lumma | 403505c2ab4656f03cc059e5035779ff901a235d6a2738ce4e920e340aa03e3e

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
@!AcTive_Pc$etUp_5567_pAs$W0rd$/Setup.exe
Size 5.5MB
Sample240607-mrnv8aga28
SHA256 db2457caa1ccd65e63718b9e28789a12e17bc7a038975fba4f07dcd9f38e7016
MD5 9d8649afd4141d960b6545998fbc423b
SHA1 3ddd700caaebab0a9d2ed640f235d4b716a505de
SHA512 0a50681e956df3187a718570fd54600365e8ad805b7e291eb5fc6169df47a6d31596f890419aa36a4f3d983b17eb21eae9e2e51cf5755f8b2b890ba87b752da2
SSDEEP 49152:88iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ79z:bihyoPgbInQEHY3N3sNfxLlC1Dxeh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://muggylasergaijynwjk.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
1512	Uhzi.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 4580	2212	Setup.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2212	Setup.exe
2212	Setup.exe
4580	more.com
4580	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2212	Setup.exe
4580	more.com

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 4580	2212	Setup.exe	86
PID 2212 wrote to memory of 4580	2212	Setup.exe	86
PID 2212 wrote to memory of 4580	2212	Setup.exe	86
PID 2212 wrote to memory of 4580	2212	Setup.exe	86
PID 4580 wrote to memory of 1512	4580	more.com	98
PID 4580 wrote to memory of 1512	4580	more.com	98
PID 4580 wrote to memory of 1512	4580	more.com	98
PID 4580 wrote to memory of 1512	4580	more.com	98
PID 4580 wrote to memory of 1512	4580	more.com	98

C:\Users\Admin\AppData\Local\Temp\@!AcTive_Pc$etUp_5567_pAs$W0rd$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\@!AcTive_Pc$etUp_5567_pAs$W0rd$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    3⤵
    - Loads dropped DLL
    PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Uhzi.au3

Path C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

a30abbd2

Path C:\Users\Admin\AppData\Local\Temp\a30abbd2
Size 1.8MB
SHA256 89464070623cde47c2864ad8165bce6ade0e7668cd850b822d3df105a6accb2c
MD5 d6110fd0c8ef5a1af626e849e095e804
SHA1 5f6611936e92391d225a1456e288aec9bb3a5bdb
SHA512 665b3affe2e1aadf14be23254e91105783a02bf346f3b08e406fde4de94630d87b92e2f07d4459ab47dc40cb73925558d056349d7f5208ecfd2cdd12b441bbe8
SSDEEP 49152:RfYpjRr/sJB3GWNMLqbuTP/FF/CBd7Z2DcGaBb0tAX:RfYpjRr/sztML2WFF/CBd7+ob7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1512-23-0x0000000000030000-0x0000000000086000-memory.dmp

Download

memory/1512-21-0x00007FFA49210000-0x00007FFA49405000-memory.dmp

Download

memory/2212-6-0x0000000074B10000-0x0000000074C8B000-memory.dmp

Download

memory/2212-7-0x0000000074B10000-0x0000000074C8B000-memory.dmp

Download

memory/2212-0-0x0000000074B10000-0x0000000074C8B000-memory.dmp

Download

memory/2212-5-0x0000000074B22000-0x0000000074B24000-memory.dmp

Download

memory/2212-1-0x00007FFA49210000-0x00007FFA49405000-memory.dmp

Download

memory/4580-9-0x0000000074B10000-0x0000000074C8B000-memory.dmp

Download

memory/4580-11-0x00007FFA49210000-0x00007FFA49405000-memory.dmp

Download

memory/4580-13-0x0000000074B10000-0x0000000074C8B000-memory.dmp

Download

memory/4580-14-0x0000000074B10000-0x0000000074C8B000-memory.dmp

Download

memory/4580-19-0x0000000074B10000-0x0000000074C8B000-memory.dmp

Download