Analysis Overview
SHA256
d7809d4936e59199744d7e0384807963821745e3de18eaec4715887a1687b9c5
Threat Level: Known bad
The file d7809d4936e59199744d7e0384807963821745e3de18eaec4715887a1687b9c5 was found to be: Known bad.
Malicious Activity Summary
Lumma Stealer
Unsigned PE
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-05-21 08:18
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-21 08:18
Reported
2024-05-21 08:21
Platform
win7-20240220-en
Max time kernel
122s
Max time network
123s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\d7809d4936e59199744d7e0384807963821745e3de18eaec4715887a1687b9c5.exe
"C:\Users\Admin\AppData\Local\Temp\d7809d4936e59199744d7e0384807963821745e3de18eaec4715887a1687b9c5.exe"
Network
Files
memory/2932-2-0x0000000000260000-0x000000000026A000-memory.dmp
memory/2932-1-0x0000000000260000-0x000000000026A000-memory.dmp
memory/2932-3-0x0000000000407000-0x0000000000421000-memory.dmp
memory/2932-0-0x0000000000400000-0x00000000006B8000-memory.dmp
memory/2932-12-0x0000000000273000-0x0000000000277000-memory.dmp
memory/2932-16-0x0000000000390000-0x00000000003E5000-memory.dmp
memory/2932-15-0x00000000002A3000-0x00000000002B9000-memory.dmp
memory/2932-14-0x00000000002A0000-0x00000000002B9000-memory.dmp
memory/2932-13-0x0000000000280000-0x0000000000284000-memory.dmp
memory/2932-11-0x0000000000263000-0x000000000026A000-memory.dmp
memory/2932-10-0x0000000000270000-0x0000000000277000-memory.dmp
memory/2932-8-0x00000000002A0000-0x00000000002B9000-memory.dmp
memory/2932-6-0x0000000000280000-0x0000000000284000-memory.dmp
memory/2932-4-0x0000000000270000-0x0000000000277000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-21 08:18
Reported
2024-05-21 08:21
Platform
win10v2004-20240508-en
Max time kernel
140s
Max time network
106s
Command Line
Signatures
Lumma Stealer
Processes
C:\Users\Admin\AppData\Local\Temp\d7809d4936e59199744d7e0384807963821745e3de18eaec4715887a1687b9c5.exe
"C:\Users\Admin\AppData\Local\Temp\d7809d4936e59199744d7e0384807963821745e3de18eaec4715887a1687b9c5.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| NL | 23.62.61.147:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 147.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | negotitatiojdsuktoos.shop | udp |
| US | 104.21.52.185:443 | negotitatiojdsuktoos.shop | tcp |
| US | 8.8.8.8:53 | museumtespaceorsp.shop | udp |
| US | 104.21.32.80:443 | museumtespaceorsp.shop | tcp |
| US | 8.8.8.8:53 | buttockdecarderwiso.shop | udp |
| US | 104.21.45.202:443 | buttockdecarderwiso.shop | tcp |
| US | 8.8.8.8:53 | averageaattractiionsl.shop | udp |
| US | 172.67.220.163:443 | averageaattractiionsl.shop | tcp |
| US | 8.8.8.8:53 | femininiespywageg.shop | udp |
| US | 172.67.141.63:443 | femininiespywageg.shop | tcp |
| US | 8.8.8.8:53 | 185.52.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.32.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.45.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 163.220.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | employhabragaomlsp.shop | udp |
| US | 104.21.85.81:443 | employhabragaomlsp.shop | tcp |
| US | 8.8.8.8:53 | stalfbaclcalorieeis.shop | udp |
| US | 104.21.3.197:443 | stalfbaclcalorieeis.shop | tcp |
| US | 8.8.8.8:53 | civilianurinedtsraov.shop | udp |
| US | 104.21.49.245:443 | civilianurinedtsraov.shop | tcp |
| US | 8.8.8.8:53 | roomabolishsnifftwk.shop | udp |
| US | 172.67.146.92:443 | roomabolishsnifftwk.shop | tcp |
| US | 8.8.8.8:53 | 63.141.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.85.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.3.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 245.49.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.146.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.143.109.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
Files
memory/1328-1-0x0000000000407000-0x0000000000421000-memory.dmp
memory/1328-3-0x00000000007B0000-0x00000000007BA000-memory.dmp
memory/1328-0-0x0000000000400000-0x00000000006B8000-memory.dmp
memory/1328-2-0x00000000007B0000-0x00000000007BA000-memory.dmp
memory/1328-9-0x0000000002320000-0x0000000002339000-memory.dmp
memory/1328-8-0x0000000002320000-0x0000000002339000-memory.dmp
memory/1328-7-0x0000000002310000-0x0000000002314000-memory.dmp
memory/1328-6-0x0000000002310000-0x0000000002314000-memory.dmp
memory/1328-5-0x0000000000960000-0x0000000000967000-memory.dmp
memory/1328-4-0x0000000000960000-0x0000000000967000-memory.dmp