	BitLockerToGo.exe
PID 1040 wrote to memory of 3456	1040	$RD2LRHZ.exe	BitLockerToGo.exe
PID 1040 wrote to memory of 3456	1040	$RD2LRHZ.exe	BitLockerToGo.exe
PID 1040 wrote to memory of 3456	1040	$RD2LRHZ.exe	BitLockerToGo.exe
PID 1040 wrote to memory of 3456	1040	$RD2LRHZ.exe	BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\$RD2LRHZ.exe
"C:\Users\Admin\AppData\Local\Temp\$RD2LRHZ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-3-0x00007FF757300000-0x00007FF75BB4F000-memory.dmp

Filesize
72.3MB

Download
memory/1040-9-0x00007FF757300000-0x00007FF75BB4F000-memory.dmp

Filesize
72.3MB

Download
memory/3456-6-0x0000000003200000-0x000000000324D000-memory.dmp

Filesize
308KB

Download
memory/3456-8-0x0000000003200000-0x000000000324D000-memory.dmp

Filesize
308KB

Download
memory/3456-10-0x0000000003200000-0x000000000324D000-memory.dmp

Filesize
308KB

Download