lumma | f8cab373e5381f3124803a5db9264c100551053d277121aea1086598142b517b

Analysis

max time kernel
134s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

!~L@tEsT_sEtUp_4499_p@ssWord`/Setup.exe
Size

5.5MB
MD5

9d8649afd4141d960b6545998fbc423b
SHA1

3ddd700caaebab0a9d2ed640f235d4b716a505de
SHA256

db2457caa1ccd65e63718b9e28789a12e17bc7a038975fba4f07dcd9f38e7016
SHA512

0a50681e956df3187a718570fd54600365e8ad805b7e291eb5fc6169df47a6d31596f890419aa36a4f3d983b17eb21eae9e2e51cf5755f8b2b890ba87b752da2
SSDEEP

49152:88iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ79z:bihyoPgbInQEHY3N3sNfxLlC1Dxeh

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://declineforntyuekw.shop/api

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

https://roomabolishsnifftwk.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
932	Uhzi.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3632 set thread context of 1516	3632	Setup.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3632	Setup.exe
3632	Setup.exe
1516	more.com
1516	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3632	Setup.exe
1516	more.com

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 1516	3632	Setup.exe	84
PID 3632 wrote to memory of 1516	3632	Setup.exe	84
PID 3632 wrote to memory of 1516	3632	Setup.exe	84
PID 3632 wrote to memory of 1516	3632	Setup.exe	84
PID 1516 wrote to memory of 932	1516	more.com	96
PID 1516 wrote to memory of 932	1516	more.com	96
PID 1516 wrote to memory of 932	1516	more.com	96
PID 1516 wrote to memory of 932	1516	more.com	96
PID 1516 wrote to memory of 932	1516	more.com	96

C:\Users\Admin\AppData\Local\Temp\!~L@tEsT_sEtUp_4499_p@ssWord`\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\!~L@tEsT_sEtUp_4499_p@ssWord`\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    3⤵
    - Loads dropped DLL
    PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\95a7b94b

Filesize
1.8MB

MD5
dcd78d1698e1ef260a8e8e4d4c6445af

SHA1
1dac02c77a6d5039b9f54e81852a3544464b264f

SHA256
577ad2fc630e7b8b81bef15e4da0f20fbee331b11e2815bb085501bb42dd89ae

SHA512
36e676580e419c361415ea1e4dd586eb96d53785d41a4386c4b0ab4e65076cd77a9aa271659f985726d2f5c6e65e98c039c4384e471cf584174a598a99d0fd66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uhzi.au3

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/932-24-0x0000000000AB0000-0x0000000000B07000-memory.dmp

Filesize
348KB

Download
memory/932-22-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

Filesize
2.0MB

Download
memory/932-21-0x0000000000AB0000-0x0000000000B07000-memory.dmp

Filesize
348KB

Download
memory/1516-15-0x00000000745C0000-0x000000007473B000-memory.dmp

Filesize
1.5MB

Download
memory/1516-9-0x00000000745C0000-0x000000007473B000-memory.dmp

Filesize
1.5MB

Download
memory/1516-11-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

Filesize
2.0MB

Download
memory/1516-13-0x00000000745C0000-0x000000007473B000-memory.dmp

Filesize
1.5MB

Download
memory/1516-19-0x00000000745C0000-0x000000007473B000-memory.dmp

Filesize
1.5MB

Download
memory/3632-0-0x00000000745C0000-0x000000007473B000-memory.dmp

Filesize
1.5MB

Download
memory/3632-7-0x00000000745C0000-0x000000007473B000-memory.dmp

Filesize
1.5MB

Download
memory/3632-6-0x00000000745C0000-0x000000007473B000-memory.dmp

Filesize
1.5MB

Download
memory/3632-5-0x00000000745D2000-0x00000000745D4000-memory.dmp

Filesize
8KB

Download
memory/3632-1-0x00007FF9F4710000-0x00007FF9F4905000-memory.dmp

Filesize
2.0MB

Download