lumma | ab6b30a965dd3df9d0160b13a2ad8be1616060951b2cc5b9338a86aa98ba793b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe
Size 9.5MB
Sample240531-fg5bwsff41
SHA256 721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491
MD5 92a37ff5181652c90127a6b0dac3d698
SHA1 4efc3a86cb4b84d4a91c7fe9454ac4de0ef0ba0a
SHA512 053a3452301a9a44b1e3ad19952a6e6d2b4e5a049a8cc5ed7cf1f4f36e8d69ac06319b9415bb41065da782db56a20825f26c7851ce69517d0012cdd90679bb8f
SSDEEP 49152:yVNz/Cxy3i+Brb/T3vO90d7HjmAFd4A64nsfJbbw8nrCi7flLd5exyzApUYpUFKS:aB3i/b77t/exyztFKCzvfjE6yxW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://considerrycurrentyws.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 1060	5104	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	93

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1060	5104	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	93
PID 5104 wrote to memory of 1060	5104	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	93
PID 5104 wrote to memory of 1060	5104	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	93
PID 5104 wrote to memory of 1060	5104	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	93
PID 5104 wrote to memory of 1060	5104	721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe	93

C:\Users\Admin\AppData\Local\Temp\721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe
"C:\Users\Admin\AppData\Local\Temp\721cc82cdd452ec3d79ed556e002ed67d122b384f0eaa09809b389c3fa88b491.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:1060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-5-0x0000000000A90000-0x0000000000AE9000-memory.dmp

Download

memory/1060-8-0x0000000000A90000-0x0000000000AE9000-memory.dmp

Download

memory/1060-9-0x0000000000A90000-0x0000000000AE9000-memory.dmp

Download

memory/1060-10-0x0000000000A90000-0x0000000000AE9000-memory.dmp

Download

memory/5104-2-0x00007FF6B9650000-0x00007FF6BA036000-memory.dmp

Download

memory/5104-6-0x00007FF6B9650000-0x00007FF6BA036000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads