lumma | b9ad294c7046ebf0478fd26ead5c843ad085be2b75b384db7ce736b917bb0574

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FоrtniteHack/FоrtniteHack.exe
Size 423KB
Sample240528-swa3tabd49
SHA256 22f96e32d657febaf4ebfb3a3f2e130bc81186411016f3dcd32c07ed28be0a91
MD5 2ec5aa978fa11b1fca15b1ad1a8f27f5
SHA1 2b3819c3c2bf7c4a477d4dcdf4b90392ed2c7faa
SHA512 c121a79e28d7421506ede67a43bbbf7652a8ebd8cf6f3a6a578742b012429a65b002ede75aec15516728a6f583703dd0e0b2564d636e8a7d5dc5f40342d86d18
SSDEEP 12288:z/bcPJsS1bvMdRiNp1ioO2rubIdzSgoUPrpakgch49RP9NJsa+6RLtpnp:z/bchs6YiNpYoO2r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://considerrycurrentyws.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
5032	FоrtniteHack.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5032 set thread context of 968	5032	FоrtniteHack.exe	93

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 968	5032	FоrtniteHack.exe	93
PID 5032 wrote to memory of 968	5032	FоrtniteHack.exe	93
PID 5032 wrote to memory of 968	5032	FоrtniteHack.exe	93
PID 5032 wrote to memory of 968	5032	FоrtniteHack.exe	93
PID 5032 wrote to memory of 968	5032	FоrtniteHack.exe	93
PID 5032 wrote to memory of 968	5032	FоrtniteHack.exe	93
PID 5032 wrote to memory of 968	5032	FоrtniteHack.exe	93
PID 5032 wrote to memory of 968	5032	FоrtniteHack.exe	93
PID 5032 wrote to memory of 968	5032	FоrtniteHack.exe	93

C:\Users\Admin\AppData\Local\Temp\FоrtniteHack\FоrtniteHack.exe
"C:\Users\Admin\AppData\Local\Temp\FоrtniteHack\FоrtniteHack.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4612,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
1⤵
PID:3140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

d3d9.dll

Path C:\Users\Admin\AppData\Roaming\d3d9.dll
Size 429KB
SHA256 9964b8f2ca9e8f72bbe66dbbcdf099cd42a0ded0063400cd83dbd5f22ec3e5da
MD5 54cad9141419b6d659e5517e208a1d33
SHA1 593c47ef1f403cf70c13be850ffc65280e1806fe
SHA512 ab22a637bde9bace0c7745231a8ae0cd8d5000ac66d4081a399a3cc2abde0f70fefc6715da82e571ac93ea6d2cd79ecc02045638fef609232fa0db8f931afe76
SSDEEP 6144:BDwTBdRoJmXbzRDTsMVRcLwlVJZnDlTl7QNwGs3BTwz38u9LnAGru3ZK6d+/fQiR:ZwTBdRokTsMA6iR0nkjb1tsbVO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/968-9-0x0000000000730000-0x0000000000788000-memory.dmp

Download

memory/968-17-0x0000000000730000-0x0000000000788000-memory.dmp

Download

memory/968-13-0x0000000000730000-0x0000000000788000-memory.dmp

Download

memory/5032-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

Download

memory/5032-1-0x0000000000D20000-0x0000000000D92000-memory.dmp

Download

memory/5032-2-0x0000000002FB0000-0x0000000002FB6000-memory.dmp

Download

memory/5032-19-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

memory/5032-18-0x0000000077611000-0x0000000077731000-memory.dmp

Download

memory/5032-20-0x0000000074B70000-0x0000000075320000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads