Overview

overview

10

Static

static

3

#!~#0PeN_5...re.dll

windows7-x64

1

#!~#0PeN_5...re.dll

windows10-2004-x64

1

#!~#0PeN_5...rk.dll

windows7-x64

1

#!~#0PeN_5...rk.dll

windows10-2004-x64

1

#!~#0PeN_5...up.exe

windows7-x64

7

#!~#0PeN_5...up.exe

windows10-2004-x64

10

#!~#0PeN_5...te.ppt

windows7-x64

1

#!~#0PeN_5...te.ppt

windows10-2004-x64

1

#!~#0PeN_5...64.dll

windows7-x64

1

#!~#0PeN_5...64.dll

windows10-2004-x64

1

#!~#0PeN_5...64.dll

windows7-x64

1

#!~#0PeN_5...64.dll

windows10-2004-x64

1

#!~#0PeN_5...40.dll

windows7-x64

1

#!~#0PeN_5...40.dll

windows10-2004-x64

1

#!~#0PeN_5..._1.dll

windows7-x64

1

#!~#0PeN_5..._1.dll

windows10-2004-x64

1

#!~#0PeN_5...se.htm

windows7-x64

1

#!~#0PeN_5...se.htm

windows10-2004-x64

1

#!~#0PeN_5...64.dll

windows7-x64

1

#!~#0PeN_5...64.dll

windows10-2004-x64

1

#!~#0PeN_5...40.dll

windows7-x64

1

#!~#0PeN_5...40.dll

windows10-2004-x64

1

#!~#0PeN_5..._1.dll

windows7-x64

1

#!~#0PeN_5..._1.dll

windows10-2004-x64

1

#!~#0PeN_5...ib.dll

windows7-x64

1

#!~#0PeN_5...ib.dll

windows10-2004-x64

1

#!~#0PeN_5...er.exe

windows7-x64

1

#!~#0PeN_5...er.exe

windows10-2004-x64

1

#!~#0PeN_5...or.exe

windows7-x64

1

#!~#0PeN_5...or.exe

windows10-2004-x64

1

#!~#0PeN_5...1].exe

windows7-x64

1

#!~#0PeN_5...1].exe

windows10-2004-x64

1

Analysis

  • max time kernel
    134s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 21:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    #!~#0PeN_5098_Pa$$WOrd~!$/Setup.exe
  • Size 5.4MB
  • Sample240603-1pcxtsab71
  • SHA256 4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lummastealer

Malware Config

Extracted

Family

  • lumma

C2

  • https://palacetilecomplew.shop/api

  • https://museumtespaceorsp.shop/api

  • https://buttockdecarderwiso.shop/api

  • https://averageaattractiionsl.shop/api

  • https://femininiespywageg.shop/api

  • https://employhabragaomlsp.shop/api

  • https://stalfbaclcalorieeis.shop/api

  • https://civilianurinedtsraov.shop/api

  • https://roomabolishsnifftwk.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\#!~#0PeN_5098_Pa$$WOrd~!$\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\#!~#0PeN_5098_Pa$$WOrd~!$\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
        C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
        3⤵
        • Loads dropped DLL
        PID:1300

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uhzi.au3
        • Path C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
        • Size 872KB
        • SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        a1ce29fb
        • Path C:\Users\Admin\AppData\Local\Temp\a1ce29fb
        • Size 1.8MB
        • SHA256 4d5071a726e889dcd137918f7a01ab3120685159c2edc6eff993b24b0c1b127c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1300-31-0x0000000000E00000-0x0000000000E59000-memory.dmp
        Download

        memory/1300-29-0x00007FFF68BB0000-0x00007FFF68DA5000-memory.dmp
        Download

        memory/1300-28-0x0000000000E00000-0x0000000000E59000-memory.dmp
        Download

        memory/2320-26-0x00000000752E0000-0x000000007545B000-memory.dmp
        Download

        memory/2320-20-0x00000000752EE000-0x00000000752F0000-memory.dmp
        Download

        memory/2320-19-0x00000000752E0000-0x000000007545B000-memory.dmp
        Download

        memory/2320-21-0x00000000752E0000-0x000000007545B000-memory.dmp
        Download

        memory/2320-17-0x00007FFF68BB0000-0x00007FFF68DA5000-memory.dmp
        Download

        memory/2320-32-0x00000000752EE000-0x00000000752F0000-memory.dmp
        Download

        memory/2716-0-0x00007FFF4A440000-0x00007FFF4A5B2000-memory.dmp
        Download

        memory/2716-14-0x00007FFF4A440000-0x00007FFF4A5B2000-memory.dmp
        Download

        memory/2716-13-0x00007FFF4A440000-0x00007FFF4A5B2000-memory.dmp
        Download

        memory/2716-12-0x00007FFF4A458000-0x00007FFF4A459000-memory.dmp
        Download