lumma | fffc8a6bb28e257d30ad521d8fad621054c48907880471a94ac65eebd4d9b678

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 19.9MB
Sample240603-j2pnqaaa76
SHA256 fffc8a6bb28e257d30ad521d8fad621054c48907880471a94ac65eebd4d9b678
MD5 8267049168fcc593bcbe6936e4f7ec8f
SHA1 34ee5b3997972e471d2c9cb18d51ec943affe073
SHA512 ae3624ab8147db9262da30b95b0dbeff6fa965714feddccd8ab2c8ad1e819fbe7379351d51216c61ac09273c01d78668a4816217bb5bd401842ec8444fa38f09
SSDEEP 98304:PCOpkq8zswzY1DvrRZ2yHJn/BFxIhpCxPI1HNkJpIefM7DoOEoj0FnTKG2myxBWH:kzswz4vrRZ2OZFxPGoIefM7DorMN8RB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://tigerrfunerlariro.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://considerrycurrentyws.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3992 set thread context of 2388	3992	file.exe	94

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2388	3992	file.exe	94
PID 3992 wrote to memory of 2388	3992	file.exe	94
PID 3992 wrote to memory of 2388	3992	file.exe	94
PID 3992 wrote to memory of 2388	3992	file.exe	94
PID 3992 wrote to memory of 2388	3992	file.exe	94

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-5-0x0000000000C20000-0x0000000000C76000-memory.dmp

Download

memory/2388-8-0x0000000000C20000-0x0000000000C76000-memory.dmp

Download

memory/2388-9-0x0000000000C20000-0x0000000000C76000-memory.dmp

Download

memory/2388-10-0x0000000000C20000-0x0000000000C76000-memory.dmp

Download

memory/3992-4-0x00007FF657E60000-0x00007FF6592B8000-memory.dmp

Download

memory/3992-6-0x00007FF657E60000-0x00007FF6592B8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads