lumma | 721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491

Analysis

max time kernel
195s
max time network
288s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30/05/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe
Size 9.5MB
Sample240530-23d8gsec43
SHA256 721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491
MD5 92a37ff5181652c90127a6b0dac3d698
SHA1 4efc3a86cb4b84d4a91c7fe9454ac4de0ef0ba0a
SHA512 053a3452301a9a44b1e3ad19952a6e6d2b4e5a049a8cc5ed7cf1f4f36e8d69ac06319b9415bb41065da782db56a20825f26c7851ce69517d0012cdd90679bb8f
SSDEEP 49152:yVNz/Cxy3i+Brb/T3vO90d7HjmAFd4A64nsfJbbw8nrCi7flLd5exyzApUYpUFKS:aB3i/b77t/exyztFKCzvfjE6yxW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://considerrycurrentyws.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4616 set thread context of 1544	4616	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	74

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 1544	4616	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	74
PID 4616 wrote to memory of 1544	4616	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	74
PID 4616 wrote to memory of 1544	4616	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	74
PID 4616 wrote to memory of 1544	4616	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	74
PID 4616 wrote to memory of 1544	4616	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	74

C:\Users\Admin\AppData\Local\Temp\721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe
"C:\Users\Admin\AppData\Local\Temp\721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-5-0x0000000002D00000-0x0000000002D59000-memory.dmp

Download

memory/1544-8-0x0000000002D00000-0x0000000002D59000-memory.dmp

Download

memory/1544-9-0x0000000002D00000-0x0000000002D59000-memory.dmp

Download

memory/4616-2-0x00007FF642870000-0x00007FF643256000-memory.dmp

Download

memory/4616-6-0x00007FF642870000-0x00007FF643256000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads