lumma | c3ad620d7f5c73d3688735b00f42078e60dd2e300d263d409937fcf29117b5f7

Analysis

max time kernel
79s
max time network
87s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
07/06/2024, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EASteamProxy.exe
Size 5.4MB
Sample240607-a7eahafg24
SHA256 4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e
MD5 ad2735f096925010a53450cb4178c89e
SHA1 c6d65163c6315a642664f4eaec0fae9528549bfe
SHA512 1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9
SSDEEP 98304:o/zx+riUDpJowboU+XEsumY2XW6jBYeZ1ER:2x+riUDwUj12X1tY5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://specialadventurousw.shop/api
https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
4740	EASteamProxy.exe

Loads dropped DLL 11 IoCs

pid	Process
4740	EASteamProxy.exe
4740	EASteamProxy.exe
4740	EASteamProxy.exe
4740	EASteamProxy.exe
4740	EASteamProxy.exe
4740	EASteamProxy.exe
4740	EASteamProxy.exe
4740	EASteamProxy.exe
4740	EASteamProxy.exe
4740	EASteamProxy.exe
4688	coml.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4740 set thread context of 204	4740	EASteamProxy.exe	74

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4740	EASteamProxy.exe
204	netsh.exe
204	netsh.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4740	EASteamProxy.exe
204	netsh.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4740	4880	EASteamProxy.exe	73
PID 4880 wrote to memory of 4740	4880	EASteamProxy.exe	73
PID 4740 wrote to memory of 204	4740	EASteamProxy.exe	74
PID 4740 wrote to memory of 204	4740	EASteamProxy.exe	74
PID 4740 wrote to memory of 204	4740	EASteamProxy.exe	74
PID 4740 wrote to memory of 204	4740	EASteamProxy.exe	74
PID 204 wrote to memory of 4688	204	netsh.exe	76
PID 204 wrote to memory of 4688	204	netsh.exe	76
PID 204 wrote to memory of 4688	204	netsh.exe	76
PID 204 wrote to memory of 4688	204	netsh.exe	76

C:\Users\Admin\AppData\Local\Temp\EASteamProxy.exe
"C:\Users\Admin\AppData\Local\Temp\EASteamProxy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Roaming\Http_116\EASteamProxy.exe
  C:\Users\Admin\AppData\Roaming\Http_116\EASteamProxy.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\netsh.exe
    C:\Windows\SysWOW64\netsh.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Users\Admin\AppData\Local\Temp\coml.au3
      C:\Users\Admin\AppData\Local\Temp\coml.au3
      4⤵
      Loads dropped DLL
      PID:4688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

cebe482a

Path C:\Users\Admin\AppData\Local\Temp\cebe482a
Size 1.9MB
SHA256 1320463b0c06153280cc98ee4fa3dc6e090f98de46e9348883b88d66538fb094
MD5 5a274b1a2b8dd698c05e30c892c96aa1
SHA1 622be52eb9502f0c9a89002b71cfd0285f2595d3
SHA512 135f8422adb69ef5f6773672825ea5b27c9e081902a5dd07c8889ad700649db2067bc5e0a4b5a46626da12963a667fd051ab12dbc4ccb3770fe26ac321f21eac
SSDEEP 49152:DRTnSHSa22JIzleF/vy42ROK2zA01KPS7:tTSyh/J42Rp2zA0Oo
MD5 SHA1 SHA512 SSDEEP

Submit Download

coml.au3

Path C:\Users\Admin\AppData\Local\Temp\coml.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

EASteamProxy.exe

Path C:\Users\Admin\AppData\Roaming\Http_116\EASteamProxy.exe
Size 3.6MB
SHA256 aaefbdf30ee210fdcc561ad9f3940784f246873102e6bf54dfdcc05f413f0159
MD5 fb8d50303440acfc6fa03ed19b9051ac
SHA1 9377809813267adc957bbb2f908f4512c07ad4f8
SHA512 84bcd25e1dad8b1bc2526872b9cafb498645a4075eeedf2e61888f85619ecdb54486adab13685bfa0b7ea0d70230d9787c0b5c6287ae53b6ef57b027165bafbd
SSDEEP 49152:/tV6Ei/dRfJ0G2rHxMEE3vM/yMjAg9shMVG96uNRGaRwkX2bjzPIXFbNY3YSiWiV:o/zx+riUDpJowboU+XEsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

EASteamProxy.exe

Path C:\Users\Admin\AppData\Roaming\Http_116\EASteamProxy.exe
Size 5.4MB
SHA256 4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e
MD5 ad2735f096925010a53450cb4178c89e
SHA1 c6d65163c6315a642664f4eaec0fae9528549bfe
SHA512 1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9
SSDEEP 98304:o/zx+riUDpJowboU+XEsumY2XW6jBYeZ1ER:2x+riUDwUj12X1tY5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Roaming\Http_116\Qt5Core.dll
Size 6.0MB
SHA256 8f4c72e3c7de1ab5d894ec7813f65c5298ecafc183f31924b44a427433ffca42
MD5 68e600cb754e04557ef716b9ebc93fe4
SHA1 8302ab611e787c312b971ce05935ff6e956faede
SHA512 8bbd7d14b59f01eba7c46a6e8592c037cab73bed1eb0762fc278cf7b81082784e88d777a32f71bc2de128c0186321004bfa4ca68d1bcaa5660694c007219e98e
SSDEEP 98304:cE5jJSnL0VxTOnyJJsv6tWKFdu9Cs/CzYnxqfRgw:cE5NSn0xLJJsv6tWKFdu9CMkexqfRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

cedula.mdb

Path C:\Users\Admin\AppData\Roaming\Http_116\cedula.mdb
Size 1.3MB
SHA256 f45a8f1f3bd261b6dc0ff70a3b1741cc1d6c99d2cb40b722c5891bf5c133f0ed
MD5 c930481811e6a333cd997e915709e79d
SHA1 9df498c6673afa45cfb10c7db516d3e81b6b9d46
SHA512 b3b9e86c5de80d461717a99e57a921cfb00a3277757eafad4270aa24ed406f2629ea192df1c8d3d92e3a5a027c5a6359663ee477288d9aaf6457735f16d9fd23
SSDEEP 24576:3Q4VAipZta4oDwmBGfD1nIAY1u833LRzODC3qGM2M6LWHk:3Q4j+wmgxI1pd60qGrMlHk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Core.dll

Path \Users\Admin\AppData\Roaming\Http_116\Qt5Core.dll
Size 5.9MB
SHA256 b018118e9a2f21fba64e93e2c1bad5822f0b921dd6316188bda17032cc957a5b
MD5 9902f18ad62ed659f9c000976b76911c
SHA1 dc92fa4628beb3ec9e84e02306da0410ee174ee8
SHA512 609b408d944165bcec0274f794de75bb8cb2de7cc112f8bff7d2cd7310ea5d6e72034b2fa22382d08c78d1df92c1f3ee9e94cfbd739765e91a85a67ecea1fca0
SSDEEP 98304:cE5jJSnL0VxTOnyJJsv6tWKFdu9Cs/CzYnxqfRgr:cE5NSn0xLJJsv6tWKFdu9CMkexqfRO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Network.dll

Path \Users\Admin\AppData\Roaming\Http_116\Qt5Network.dll
Size 1.3MB
SHA256 3daf9c17f9d478fa0dfb0973d39e3232543bc4725e74da7aaeedcbe861906855
MD5 22a1241b0b02e00398edb39d46b4dd71
SHA1 0b68f607404eb9017eff7ce3edf4e84b263d6b5b
SHA512 e0fa0048692484b2c7fc0b126c8ccb99365486e73941f2cd81941af8bae34ae14cb0669645f3ea86fa4bc59b2eff184e738bfc5a35b5f90c03a3d23e6411e558
SSDEEP 24576:CNG2bq1mhQpCR4SSUVxiKZivahau3pUlSuMEFR+PoT0l7U:f4hQoRpSUVYKZqIau3pUlNMEePoT0h
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1-x64.dll

Path \Users\Admin\AppData\Roaming\Http_116\libcrypto-1_1-x64.dll
Size 2.7MB
SHA256 52415829d85c06df8724a3d3d00c98f12beabf5d6f3cbad919ec8000841a86e8
MD5 28dea3e780552eb5c53b3b9b1f556628
SHA1 55dccd5b30ce0363e8ebdfeb1cca38d1289748b8
SHA512 19dfe5f71901e43ea34d257f693ae1a36433dbdbcd7c9440d9b0f9eea24de65c4a8fe332f7b88144e1a719a6ba791c2048b4dd3e5b1ed0fdd4c813603ad35112
SSDEEP 49152:KlOh5PuX2I9Rkf5gnQ7duzGuqFCtLQ2IqNPz38JQ41CPwDv3uFfJ:Q2Irkn2Iqt38C41CPwDv3uFfJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1-x64.dll

Path \Users\Admin\AppData\Roaming\Http_116\libssl-1_1-x64.dll
Size 669KB
SHA256 a0e43cbc4a2d8d39f225abd91980001b7b2b5001e8b2b8292537ae39b17b85d1
MD5 4ad03043a32e9a1ef64115fc1ace5787
SHA1 352e0e3a628c8626cff7eed348221e889f6a25c4
SHA512 edfae3660a5f19a9deda0375efba7261d211a74f1d8b6bf1a8440fed4619c4b747aca8301d221fd91230e7af1dab73123707cc6eda90e53eb8b6b80872689ba6
SSDEEP 12288:PcPPRr7K55yAAKDNkk1+cFc+CmRkS9/+wDe1rlXiE4D9u3AG3UQjA5WU2lvz:2N43+cFcmYhXixo7708U2lvz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path \Users\Admin\AppData\Roaming\Http_116\msvcp140.dll
Size 564KB
SHA256 74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823
MD5 1ba6d1cf0508775096f9e121a24e5863
SHA1 df552810d779476610da3c8b956cc921ed6c91ae
SHA512 9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af
SSDEEP 12288:RBSNvy11qsslnxU/1ceqHiNHlOp/2M+UHHZpDLO+r2VhQEKZm+jWodEEVAdm:RBSDOFQEKZm+jWodEE2dm
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140_1.dll

Path \Users\Admin\AppData\Roaming\Http_116\msvcp140_1.dll
Size 34KB
SHA256 a3a1199de32bbbc8318ec33e2e1ce556247d012851e4b367fe853a51e74ce4ee
MD5 69d96e09a54fbc5cf92a0e084ab33856
SHA1 b4629d51b5c4d8d78ccb3370b40a850f735b8949
SHA512 2087827137c473cdbec87789361ed34fad88c9fe80ef86b54e72aea891d91af50b17b7a603f9ae2060b3089ce9966fad6d7fbe22dee980c07ed491a75503f2cf
SSDEEP 384:z1vZLMtUYqOoKFYpWcm5gW/ki0pSt+eB+Hj+R9zUkUTRtHRN7SoHR9zui5TJ:zpCtzqOjKYWi0QKHji9zSRtnx9zJTJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

steam_api64.dll

Path \Users\Admin\AppData\Roaming\Http_116\steam_api64.dll
Size 291KB
SHA256 1db3fd414039d3e5815a5721925dd2e0a3a9f2549603c6cab7c49b84966a1af3
MD5 6b4ab6e60364c55f18a56a39021b74a6
SHA1 39cac2889d8ca497ee0d8434fc9f6966f18fa336
SHA512 c08de8c6e331d13dfe868ab340e41552fc49123a9f782a5a63b95795d5d979e68b5a6ab171153978679c0791dc3e3809c883471a05864041ce60b240ccdd4c21
SSDEEP 3072:504VEQ2u/niy9UVLCe9ZqdrP+VXvv+sJYB2RHKBi65lhTbCc+hnvvEyP7yq+uei1:QZu/i874ZcrMv2cRh7yqO2CPLHxYq8/B
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path \Users\Admin\AppData\Roaming\Http_116\vcruntime140.dll
Size 106KB
SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
MD5 49c96cecda5c6c660a107d378fdfc3d4
SHA1 00149b7a66723e3f0310f139489fe172f818ca8e
SHA512 e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
SSDEEP 1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path \Users\Admin\AppData\Roaming\Http_116\vcruntime140_1.dll
Size 48KB
SHA256 6fd366a691ed68430bcd0a3de3d8d19a0cb2102952bfc140bbef4354ed082c47
MD5 cf0a1c4776ffe23ada5e570fc36e39fe
SHA1 2050fadecc11550ad9bde0b542bcf87e19d37f1a
SHA512 d95cd98d22ca048d0fc5bca551c9db13d6fa705f6af120bbbb621cf2b30284bfdc7320d0a819bb26dab1e0a46253cc311a370bed4ef72ecb60c69791ed720168
SSDEEP 768:a0Q4HUcGJZekJSam1BbuBSYcCZbiLzlSHji9z4GwZHji9znwT:afnDex5izbiLzlE+z4Gwl+zwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/204-40-0x00007FFA80D50000-0x00007FFA80F2B000-memory.dmp

Download

memory/4688-44-0x00007FFA80D50000-0x00007FFA80F2B000-memory.dmp

Download

memory/4688-45-0x0000000000940000-0x000000000099B000-memory.dmp

Download

memory/4688-49-0x0000000000940000-0x000000000099B000-memory.dmp

Download

memory/4740-37-0x00007FFA73110000-0x00007FFA7327A000-memory.dmp

Download

memory/4740-36-0x00007FFA73110000-0x00007FFA7327A000-memory.dmp

Download

memory/4880-0-0x00007FF6EE63E000-0x00007FF6EE642000-memory.dmp

Download

memory/4880-1-0x00007FFA73110000-0x00007FFA7327A000-memory.dmp

Download