lumma | 97767dcc0522540da20c9f3e68de20f75779e326697e1c0e201be9ff57154484

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a09ef83719952de3da58e3af375af664.exe
Size 1.2MB
Sample240603-rf4vhsad44
SHA256 97767dcc0522540da20c9f3e68de20f75779e326697e1c0e201be9ff57154484
MD5 a09ef83719952de3da58e3af375af664
SHA1 8cb249125770b65dd0f8e4bc575a9ed9fd64e1dd
SHA512 0de74d2b7dac3af23680d89da186f495f4eaa3722b7966132e5f2c9cbe7d0f0f80da1c90c0a695fe82c917ad7190fb3696d257d7d3841b4cd7276b2034594fd9
SSDEEP 24576:e35j/uUTwSckwIFW2Fst78WWcSeD41XSVTahZ:e35JwSZwIFW2a1WFe81XS5u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://considerrycurrentyws.shop/api
https://horsedwollfedrwos.shop/api
https://patternapplauderw.shop/api
https://understanndtytonyguw.shop/api
https://messtimetabledkolvk.shop/api
https://detailbaconroollyws.shop/api
https://deprivedrinkyfaiir.shop/api
https://relaxtionflouwerwi.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1444 set thread context of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	1444	WerFault.exe	83

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4384	1444	a09ef83719952de3da58e3af375af664.exe	84
PID 1444 wrote to memory of 4384	1444	a09ef83719952de3da58e3af375af664.exe	84
PID 1444 wrote to memory of 4384	1444	a09ef83719952de3da58e3af375af664.exe	84
PID 1444 wrote to memory of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85
PID 1444 wrote to memory of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85
PID 1444 wrote to memory of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85
PID 1444 wrote to memory of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85
PID 1444 wrote to memory of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85
PID 1444 wrote to memory of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85
PID 1444 wrote to memory of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85
PID 1444 wrote to memory of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85
PID 1444 wrote to memory of 1564	1444	a09ef83719952de3da58e3af375af664.exe	85

C:\Users\Admin\AppData\Local\Temp\a09ef83719952de3da58e3af375af664.exe
"C:\Users\Admin\AppData\Local\Temp\a09ef83719952de3da58e3af375af664.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 244
  2⤵
  - Program crash
  PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1444 -ip 1444
1⤵
PID:1360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-0-0x0000000000E80000-0x0000000000E81000-memory.dmp

Download

memory/1444-1-0x0000000000E80000-0x0000000000E81000-memory.dmp

Download

memory/1444-3-0x0000000000E80000-0x0000000000E81000-memory.dmp

Download

memory/1564-2-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1564-5-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/1564-6-0x0000000000400000-0x0000000000459000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads