lumma | 36a33e7da8ad27ce449d6bc53c6ca650bc283b8f96d5fe797187aea40e0dcc68 | Triage

Submit
Reports

Overview

overview

Static

static

3

100e14f03b...37.exe

windows10-2004-x64

14e92d7584...fd.exe

windows7-x64

3

14e92d7584...fd.exe

windows10-2004-x64

228c350439...1a.exe

windows7-x64

3

228c350439...1a.exe

windows10-2004-x64

236732ce45...d5.exe

windows7-x64

3

236732ce45...d5.exe

windows10-2004-x64

2a0ae333a9...1a.exe

windows7-x64

3

2a0ae333a9...1a.exe

windows10-2004-x64

2b467ee19e...44.exe

windows7-x64

3

2b467ee19e...44.exe

windows10-2004-x64

399f6dfec3...0c.exe

windows10-2004-x64

3ddd80ba69...8c.exe

windows7-x64

3

3ddd80ba69...8c.exe

windows10-2004-x64

4be1f370e8...6b.exe

windows7-x64

3

4be1f370e8...6b.exe

windows10-2004-x64

65a31de21f...f0.exe

windows10-2004-x64

790345d8c0...0a.exe

windows7-x64

3

790345d8c0...0a.exe

windows10-2004-x64

7a5164cea0...f7.exe

windows7-x64

3

7a5164cea0...f7.exe

windows10-2004-x64

9a7761a218...43.exe

windows7-x64

3

9a7761a218...43.exe

windows10-2004-x64

a26df59e48...78.exe

windows10-2004-x64

c0c8fc8c3b...49.exe

windows7-x64

3

c0c8fc8c3b...49.exe

windows10-2004-x64

c4172a7d8d...fa.exe

windows7-x64

3

c4172a7d8d...fa.exe

windows10-2004-x64

d3855d0640...68.exe

windows7-x64

3

d3855d0640...68.exe

windows10-2004-x64

d6c7041aa6...93.exe

windows7-x64

3

d6c7041aa6...93.exe

windows10-2004-x64

Analysis

max time kernel
136s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 09:13

Sharing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

100e14f03bac13fc1c4e178555a3dd9d1c0a021aa089b6b88cb8065f8163e837.exe

Resource

win10v2004-20240508-en

redline dimas infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

14e92d75842bf0e1bcae35adc805c07925a4a6d97655b90182b6147b5efbaffd.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

14e92d75842bf0e1bcae35adc805c07925a4a6d97655b90182b6147b5efbaffd.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

228c35043919b5a4d810fd11dbb1b9646333aa6e75788617e4cc4ac41ab07a1a.exe

Resource

win7-20240215-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

228c35043919b5a4d810fd11dbb1b9646333aa6e75788617e4cc4ac41ab07a1a.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

2a0ae333a9b72768e8a05e7ebbfe4b15cf581f8c08129c0639aeed58eaf7901a.exe

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

2a0ae333a9b72768e8a05e7ebbfe4b15cf581f8c08129c0639aeed58eaf7901a.exe

Resource

win10v2004-20240508-en

redline 5345987420 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral10

Sample

2b467ee19e1542f60392c1b29a264ffabce3e9a8da48a4707e8d8f1bea1d1244.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

2b467ee19e1542f60392c1b29a264ffabce3e9a8da48a4707e8d8f1bea1d1244.exe

Resource

win10v2004-20240508-en

redline 5195552529 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral12

Sample

399f6dfec39b77c21a8b31e45c5c8fb863a8b28a73a4923ff7543886ebfa0c0c.exe

Resource

win10v2004-20240426-en

redline ditro infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral13

Sample

3ddd80ba692516ca1977cdf6eb25ad59de7b9e87f447a412e2468a77ad1bbd8c.exe

Resource

win7-20240419-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

3ddd80ba692516ca1977cdf6eb25ad59de7b9e87f447a412e2468a77ad1bbd8c.exe

Resource

win10v2004-20240508-en

redline 5637482599 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral15

Sample

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

Resource

win7-20240419-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

4be1f370e880d06da141a2c9957de478c40592a3abf6312aa8c2ef401a37d36b.exe

Resource

win10v2004-20240508-en

redline 5195552529 discovery infostealer spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral17

Sample

65a31de21fb11e9ed0db8f58105c54bbfc7953f539d85a946293e38e9065bbf0.exe

Resource

win10v2004-20240508-en

redline dimas evasion infostealer persistence trojan

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral18

Sample

790345d8c07ae982c606f2db111e6ff6a2bae42847c106a6f096f208f1653d0a.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

790345d8c07ae982c606f2db111e6ff6a2bae42847c106a6f096f208f1653d0a.exe

Resource

win10v2004-20240508-en

redline zgrat discovery infostealer rat spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral20

Sample

7a5164cea09551d97475639ab8fb782d5fff907df5db0ff94ae2cb2a3b40dcf7.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

7a5164cea09551d97475639ab8fb782d5fff907df5db0ff94ae2cb2a3b40dcf7.exe

Resource

win10v2004-20240426-en

redline @deeqsio infostealer

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral22

Sample

9a7761a218bd7bd89d897848e3eafea1a05f151c3ab44668124ffa35c4d3a743.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral23

Sample

9a7761a218bd7bd89d897848e3eafea1a05f151c3ab44668124ffa35c4d3a743.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral24

Sample

a26df59e48ff80e63c4ae80b1ca4da56cf0629cdcaaa173b3f510b0b20722f78.exe

Resource

win10v2004-20240508-en

redline dimas evasion infostealer persistence trojan

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral25

Sample

c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

c0c8fc8c3baf26ce045fa13a8b1bf6d6051171f13321183317fc587bd5217e49.exe

Resource

win10v2004-20240426-en

redline 7001210066 discovery infostealer spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral27

Sample

c4172a7d8d27c8367cd7a3b7b3d410e4678ddfd8748e6bf631c21e8f639c7efa.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral28

Sample

c4172a7d8d27c8367cd7a3b7b3d410e4678ddfd8748e6bf631c21e8f639c7efa.exe

Resource

win10v2004-20240226-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral29

Sample

d3855d0640853387bc0df63e4ddcbc8af40e8cbb259b6be8049d23526e31dd68.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

d3855d0640853387bc0df63e4ddcbc8af40e8cbb259b6be8049d23526e31dd68.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

d6c7041aa6a01fcdc7f6a9f60c8eaf8edcbcc73cb1802bc3623346b3b3219693.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral32

Sample

d6c7041aa6a01fcdc7f6a9f60c8eaf8edcbcc73cb1802bc3623346b3b3219693.exe

Resource

win10v2004-20240426-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Report Analysis Logs

General

Target

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
Size

694KB
MD5

c8032b42738527a70de1dadc4a7bff5b
SHA1

f5f778df15d4e14503bea0f654cf9427ba050a38
SHA256

236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5
SHA512

babddfaac51c11952a79047852b01c499075acfe24e91dac46a5c590a31be1e4e71df5b1daf27254d9d608fa7345839790f8a550e04392de7f625c5d6b22a97d
SSDEEP

12288:OO0Jg3ZJ7hWFArUqHsjumNFcF9gopM3bcgsqV5P3JkTC:OJJU7hWFuHyumzcCLUqV5v0

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

C2

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://enthusiasimtitleow.shop/api

https://dismissalcylinderhostw.shop/api

https://affordcharmcropwo.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://pillowbrocccolipe.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Processes

C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe
"C:\Users\Admin\AppData\Local\Temp\236732ce453b741f26e2fb94d54ade44d3d1ae332c52f6d420a1dcc1c8d05dd5.exe"
1⤵
PID:4220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4220-7-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4220-9-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4220-8-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4220-6-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4220-5-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4220-0-0x00000000004D0000-0x000000000051D000-memory.dmp

Filesize
308KB

Download
memory/4220-10-0x00000000004D0000-0x000000000051D000-memory.dmp

Filesize
308KB

Download

© 2018-2024

Terms | Privacy