lumma | 31901770406ed3dd08a35be44dcb2e7982354668d42da270a29da247297736f6

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The Setup Files/Setup.exe
Size 5.4MB
Sample240607-t6kknscc22
SHA256 4e775b5fafb4e6d89a4694f8694d2b8b540534bd4a52ff42f70095f1c929160e
MD5 ad2735f096925010a53450cb4178c89e
SHA1 c6d65163c6315a642664f4eaec0fae9528549bfe
SHA512 1868b22a7c5cba89545b06f010c09c5418b3d86039099d681eee9567c47208fdba3b89c6251cf03c964c58c805280d45ba9c3533125f6bd3e0bc067477e03ab9
SSDEEP 98304:o/zx+riUDpJowboU+XEsumY2XW6jBYeZ1ER:2x+riUDwUj12X1tY5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://makketakecoincidejs.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
4964	xdd.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4144 set thread context of 1944	4144	Setup.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4144	Setup.exe
4144	Setup.exe
1944	comp.exe
1944	comp.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4144	Setup.exe
1944	comp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1944	4144	Setup.exe	83
PID 4144 wrote to memory of 1944	4144	Setup.exe	83
PID 4144 wrote to memory of 1944	4144	Setup.exe	83
PID 4144 wrote to memory of 1944	4144	Setup.exe	83
PID 1944 wrote to memory of 4964	1944	comp.exe	92
PID 1944 wrote to memory of 4964	1944	comp.exe	92
PID 1944 wrote to memory of 4964	1944	comp.exe	92
PID 1944 wrote to memory of 4964	1944	comp.exe	92
PID 1944 wrote to memory of 4964	1944	comp.exe	92

C:\Users\Admin\AppData\Local\Temp\The Setup Files\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\The Setup Files\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\comp.exe
  C:\Windows\SysWOW64\comp.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\xdd.au3
    C:\Users\Admin\AppData\Local\Temp\xdd.au3
    3⤵
    - Loads dropped DLL
    PID:4964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

83d73a0d

Path C:\Users\Admin\AppData\Local\Temp\83d73a0d
Size 1.8MB
SHA256 2bb52337e2c5b7d7c9a986eb147b6d97a625ec2998f3a6a3812815bb3c3d9a83
MD5 6feda99aba7512ead2ff02f166bebcf0
SHA1 5842b664892e1879cadae9780ae1d6aaecd27658
SHA512 ca53209be632700b8b33390d0a9c7211e2bbdae239fd3225f01e1fa374e6ad74ad5b7be29411d2b8f7fa38eb4c9bd245b44377e587a8ef08f283bb56b37d51c1
SSDEEP 49152:wFHuXVeRJVTOu65YeM1thphnOMH1RFzukxiDAmpPcJYZ6gVsWMSzbN:y8eJ1jRZucacJYZ6giWMmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

xdd.au3

Path C:\Users\Admin\AppData\Local\Temp\xdd.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

xdd.au3

Path C:\Users\Admin\AppData\Local\Temp\xdd.au3
Size 448KB
SHA256 7005bb5f6e3710a888cb03fa55ed2032cc52b110375bdef44eea00de9c994353
MD5 198c2107147f05ed821c761617e3cfcb
SHA1 42f8af1e1a5ef0b08c09bccf3713fd13b2edaae0
SHA512 2be55ce9c78cdef7a93a14b913dd1b4e07fae46259f1f7387fb273a9bb580b2809f72a6804e52172b3d8901c746d25799619cdd75aa0b348d406d8f7d5b8dc98
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN0:6T3E53Myyzl09
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1944-21-0x0000000075670000-0x00000000757EB000-memory.dmp

Download

memory/1944-17-0x00007FF85C470000-0x00007FF85C665000-memory.dmp

Download

memory/1944-20-0x000000007567E000-0x0000000075680000-memory.dmp

Download

memory/1944-19-0x0000000075670000-0x00000000757EB000-memory.dmp

Download

memory/1944-26-0x0000000075670000-0x00000000757EB000-memory.dmp

Download

memory/1944-31-0x000000007567E000-0x0000000075680000-memory.dmp

Download

memory/4144-14-0x00007FF83D890000-0x00007FF83DA02000-memory.dmp

Download

memory/4144-0-0x00007FF83D890000-0x00007FF83DA02000-memory.dmp

Download

memory/4144-12-0x00007FF83D8A8000-0x00007FF83D8A9000-memory.dmp

Download

memory/4144-13-0x00007FF83D890000-0x00007FF83DA02000-memory.dmp

Download

memory/4964-28-0x00007FF85C470000-0x00007FF85C665000-memory.dmp

Download

memory/4964-30-0x0000000000990000-0x00000000009E9000-memory.dmp

Download