lumma | 4d78a755479061e805e7f1c6049f67805bcca95ef3397ca87c2c56897d867d75

Resubmissions

08/06/2024, 18:39

240608-xak34sfc9610

08/06/2024, 18:37

240608-w9q8qsfc8610

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BLT Updater v.1.12.exe
Size 541KB
Sample240608-w9q8qsfc86
SHA256 4d78a755479061e805e7f1c6049f67805bcca95ef3397ca87c2c56897d867d75
MD5 edf389aa1cdec3f8c41eb38464bd722e
SHA1 45e483d92704c4ce1831a81365d99410302df697
SHA512 4d2a554392d1ce1340f9ce5ee8aa62a2bc1fe5fbdef3e7b8019944fcb91f672ab6ee3e5e477d2df16154bc0d0b39589895534e3c261ac8140dc4f13a33350f07
SSDEEP 6144:ohyqbQu7OEY34OHy82NafpYG8X8JAVBq86xdSO5IPu6voarczAGhFHTDdCzYDwwr:O9iEY/vpiX48OSOIoqczRzAewwS7ZeEO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://liabiliytshareodlkv.shop/api
https://notoriousdcellkw.shop/api
https://conferencefreckewl.shop/api
https://flourhishdiscovrw.shop/api
https://landdumpycolorwskfw.shop/api
https://ohfantasyproclaiwlo.shop/api
https://parallelmercywksoffw.shop/api
https://barebrilliancedkoso.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4868 set thread context of 3716	4868	BLT Updater v.1.12.exe	91

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 3716	4868	BLT Updater v.1.12.exe	91
PID 4868 wrote to memory of 3716	4868	BLT Updater v.1.12.exe	91
PID 4868 wrote to memory of 3716	4868	BLT Updater v.1.12.exe	91
PID 4868 wrote to memory of 3716	4868	BLT Updater v.1.12.exe	91
PID 4868 wrote to memory of 3716	4868	BLT Updater v.1.12.exe	91
PID 4868 wrote to memory of 3716	4868	BLT Updater v.1.12.exe	91
PID 4868 wrote to memory of 3716	4868	BLT Updater v.1.12.exe	91
PID 4868 wrote to memory of 3716	4868	BLT Updater v.1.12.exe	91
PID 4868 wrote to memory of 3716	4868	BLT Updater v.1.12.exe	91

C:\Users\Admin\AppData\Local\Temp\BLT Updater v.1.12.exe
"C:\Users\Admin\AppData\Local\Temp\BLT Updater v.1.12.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3444,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:4636

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-2-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3716-6-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3716-5-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3716-7-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/4868-0-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

memory/4868-1-0x00000000007F0000-0x00000000007F1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads