lumma | b5f0199b5ff7d77f3596ed2f29e94471cd1245576c2d3db0396b008b8df6d980

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
69b31307eb0cc57620f34a71f7459b50.exe
Size 392KB
Sample240601-cpr5rafb28
SHA256 b5f0199b5ff7d77f3596ed2f29e94471cd1245576c2d3db0396b008b8df6d980
MD5 69b31307eb0cc57620f34a71f7459b50
SHA1 01708c7381abaa7fc74cfad1e0231c6bc8fbb184
SHA512 5b2a9da41da0790b5a68b5d47cc7fcdd504e0eebf31e1697c5f97d7250559f6b9a2d1a46627465b3bffd9005367b1cd132976152c26a840cd00dd83389172e3c
SSDEEP 12288:mKBtUH4tNUf1QaTINIE3wuW5KuerfJOKlYEdQwH2mtqomCY90rpSv6:mAtUHUCf1QXNI6w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
400	69b31307eb0cc57620f34a71f7459b50.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83
PID 400 wrote to memory of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83
PID 400 wrote to memory of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83
PID 400 wrote to memory of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83
PID 400 wrote to memory of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83
PID 400 wrote to memory of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83
PID 400 wrote to memory of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83
PID 400 wrote to memory of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83
PID 400 wrote to memory of 3912	400	69b31307eb0cc57620f34a71f7459b50.exe	83

C:\Users\Admin\AppData\Local\Temp\69b31307eb0cc57620f34a71f7459b50.exe
"C:\Users\Admin\AppData\Local\Temp\69b31307eb0cc57620f34a71f7459b50.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:3912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

d3d9.dll

Path C:\Users\Admin\AppData\Roaming\d3d9.dll
Size 396KB
SHA256 83be49e0419148488f6ed868e72cfbaec9b074be1153b573b699f0527dec9e8a
MD5 abda96ab5ccbd38747be079542466893
SHA1 23a21bafda6d396c9c8438eb23b90eb31f1c563d
SHA512 3277bc3af353f36f747789e45cc579e858e1edde5111290a7fd524e34f39a2925038251a0f6cc0621c8859f090263c754f5f316ec3b82a201fb1dbbbd0413284
SSDEEP 6144:t/QC+428OmPzGmG6Aa6ZHQPFGaqYClsfRk8OV3Ze0ML/W+R0GQz9:lHJ2kG6Aa6FQPF/qYkrdZrGW+Rsz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-0-0x000000007466E000-0x000000007466F000-memory.dmp

Download

memory/400-1-0x0000000000AD0000-0x0000000000B3C000-memory.dmp

Download

memory/400-2-0x00000000013D0000-0x00000000013D6000-memory.dmp

Download

memory/400-13-0x0000000077101000-0x0000000077221000-memory.dmp

Download

memory/400-14-0x0000000074660000-0x0000000074E10000-memory.dmp

Download

memory/400-16-0x0000000074660000-0x0000000074E10000-memory.dmp

Download

memory/3912-12-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/3912-9-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/3912-15-0x0000000000400000-0x0000000000455000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads