lumma | 403505c2ab4656f03cc059e5035779ff901a235d6a2738ce4e920e340aa03e3e

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
@!AcTive_Pc$etUp_5567_pAs$W0rd$/Setup.exe
Size 5.5MB
Sample240608-h85g3sbb29
SHA256 db2457caa1ccd65e63718b9e28789a12e17bc7a038975fba4f07dcd9f38e7016
MD5 9d8649afd4141d960b6545998fbc423b
SHA1 3ddd700caaebab0a9d2ed640f235d4b716a505de
SHA512 0a50681e956df3187a718570fd54600365e8ad805b7e291eb5fc6169df47a6d31596f890419aa36a4f3d983b17eb21eae9e2e51cf5755f8b2b890ba87b752da2
SSDEEP 49152:88iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ79z:bihyoPgbInQEHY3N3sNfxLlC1Dxeh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://muggylasergaijynwjk.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
4344	Uhzi.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 392 set thread context of 4232	392	Setup.exe	92

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
392	Setup.exe
392	Setup.exe
4232	more.com
4232	more.com
4232	more.com
4232	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
392	Setup.exe
4232	more.com

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 4232	392	Setup.exe	92
PID 392 wrote to memory of 4232	392	Setup.exe	92
PID 392 wrote to memory of 4232	392	Setup.exe	92
PID 392 wrote to memory of 4232	392	Setup.exe	92
PID 4232 wrote to memory of 4344	4232	more.com	102
PID 4232 wrote to memory of 4344	4232	more.com	102
PID 4232 wrote to memory of 4344	4232	more.com	102
PID 4232 wrote to memory of 4344	4232	more.com	102
PID 4232 wrote to memory of 4344	4232	more.com	102

C:\Users\Admin\AppData\Local\Temp\@!AcTive_Pc$etUp_5567_pAs$W0rd$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\@!AcTive_Pc$etUp_5567_pAs$W0rd$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    3⤵
    - Loads dropped DLL
    PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

3884f50d

Path C:\Users\Admin\AppData\Local\Temp\3884f50d
Size 1.8MB
SHA256 fd2baff8910856a26dc45550d9b118b9553266098cdb16afd06711b8a393d0ea
MD5 11874faa59a94364dc60a4eb85ca0691
SHA1 301113885e4f8d0838a1076a35b24403e61bddb2
SHA512 a0d902d371db9354b1b3275cf790a1b136c508646a1beded78ad192acf4ddd59d60937fb8e1570df2b9d5f9c40a1c96e452fa12219f3c0f32a4699fcb63512c7
SSDEEP 49152:DLTIsPOLEiBRKxtBRJPvwBtiJAE3mI53NAjbgAI2OBz:DLTIkAAAE13NAjMdx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uhzi.au3

Path C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/392-1-0x00007FFB09050000-0x00007FFB09245000-memory.dmp

Download

memory/392-5-0x0000000074AB2000-0x0000000074AB4000-memory.dmp

Download

memory/392-6-0x0000000074AA0000-0x0000000074C1B000-memory.dmp

Download

memory/392-7-0x0000000074AA0000-0x0000000074C1B000-memory.dmp

Download

memory/392-0-0x0000000074AA0000-0x0000000074C1B000-memory.dmp

Download

memory/4232-10-0x0000000074AA0000-0x0000000074C1B000-memory.dmp

Download

memory/4232-13-0x0000000074AA0000-0x0000000074C1B000-memory.dmp

Download

memory/4232-14-0x0000000074AA0000-0x0000000074C1B000-memory.dmp

Download

memory/4232-19-0x0000000074AA0000-0x0000000074C1B000-memory.dmp

Download

memory/4232-11-0x00007FFB09050000-0x00007FFB09245000-memory.dmp

Download

memory/4344-21-0x00007FFB09050000-0x00007FFB09245000-memory.dmp

Download

memory/4344-23-0x00000000003E0000-0x0000000000436000-memory.dmp

Download