lumma | 19b8e97c6cadc4101c27bcf6ad5089da30f52c1472ec612d0cd317ff3ebb978a

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
@!#SetUp_4474_Pa$sW0rd$$/Setup.exe
Size 685.8MB
Sample240603-1nwnjsbb95
SHA256 3428c11896f6ce51a103ed6b334610f5a56d6cd863ca22ecc26a730bc72e2006
MD5 f0a9d34e5ca0b7f68f0b0823fe74f44d
SHA1 c5a73000ffed991100ed08f70969979755c1599d
SHA512 b91574d55390a1662022a0460aeb27768cfff7907cd77101d2e32a886ecf9defd74866e14aa3d652437c547889fc6bcbe52f5aca9f9e880066c2d1aed012e519
SSDEEP 196608:n9HPEk+DVjEW4dnuQNz92bHcTOpCopjQMHRf9r6CwX3FiUsWjS:5b4VgW4d6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://tropicalironexpressiw.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://considerrycurrentyws.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
2880	Setup.exe

Loads dropped DLL 1 IoCs

pid	Process
1712	launch.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2872 set thread context of 4176	2872	Setup.exe	93

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2880	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2872	Setup.exe
2872	Setup.exe
4176	more.com
4176	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2872	Setup.exe
4176	more.com

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2880	2872	Setup.exe	87
PID 2872 wrote to memory of 2880	2872	Setup.exe	87
PID 2872 wrote to memory of 2880	2872	Setup.exe	87
PID 2872 wrote to memory of 4176	2872	Setup.exe	93
PID 2872 wrote to memory of 4176	2872	Setup.exe	93
PID 2872 wrote to memory of 4176	2872	Setup.exe	93
PID 2872 wrote to memory of 4176	2872	Setup.exe	93
PID 4176 wrote to memory of 1712	4176	more.com	96
PID 4176 wrote to memory of 1712	4176	more.com	96
PID 4176 wrote to memory of 1712	4176	more.com	96
PID 4176 wrote to memory of 1712	4176	more.com	96
PID 4176 wrote to memory of 1712	4176	more.com	96

C:\Users\Admin\AppData\Local\Temp\@!#SetUp_4474_Pa$sW0rd$$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\@!#SetUp_4474_Pa$sW0rd$$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Roaming\huia\JQFXXTJFZSRVC\Setup.exe
  C:\Users\Admin\AppData\Roaming\huia\JQFXXTJFZSRVC\Setup.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 836
    3⤵
    - Program crash
    PID:2864
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\launch.au3
    C:\Users\Admin\AppData\Local\Temp\launch.au3
    3⤵
    - Loads dropped DLL
    PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2880 -ip 2880
1⤵
PID:4464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

a62e133e

Path C:\Users\Admin\AppData\Local\Temp\a62e133e
Size 1.9MB
SHA256 46b62c05c4709422bff229cab411c607d4d2bdf3f710de886e121bba17ef2e73
MD5 d941d45e64a1de7c2f397228f88a0933
SHA1 3b19ddc3079432b54588944bd36d2424513a0093
SHA512 72eaa348dcd4f7cfbeab83348667e58fb2ac6497e7329fb43bf11b0b57adb16f47824ebb0584cafda062fcde95859bbceeba13f195f4b4704e924e933074e93b
SSDEEP 49152:W2aL+8oaAO3l2j8LaO+DV0RA8uHYJAxH7wbkgQUuMRh:ZFgAOkjPJDuRoHYJAx0bkgQUuwh
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9f4c0fe

Path C:\Users\Admin\AppData\Local\Temp\a9f4c0fe
Size 2.0MB
SHA256 9c540f326f9cf8f017e085af156ea66b03d19781ab67c0082b40640ee9756ebc
MD5 186417dea27dee39577244d787903e6f
SHA1 d32de648a7497e52611ed9972ad951aec6618c7b
SHA512 a2831cf58812576d39a05a1b553d5ab912237a5efe4ad79ef52e662d40a9fe59c8f064a653b5ce5d9562db4bf22d9a2939b130ac2a546dfcd6b590f624432e5d
SSDEEP 24576:mrXasSm0P63XJ+vHCil9tjEvDUz+HcnHC7CmqwtVIblnX55P8pVc4ICMhyKlGUb0:mbAy+HCi/Kv98n7A213P8pVnUlT5Wn
MD5 SHA1 SHA512 SSDEEP

Submit Download

launch.au3

Path C:\Users\Admin\AppData\Local\Temp\launch.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Roaming\huia\JQFXXTJFZSRVC\Setup.exe
Size 111KB
SHA256 56cff82b9e3ee0ed5e74a3e55115e96fd198598be26492cca7b15d9b9023a238
MD5 9f262921a7fbd432c3a694a372caf1b9
SHA1 dfd75a8835a5553d457f4f702c7fe5785227854f
SHA512 cabeaef6132444dc06e7a53332eb58446f7046069044c44b7a27693866a1d66aad7b3ebb5fe7bb79b780548a75b206528f176f5505c574b1c7ad3bcc6fc628b8
SSDEEP 1536:EDDx7Upqno3LbIGHP50vttPTHQaictCH5p5A5stCpnchYq9o:yx7UYno3v50vjzHY5p5A5stC9chYqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1712-34-0x0000000000A60000-0x0000000000ABB000-memory.dmp

Download

memory/1712-32-0x00007FFB65130000-0x00007FFB65325000-memory.dmp

Download

memory/2872-16-0x00007FFB46A60000-0x00007FFB46BD2000-memory.dmp

Download

memory/2872-9-0x00007FFB46A60000-0x00007FFB46BD2000-memory.dmp

Download

memory/2872-0-0x00000211907B0000-0x00000211907B1000-memory.dmp

Download

memory/2872-10-0x00007FFB46A78000-0x00007FFB46A79000-memory.dmp

Download

memory/2872-11-0x00007FFB46A60000-0x00007FFB46BD2000-memory.dmp

Download

memory/2872-7-0x00007FFB46A60000-0x00007FFB46BD2000-memory.dmp

Download

memory/2872-1-0x0000000000560000-0x0000000000B3B000-memory.dmp

Download

memory/4176-21-0x00007FFB65130000-0x00007FFB65325000-memory.dmp

Download

memory/4176-23-0x0000000075AC0000-0x0000000075C3B000-memory.dmp

Download

memory/4176-24-0x0000000075ACE000-0x0000000075AD0000-memory.dmp

Download

memory/4176-25-0x0000000075AC0000-0x0000000075C3B000-memory.dmp

Download

memory/4176-30-0x0000000075AC0000-0x0000000075C3B000-memory.dmp

Download

memory/4176-36-0x0000000075ACE000-0x0000000075AD0000-memory.dmp

Download