lumma | 3235c59c8cb7e035f7078f16766a566fd6bcf0e20d7f389e704e1e9084503e99

Analysis

max time kernel
133s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
31/05/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup_v1.8.6.exe
Size 27.2MB
Sample240531-ppaa6agh7x
SHA256 e8118821f5e862fb520e93d83b4e324812a07a63c54333755f21d09d812c16a4
MD5 01297122a92042b4c7fdd0a465d0da65
SHA1 9cae1551d1b0e166d3bf585294745deb806c78fb
SHA512 099ea5945eb114295f234adce0f8e620ebaa8fe2755d6a72e1eadcee4a46ff3c0b69b362a64ed532889f1f81b15bdd10c826e03eba1c3b6e50874f336ed50024
SSDEEP 196608:DkV5DmQWYTp7455fM/FE5uUEePptQgUYC+L:47FWY14TQ1jQt/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://phobicgiddyfivverr.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://considerrycurrentyws.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3764 set thread context of 1348	3764	Setup_v1.8.6.exe	72

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 1348	3764	Setup_v1.8.6.exe	72
PID 3764 wrote to memory of 1348	3764	Setup_v1.8.6.exe	72
PID 3764 wrote to memory of 1348	3764	Setup_v1.8.6.exe	72
PID 3764 wrote to memory of 1348	3764	Setup_v1.8.6.exe	72
PID 3764 wrote to memory of 1348	3764	Setup_v1.8.6.exe	72

C:\Users\Admin\AppData\Local\Temp\Setup_v1.8.6.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_v1.8.6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:1348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1348-5-0x0000000000700000-0x0000000000758000-memory.dmp

Download

memory/1348-8-0x0000000000700000-0x0000000000758000-memory.dmp

Download

memory/1348-9-0x0000000000700000-0x0000000000758000-memory.dmp

Download

memory/3764-2-0x00007FF7B2D60000-0x00007FF7B4900000-memory.dmp

Download

memory/3764-6-0x00007FF7B2D60000-0x00007FF7B4900000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads