lumma | ab6b30a965dd3df9d0160b13a2ad8be1616060951b2cc5b9338a86aa98ba793b

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe
Size 9.5MB
Sample240531-dcbsnsdg38
SHA256 721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491
MD5 92a37ff5181652c90127a6b0dac3d698
SHA1 4efc3a86cb4b84d4a91c7fe9454ac4de0ef0ba0a
SHA512 053a3452301a9a44b1e3ad19952a6e6d2b4e5a049a8cc5ed7cf1f4f36e8d69ac06319b9415bb41065da782db56a20825f26c7851ce69517d0012cdd90679bb8f
SSDEEP 49152:yVNz/Cxy3i+Brb/T3vO90d7HjmAFd4A64nsfJbbw8nrCi7flLd5exyzApUYpUFKS:aB3i/b77t/exyztFKCzvfjE6yxW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://considerrycurrentyws.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 3724	1792	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	91

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3724	1792	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	91
PID 1792 wrote to memory of 3724	1792	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	91
PID 1792 wrote to memory of 3724	1792	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	91
PID 1792 wrote to memory of 3724	1792	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	91
PID 1792 wrote to memory of 3724	1792	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	91

C:\Users\Admin\AppData\Local\Temp\721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe
"C:\Users\Admin\AppData\Local\Temp\721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:3724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-4-0x00007FF7DD240000-0x00007FF7DDC26000-memory.dmp

Download

memory/1792-6-0x00007FF7DD240000-0x00007FF7DDC26000-memory.dmp

Download

memory/3724-5-0x00000000008C0000-0x0000000000919000-memory.dmp

Download

memory/3724-8-0x00000000008C0000-0x0000000000919000-memory.dmp

Download

memory/3724-9-0x00000000008C0000-0x0000000000919000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads