lumma | 2ce94017785dc8db14faf8cd5769a2b854a8ef259ecc0e8eeb27bab230b0f727

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
#!~#0PEN_6092_P@$$WORd~!$/Setup.exe
Size 686.0MB
Sample240603-1n1bqsbb98
SHA256 c279f9d80a89a46aa4719cd2ad388ed39f88949c457deff47ba3b1520991fdf2
MD5 c3d6187447293dda0ee6610d3bb77f5f
SHA1 828e7fe748f0d32175195e8c19a52d31af748455
SHA512 bed12fe4c4604a6526c1950f197894947b291fbeeb1902401ae7527705b3503e86354123de73edbc59b3e3ef6992a0955e3f1a74eb0f66e5caf2b7eb143d5e9b
SSDEEP 196608:P9HPEP3fd6zGRgRRarrtck0ef73viP/KSt6u+b2htX6/O:Bk3fdjRyarrz0efo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://tropicalironexpressiw.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://considerrycurrentyws.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
1448	Setup.exe

Loads dropped DLL 1 IoCs

pid	Process
3000	launch.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 4492	1032	Setup.exe	96

Program crash 1 IoCs

pid	pid_target	Process	procid_target
376	1448	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1032	Setup.exe
1032	Setup.exe
4492	more.com
4492	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1032	Setup.exe
4492	more.com

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1448	1032	Setup.exe	89
PID 1032 wrote to memory of 1448	1032	Setup.exe	89
PID 1032 wrote to memory of 1448	1032	Setup.exe	89
PID 1032 wrote to memory of 4492	1032	Setup.exe	96
PID 1032 wrote to memory of 4492	1032	Setup.exe	96
PID 1032 wrote to memory of 4492	1032	Setup.exe	96
PID 1032 wrote to memory of 4492	1032	Setup.exe	96
PID 4492 wrote to memory of 3000	4492	more.com	100
PID 4492 wrote to memory of 3000	4492	more.com	100
PID 4492 wrote to memory of 3000	4492	more.com	100
PID 4492 wrote to memory of 3000	4492	more.com	100
PID 4492 wrote to memory of 3000	4492	more.com	100

C:\Users\Admin\AppData\Local\Temp\#!~#0PEN_6092_P@$$WORd~!$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\#!~#0PEN_6092_P@$$WORd~!$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Roaming\huia\MIXLBNIDKHIB\Setup.exe
  C:\Users\Admin\AppData\Roaming\huia\MIXLBNIDKHIB\Setup.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 868
    3⤵
    - Program crash
    PID:376
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Users\Admin\AppData\Local\Temp\launch.au3
    C:\Users\Admin\AppData\Local\Temp\launch.au3
    3⤵
    - Loads dropped DLL
    PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1448 -ip 1448
1⤵
PID:880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

c2e5691d

Path C:\Users\Admin\AppData\Local\Temp\c2e5691d
Size 2.1MB
SHA256 66915043439043c6e225e5a20408dae22e853721176625a60561b8dc96e32faa
MD5 37fe1e953a5c65c47a9dcd02b30172f6
SHA1 b891e2885076d1d4605519d427f2982c847298e2
SHA512 7acf61e76d9dcf1c08e9e4e492bcf86c2ce49988a25521735c0780f22930195cd01ea2b9e4cf8b730ce69bac27d0c093b0a25253feb14a74d90c01432329badb
SSDEEP 49152:MZfxvPtS7u4qtLd8DlyNRQTgyWCR1C9rsxdEsvobSt7Uqj+w411ovy9rLFY8XPDn:MZftP6S2GRggmR1C9GoWu24r+yTY0rXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

c5d18eea

Path C:\Users\Admin\AppData\Local\Temp\c5d18eea
Size 2.0MB
SHA256 428209cb83d6afc223cb0b64e4e5ed4ec41649ed048b752293f25c23bf687c16
MD5 348de29fa28f596c1a2dac84293350e2
SHA1 dd53bb1f57ed47b2c7897f45d05663f0b466e4a7
SHA512 9532f5c5ff3bbb08d5a911ea0ad6497a7d9cc6ae882cade663c9e59ca6703a0c86b8db183a3dbfe70e73ea9ea081b657b7161621cfc44c808c1bc252a1cfced3
SSDEEP 49152:6wejVd10riCKEdRbjqntSVv5n95V74Sm0XKvHZ:H+CBzkaX25
MD5 SHA1 SHA512 SSDEEP

Submit Download

launch.au3

Path C:\Users\Admin\AppData\Local\Temp\launch.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Roaming\huia\MIXLBNIDKHIB\Setup.exe
Size 111KB
SHA256 56cff82b9e3ee0ed5e74a3e55115e96fd198598be26492cca7b15d9b9023a238
MD5 9f262921a7fbd432c3a694a372caf1b9
SHA1 dfd75a8835a5553d457f4f702c7fe5785227854f
SHA512 cabeaef6132444dc06e7a53332eb58446f7046069044c44b7a27693866a1d66aad7b3ebb5fe7bb79b780548a75b206528f176f5505c574b1c7ad3bcc6fc628b8
SSDEEP 1536:EDDx7Upqno3LbIGHP50vttPTHQaictCH5p5A5stCpnchYq9o:yx7UYno3v50vjzHY5p5A5stC9chYqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1032-16-0x00007FFEE9860000-0x00007FFEE99D2000-memory.dmp

Download

memory/1032-1-0x00000000008F0000-0x0000000000F02000-memory.dmp

Download

memory/1032-11-0x00007FFEE9860000-0x00007FFEE99D2000-memory.dmp

Download

memory/1032-10-0x00007FFEE9878000-0x00007FFEE9879000-memory.dmp

Download

memory/1032-0-0x0000022987DB0000-0x0000022987DB1000-memory.dmp

Download

memory/1032-7-0x00007FFEE9860000-0x00007FFEE99D2000-memory.dmp

Download

memory/1032-9-0x00007FFEE9860000-0x00007FFEE99D2000-memory.dmp

Download

memory/3000-34-0x0000000000740000-0x0000000000799000-memory.dmp

Download

memory/3000-32-0x00007FFF07B10000-0x00007FFF07D05000-memory.dmp

Download

memory/4492-23-0x0000000074C10000-0x0000000074D8B000-memory.dmp

Download

memory/4492-30-0x0000000074C10000-0x0000000074D8B000-memory.dmp

Download

memory/4492-25-0x0000000074C10000-0x0000000074D8B000-memory.dmp

Download

memory/4492-24-0x0000000074C1E000-0x0000000074C20000-memory.dmp

Download

memory/4492-21-0x00007FFF07B10000-0x00007FFF07D05000-memory.dmp

Download

memory/4492-36-0x0000000074C1E000-0x0000000074C20000-memory.dmp

Download