lumma | 5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 545KB
Sample240607-sdbavsbb25
SHA256 5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675
MD5 cc57562764c9ba73ef6bf0f056e12e30
SHA1 97147bf2317534d7908e18ad1139d2bf04e54990
SHA512 ddbe6484f9f4d98b0ad09a017733599bc62da20e02549d1751c11d9f460c8c95ec0d1563cc5c034e6a7b15d36ca8a3febe2cf7a7aae7e138d1e5e4feea42019b
SSDEEP 12288:Hn9kenWw3Pl/BVHtRPoJU4fZ8dzLO1lotdBhp4HEO:HCenjzR4UcSdzLWo94Ht
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://willingyhollowsk.shop/api
https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3104 set thread context of 3652	3104	file.exe	92

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 3684	3104	file.exe	90
PID 3104 wrote to memory of 3684	3104	file.exe	90
PID 3104 wrote to memory of 3684	3104	file.exe	90
PID 3104 wrote to memory of 3724	3104	file.exe	91
PID 3104 wrote to memory of 3724	3104	file.exe	91
PID 3104 wrote to memory of 3724	3104	file.exe	91
PID 3104 wrote to memory of 3652	3104	file.exe	92
PID 3104 wrote to memory of 3652	3104	file.exe	92
PID 3104 wrote to memory of 3652	3104	file.exe	92
PID 3104 wrote to memory of 3652	3104	file.exe	92
PID 3104 wrote to memory of 3652	3104	file.exe	92
PID 3104 wrote to memory of 3652	3104	file.exe	92
PID 3104 wrote to memory of 3652	3104	file.exe	92
PID 3104 wrote to memory of 3652	3104	file.exe	92
PID 3104 wrote to memory of 3652	3104	file.exe	92

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1876 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3104-0-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/3104-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/3104-3-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/3652-2-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3652-5-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3652-6-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3652-7-0x0000000000400000-0x000000000045C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads