lumma | 2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554

Analysis

max time kernel
132s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe
Size 5.6MB
Sample240607-bpy3magb79
SHA256 2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554
MD5 8e6770d2f06f9075e1f7cc6aedfe9f8e
SHA1 522be7c6a506aa3c437eed5b3d1c41f80d58daa2
SHA512 d01ea37cccdcb637def85a572cc3568c68aad16b23b23bcd1193f1fe798c9511655e506b739e58fdd3dba1c3ea6bfdf72a7693dd87400a45f1134e6f9d0126c6
SSDEEP 49152:Sg/aL1k5sblF3buLSdGJ7xCvkuhBIydW5T56r3KrFjNYCQy+crjN5EKPB9X+hvCQ:GJVblbGhSGydgmKruWEq9di
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://stickyyummyskiwffe.shop/api
https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://greentastellesqwm.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4160 set thread context of 1804	4160	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	94

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 1804	4160	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	94
PID 4160 wrote to memory of 1804	4160	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	94
PID 4160 wrote to memory of 1804	4160	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	94
PID 4160 wrote to memory of 1804	4160	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	94
PID 4160 wrote to memory of 1804	4160	2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe	94

C:\Users\Admin\AppData\Local\Temp\2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe
"C:\Users\Admin\AppData\Local\Temp\2501b51b7e7547665a010a629aeed45175d705d0749b2a201c375b31409ef554.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-5-0x0000000000490000-0x00000000004EA000-memory.dmp

Download

memory/1804-9-0x0000000000490000-0x00000000004EA000-memory.dmp

Download

memory/1804-8-0x0000000000490000-0x00000000004EA000-memory.dmp

Download

memory/4160-2-0x00007FF7D84F0000-0x00007FF7D8AE8000-memory.dmp

Download

memory/4160-6-0x00007FF7D84F0000-0x00007FF7D8AE8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads