lumma | 5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe
Size 545KB
Sample240608-bk4gjsfh33
SHA256 5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675
MD5 cc57562764c9ba73ef6bf0f056e12e30
SHA1 97147bf2317534d7908e18ad1139d2bf04e54990
SHA512 ddbe6484f9f4d98b0ad09a017733599bc62da20e02549d1751c11d9f460c8c95ec0d1563cc5c034e6a7b15d36ca8a3febe2cf7a7aae7e138d1e5e4feea42019b
SSDEEP 12288:Hn9kenWw3Pl/BVHtRPoJU4fZ8dzLO1lotdBhp4HEO:HCenjzR4UcSdzLWo94Ht
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://willingyhollowsk.shop/api
https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1672 set thread context of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84
PID 1672 wrote to memory of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84
PID 1672 wrote to memory of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84
PID 1672 wrote to memory of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84
PID 1672 wrote to memory of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84
PID 1672 wrote to memory of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84
PID 1672 wrote to memory of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84
PID 1672 wrote to memory of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84
PID 1672 wrote to memory of 4880	1672	5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe	84

C:\Users\Admin\AppData\Local\Temp\5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe
"C:\Users\Admin\AppData\Local\Temp\5db086810e23a0a6d59a3cd203a59039a2f99f4914a07e9f60955e5d522a5675.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-0-0x00000000017E0000-0x00000000017E1000-memory.dmp

Download

memory/1672-1-0x00000000017E0000-0x00000000017E1000-memory.dmp

Download

memory/1672-3-0x00000000017E0000-0x00000000017E1000-memory.dmp

Download

memory/4880-2-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4880-5-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4880-6-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4880-7-0x0000000000400000-0x000000000045C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads