lumma | 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b

Analysis

max time kernel
195s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24/05/2024, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe
Size 460KB
Sample240524-ajtehsed4z
SHA256 74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b
MD5 c49297876753f4cd93461e26db8b586e
SHA1 ca9e6c59d61709585867a41de09429542c380a36
SHA512 8cdb0953e129b0bb74d946d304ad9b21c0365b85b0db378ba568057c30234ec1ce0e18cc26d25fc70180680928051ba2b6829768bdd714286fcb1d359d0f00d3
SSDEEP 12288:zTUgQwrx/PEWHuPYwakIS/GsTrnLXGil1erhFn:/UgnV6gYISe0rnyibgjn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://civilianurinedtsraov.shop/api
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://roomabolishsnifftwk.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3380 set thread context of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 2768	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	75
PID 3380 wrote to memory of 2768	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	75
PID 3380 wrote to memory of 2768	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	75
PID 3380 wrote to memory of 4512	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	76
PID 3380 wrote to memory of 4512	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	76
PID 3380 wrote to memory of 4512	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	76
PID 3380 wrote to memory of 3824	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	77
PID 3380 wrote to memory of 3824	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	77
PID 3380 wrote to memory of 3824	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	77
PID 3380 wrote to memory of 1984	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	78
PID 3380 wrote to memory of 1984	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	78
PID 3380 wrote to memory of 1984	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	78
PID 3380 wrote to memory of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79
PID 3380 wrote to memory of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79
PID 3380 wrote to memory of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79
PID 3380 wrote to memory of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79
PID 3380 wrote to memory of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79
PID 3380 wrote to memory of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79
PID 3380 wrote to memory of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79
PID 3380 wrote to memory of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79
PID 3380 wrote to memory of 1216	3380	74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe	79

C:\Users\Admin\AppData\Local\Temp\74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe
"C:\Users\Admin\AppData\Local\Temp\74fb94ba07de535e48b40eb86773e883e0d40ee55a10397526359844add1f92b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-1-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/1216-4-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/1216-5-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/3380-0-0x0000000001030000-0x0000000001031000-memory.dmp

Download

memory/3380-2-0x0000000001030000-0x0000000001031000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads