lumma | 89c064651ee7635c020a93a57946473ba8904cb4671a1d861413c40d13980ace

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
@!AcTive_Pc$etUp_5567_pAs$W0rd$/Setup.exe
Size 5.5MB
Sample240609-b82mvsbg9s
SHA256 db2457caa1ccd65e63718b9e28789a12e17bc7a038975fba4f07dcd9f38e7016
MD5 9d8649afd4141d960b6545998fbc423b
SHA1 3ddd700caaebab0a9d2ed640f235d4b716a505de
SHA512 0a50681e956df3187a718570fd54600365e8ad805b7e291eb5fc6169df47a6d31596f890419aa36a4f3d983b17eb21eae9e2e51cf5755f8b2b890ba87b752da2
SSDEEP 49152:88iGSBp0o5I9vl6yoPgbIXayfQUxldpSphlWopc9MTHKsb48bHVGfKiaaQATZ79z:bihyoPgbInQEHY3N3sNfxLlC1Dxeh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://muggylasergaijynwjk.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
1636	Uhzi.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3524 set thread context of 2652	3524	Setup.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3524	Setup.exe
3524	Setup.exe
2652	more.com
2652	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3524	Setup.exe
2652	more.com

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 2652	3524	Setup.exe	84
PID 3524 wrote to memory of 2652	3524	Setup.exe	84
PID 3524 wrote to memory of 2652	3524	Setup.exe	84
PID 3524 wrote to memory of 2652	3524	Setup.exe	84
PID 2652 wrote to memory of 1636	2652	more.com	93
PID 2652 wrote to memory of 1636	2652	more.com	93
PID 2652 wrote to memory of 1636	2652	more.com	93
PID 2652 wrote to memory of 1636	2652	more.com	93
PID 2652 wrote to memory of 1636	2652	more.com	93

C:\Users\Admin\AppData\Local\Temp\@!AcTive_Pc$etUp_5567_pAs$W0rd$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\@!AcTive_Pc$etUp_5567_pAs$W0rd$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
    3⤵
    - Loads dropped DLL
    PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

97dc99ca

Path C:\Users\Admin\AppData\Local\Temp\97dc99ca
Size 1.8MB
SHA256 f51a7ca4bc5ffc530e553f903254f4055d48d08a712b8f1d3e53416716c95a8b
MD5 b3f728d1f3a8aa0b133d9a2cb5baf4fd
SHA1 4173886f0d089a808bf66c5c8c8092d45c237af3
SHA512 812e1d8ee0c716813d4b97cb46fd2243bea481308137665d16fe37a5e17d445be1c22eb2bf5c7ce9b4bf4125ecc0242afddb332e6b7990dd641fb6e788e016a5
SSDEEP 49152:1TiPDff0ypCCw59h/OVhbS+jjjjjjjjjjjjjjjjjjjjj/h2HVYQ:1TiAb59NOe+jjjjjjjjjjjjjjjjjjjjY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uhzi.au3

Path C:\Users\Admin\AppData\Local\Temp\Uhzi.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1636-23-0x0000000000FF0000-0x0000000001046000-memory.dmp

Download

memory/1636-21-0x00007FFC54E10000-0x00007FFC55005000-memory.dmp

Download

memory/2652-14-0x0000000074A50000-0x0000000074BCB000-memory.dmp

Download

memory/2652-9-0x0000000074A50000-0x0000000074BCB000-memory.dmp

Download

memory/2652-11-0x00007FFC54E10000-0x00007FFC55005000-memory.dmp

Download

memory/2652-13-0x0000000074A50000-0x0000000074BCB000-memory.dmp

Download

memory/2652-19-0x0000000074A50000-0x0000000074BCB000-memory.dmp

Download

memory/3524-7-0x0000000074A50000-0x0000000074BCB000-memory.dmp

Download

memory/3524-0-0x0000000074A50000-0x0000000074BCB000-memory.dmp

Download

memory/3524-1-0x00007FFC54E10000-0x00007FFC55005000-memory.dmp

Download

memory/3524-5-0x0000000074A62000-0x0000000074A64000-memory.dmp

Download

memory/3524-6-0x0000000074A50000-0x0000000074BCB000-memory.dmp

Download