lumma | ba67c443843d2a805daa4bff47449488132533d66ed36b9b6349b74c65b08a5d

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 686.0MB
Sample240530-fn8ynage97
SHA256 c279f9d80a89a46aa4719cd2ad388ed39f88949c457deff47ba3b1520991fdf2
MD5 c3d6187447293dda0ee6610d3bb77f5f
SHA1 828e7fe748f0d32175195e8c19a52d31af748455
SHA512 bed12fe4c4604a6526c1950f197894947b291fbeeb1902401ae7527705b3503e86354123de73edbc59b3e3ef6992a0955e3f1a74eb0f66e5caf2b7eb143d5e9b
SSDEEP 196608:P9HPEP3fd6zGRgRRarrtck0ef73viP/KSt6u+b2htX6/O:Bk3fdjRyarrz0efo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://tropicalironexpressiw.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://considerrycurrentyws.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
3548	Setup.exe

Loads dropped DLL 1 IoCs

pid	Process
3848	launch.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1172 set thread context of 2616	1172	Setup.exe	93

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	3548	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1172	Setup.exe
1172	Setup.exe
2616	more.com
2616	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1172	Setup.exe
2616	more.com

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 3548	1172	Setup.exe	87
PID 1172 wrote to memory of 3548	1172	Setup.exe	87
PID 1172 wrote to memory of 3548	1172	Setup.exe	87
PID 1172 wrote to memory of 2616	1172	Setup.exe	93
PID 1172 wrote to memory of 2616	1172	Setup.exe	93
PID 1172 wrote to memory of 2616	1172	Setup.exe	93
PID 1172 wrote to memory of 2616	1172	Setup.exe	93
PID 2616 wrote to memory of 3848	2616	more.com	96
PID 2616 wrote to memory of 3848	2616	more.com	96
PID 2616 wrote to memory of 3848	2616	more.com	96
PID 2616 wrote to memory of 3848	2616	more.com	96
PID 2616 wrote to memory of 3848	2616	more.com	96

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Users\Admin\AppData\Roaming\huia\TKAIYFGKDGPLW\Setup.exe
  C:\Users\Admin\AppData\Roaming\huia\TKAIYFGKDGPLW\Setup.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 848
    3⤵
    - Program crash
    PID:5020
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Users\Admin\AppData\Local\Temp\launch.au3
    C:\Users\Admin\AppData\Local\Temp\launch.au3
    3⤵
    - Loads dropped DLL
    PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3548 -ip 3548
1⤵
PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

b11fd68d

Path C:\Users\Admin\AppData\Local\Temp\b11fd68d
Size 2.1MB
SHA256 66915043439043c6e225e5a20408dae22e853721176625a60561b8dc96e32faa
MD5 37fe1e953a5c65c47a9dcd02b30172f6
SHA1 b891e2885076d1d4605519d427f2982c847298e2
SHA512 7acf61e76d9dcf1c08e9e4e492bcf86c2ce49988a25521735c0780f22930195cd01ea2b9e4cf8b730ce69bac27d0c093b0a25253feb14a74d90c01432329badb
SSDEEP 49152:MZfxvPtS7u4qtLd8DlyNRQTgyWCR1C9rsxdEsvobSt7Uqj+w411ovy9rLFY8XPDn:MZftP6S2GRggmR1C9GoWu24r+yTY0rXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

b3a957ca

Path C:\Users\Admin\AppData\Local\Temp\b3a957ca
Size 2.0MB
SHA256 56fcb05087bfc5d0590ad85873c7adf8909937152d5a8b345c2f1cf749639613
MD5 721a3572e8a36977e6f723d54313f3e5
SHA1 542d14697e33dba56d580337bf11ccc47f654791
SHA512 aa6dc653424dda325f20454f8390634156417bfbe6130783b7b8f581345ad572e404a5d8dd338a8ba44e7891d73a7b91ca450b2501e9ea03880cf0ed9dc4c136
SSDEEP 24576:HNyuCYPv76sRiIkUcedT2jh7tyJnYwsH/4qKAVt5qTJMJb6s0I5dJ8ty:tyuPUUc5oQHgHG5oqrb5cty
MD5 SHA1 SHA512 SSDEEP

Submit Download

launch.au3

Path C:\Users\Admin\AppData\Local\Temp\launch.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Roaming\huia\TKAIYFGKDGPLW\Setup.exe
Size 111KB
SHA256 56cff82b9e3ee0ed5e74a3e55115e96fd198598be26492cca7b15d9b9023a238
MD5 9f262921a7fbd432c3a694a372caf1b9
SHA1 dfd75a8835a5553d457f4f702c7fe5785227854f
SHA512 cabeaef6132444dc06e7a53332eb58446f7046069044c44b7a27693866a1d66aad7b3ebb5fe7bb79b780548a75b206528f176f5505c574b1c7ad3bcc6fc628b8
SSDEEP 1536:EDDx7Upqno3LbIGHP50vttPTHQaictCH5p5A5stCpnchYq9o:yx7UYno3v50vjzHY5p5A5stC9chYqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1172-16-0x00007FF8F4EE0000-0x00007FF8F5052000-memory.dmp

Download

memory/1172-11-0x00007FF8F4EE0000-0x00007FF8F5052000-memory.dmp

Download

memory/1172-10-0x00007FF8F4EF8000-0x00007FF8F4EF9000-memory.dmp

Download

memory/1172-9-0x00007FF8F4EE0000-0x00007FF8F5052000-memory.dmp

Download

memory/1172-0-0x0000016A1BB40000-0x0000016A1BB41000-memory.dmp

Download

memory/1172-7-0x00007FF8F4EE0000-0x00007FF8F5052000-memory.dmp

Download

memory/1172-1-0x0000000000A10000-0x0000000001022000-memory.dmp

Download

memory/2616-24-0x000000007502E000-0x0000000075030000-memory.dmp

Download

memory/2616-25-0x0000000075020000-0x000000007519B000-memory.dmp

Download

memory/2616-23-0x0000000075020000-0x000000007519B000-memory.dmp

Download

memory/2616-30-0x0000000075020000-0x000000007519B000-memory.dmp

Download

memory/2616-21-0x00007FF903C30000-0x00007FF903E25000-memory.dmp

Download

memory/2616-35-0x000000007502E000-0x0000000075030000-memory.dmp

Download

memory/3848-32-0x00007FF903C30000-0x00007FF903E25000-memory.dmp

Download

memory/3848-34-0x0000000000CB0000-0x0000000000D09000-memory.dmp

Download