lumma | 19ef966a051fb80a7e9a4c226171784888184c9e12f75a8cc5d88da9ecab375f | Triage

Submit
Reports

Overview

overview

Static

static

3

06ca8c24aa...f2.exe

windows10-2004-x64

0a65c97791...d1.exe

windows10-2004-x64

131675744e...29.exe

windows10-2004-x64

204413b9cd...ef.exe

windows10-2004-x64

236732ce45...d5.exe

windows7-x64

3

236732ce45...d5.exe

windows10-2004-x64

23bc83a4a6...94.exe

windows10-2004-x64

3c35dfb6ea...cb.exe

windows10-2004-x64

42aaf3452f...91.exe

windows10-2004-x64

42d39578cc...dd.exe

windows10-2004-x64

4f4e29cb12...50.exe

windows10-2004-x64

566c1670c8...b3.exe

windows7-x64

3

566c1670c8...b3.exe

windows10-2004-x64

5b49e20d68...4b.exe

windows10-2004-x64

6a07da5bb1...d3.exe

windows10-2004-x64

6fca9c5ffc...25.exe

windows10-2004-x64

9a7761a218...43.exe

windows7-x64

3

9a7761a218...43.exe

windows10-2004-x64

9c63b1ba60...a6.exe

windows10-2004-x64

c4172a7d8d...fa.exe

windows7-x64

3

c4172a7d8d...fa.exe

windows10-2004-x64

c69d581e2c...e2.exe

windows10-2004-x64

d6c7041aa6...93.exe

windows7-x64

3

d6c7041aa6...93.exe

windows10-2004-x64

d9d3f90c8c...39.exe

windows7-x64

3

d9d3f90c8c...39.exe

windows10-2004-x64

Analysis

max time kernel
129s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 15:11

Sharing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

06ca8c24aac1dfc98dcff3632bd9a2a735d5a57c7e634d8c9100f6446b5423f2.exe

Resource

win10v2004-20240426-en

amadey healer redline lande dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

0a65c977910ca28680d005dc6473013f3db66862b80fc54be76caaa774022bd1.exe

Resource

win10v2004-20240426-en

healer redline kira dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral3

Sample

131675744e12e01eb73fd34a82dd03d2d5ab80bd88b854836a13d0065e536c29.exe

Resource

win10v2004-20240226-en

amadey healer redline naher dropper evasion infostealer persistence trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral4

Sample

204413b9cda0920c938a88543e17b0124930d45599fcfef01c7c4af30f9266ef.exe

Resource

win10v2004-20240426-en

healer redline mihan dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral5

Sample

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

23bc83a4a63831c87e6d79e2b366e2534c967a13a377e66f4d92e226f9e8be94.exe

Resource

win10v2004-20240508-en

healer redline dumud dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral8

Sample

3c35dfb6ea626f1c886ef4aa2783e8564f7331e639f222d5e208b3a6840a2bcb.exe

Resource

win10v2004-20240508-en

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral9

Sample

42aaf3452f3dbd3fec800b9307def7e1463e88016e6585d09719f8642ef8f491.exe

Resource

win10v2004-20240508-en

amadey healer redline nasa dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral10

Sample

42d39578cc12683f8a0abd7ba86e5c4ac7851f250280f34750b593a37c4d87dd.exe

Resource

win10v2004-20240508-en

healer redline dumud dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral11

Sample

4f4e29cb128488d30d32248cb2cc720bcd2a3a531f5757ba469b1e3291917c50.exe

Resource

win10v2004-20240426-en

healer redline dumud dropper evasion infostealer persistence trojan

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral12

Sample

566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

566c1670c8a5f43ec35b831518b15cf388fbddff2c3ba3ffc8167ac1bf0a1fb3.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral14

Sample

5b49e20d688471002a1cc866e323e32a0e0a2f1e92fd2f057979cd27a850f44b.exe

Resource

win10v2004-20240426-en

amadey healer redline lande dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral15

Sample

6a07da5bb14797863c49fc62e415bb280c201c446e8d5746c3ae106bf92ceed3.exe

Resource

win10v2004-20240426-en

healer redline mihan dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral16

Sample

6fca9c5ffc57888f92c438ff3dd7d9247b7f7e696e9a6b1b63c3aa2a801b0625.exe

Resource

win10v2004-20240426-en

amadey healer redline smokeloader news backdoor dropper evasion infostealer persistence trojan

windows10-2004-x64

18 signatures

150 seconds

Behavioral task

behavioral17

Sample

9a7761a218bd7bd89d897848e3eafea1a05f151c3ab44668124ffa35c4d3a743.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

9a7761a218bd7bd89d897848e3eafea1a05f151c3ab44668124ffa35c4d3a743.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

9c63b1ba6018935ad5e5fbb92f79d2bbd6eeb9ee0520ed5cbe7b9e1213eb33a6.exe

Resource

win10v2004-20240226-en

healer redline masha dropper evasion infostealer persistence trojan

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral20

Sample

c4172a7d8d27c8367cd7a3b7b3d410e4678ddfd8748e6bf631c21e8f639c7efa.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

c4172a7d8d27c8367cd7a3b7b3d410e4678ddfd8748e6bf631c21e8f639c7efa.exe

Resource

win10v2004-20240508-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral22

Sample

c69d581e2c9751820b591c60023bbffd16aa66ad26d0c76b20574cdac2cc7be2.exe

Resource

win10v2004-20240508-en

amadey mystic persistence stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral23

Sample

d6c7041aa6a01fcdc7f6a9f60c8eaf8edcbcc73cb1802bc3623346b3b3219693.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral24

Sample

d6c7041aa6a01fcdc7f6a9f60c8eaf8edcbcc73cb1802bc3623346b3b3219693.exe

Resource

win10v2004-20240508-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral25

Sample

d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe

Resource

win10v2004-20240426-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Report Analysis Logs

General

Target

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
Size

694KB
MD5

c8032b42738527a70de1dadc4a7bff5b
SHA1

f5f778df15d4e14503bea0f654cf9427ba050a38
SHA256

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5
SHA512

babddfaac51c11952a79047852b01c499075acfe24e91dac46a5c590a31be1e4e71df5b1daf27254d9d608fa7345839790f8a550e04392de7f625c5d6b22a97d
SSDEEP

12288:OO0Jg3ZJ7hWFArUqHsjumNFcF9gopM3bcgsqV5P3JkTC:OJJU7hWFuHyumzcCLUqV5v0

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

C2

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://enthusiasimtitleow.shop/api

https://dismissalcylinderhostw.shop/api

https://affordcharmcropwo.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://pillowbrocccolipe.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Processes

C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
"C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe"
1⤵
PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-0-0x00000000008E0000-0x000000000092D000-memory.dmp

Filesize
308KB

Download
memory/1428-6-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1428-5-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1428-7-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1428-9-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1428-8-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/1428-10-0x00000000008E0000-0x000000000092D000-memory.dmp

Filesize
308KB

Download

© 2018-2024

Terms | Privacy