lumma | afcbaf1a8324f982443b2c76094a51669ffde2023848bd9b307b9824f4cdf133

Analysis

max time kernel
34s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 657KB
Sample240604-qapmzagf3z
SHA256 afcbaf1a8324f982443b2c76094a51669ffde2023848bd9b307b9824f4cdf133
MD5 42cd9ed9f55ac4b3f32db80d0a2b7a83
SHA1 04714c8a0757cdbbca221da2ebf47c3c3d43a4f0
SHA512 b45f5a7d95df6846e690b575bc9a7dc8aba9bc78e3b854bd7a7e5e62b01edb0d36a6c978b57028ab35928c903644c4ea80fbb01794e213e775767b4af456ea63
SSDEEP 12288:gAWu7pYxcKM52moFJSzHTS7VhugWaK8WLJD4O8ylZLoBZhnP90uREJdpoOL+ScOx:gQtKMQ1JSzHTS7VRXPWLJk4S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
3612	Setup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3612 set thread context of 1680	3612	Setup.exe	83

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 1680	3612	Setup.exe	83
PID 3612 wrote to memory of 1680	3612	Setup.exe	83
PID 3612 wrote to memory of 1680	3612	Setup.exe	83
PID 3612 wrote to memory of 1680	3612	Setup.exe	83
PID 3612 wrote to memory of 1680	3612	Setup.exe	83
PID 3612 wrote to memory of 1680	3612	Setup.exe	83
PID 3612 wrote to memory of 1680	3612	Setup.exe	83
PID 3612 wrote to memory of 1680	3612	Setup.exe	83
PID 3612 wrote to memory of 1680	3612	Setup.exe	83

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

d3d9.dll

Path C:\Users\Admin\AppData\Roaming\d3d9.dll
Size 433KB
SHA256 913230d8cc71bf39bcc872eb85a8c4612c0ce28422929b6ef4f16ed703f4c615
MD5 551b655d55ff94193e9aa96289f51b03
SHA1 d0bba4fa7484ea8d81874deb7149c07513a41cb3
SHA512 ad15cfc1d9646405d40e2b456e995fde1585e39dd29620afd97922cae583aa9f31ac6c1f983ac0db34147e520af9c6827225ee26347290187e3de5c59f23a020
SSDEEP 12288:JBs9ga5I/05c8feU6IjvT8HtTTZBaEh9nR:9sI/0q82U6IjvT4ZTZBp9R
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1680-9-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1680-15-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1680-12-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3612-0-0x000000007432E000-0x000000007432F000-memory.dmp

Download

memory/3612-1-0x00000000005A0000-0x000000000064C000-memory.dmp

Download

memory/3612-2-0x0000000004F80000-0x0000000004F86000-memory.dmp

Download

memory/3612-14-0x0000000077671000-0x0000000077791000-memory.dmp

Download

memory/3612-13-0x0000000074320000-0x0000000074AD0000-memory.dmp

Download

memory/3612-16-0x0000000074320000-0x0000000074AD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads