lumma | 4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe
Size 535KB
Sample240610-cmkynaae7y
SHA256 4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5
MD5 70c863ac0ac79ca85553436865950c68
SHA1 8f3923a3a233ef7be861a773ee5caf5172e1fcfe
SHA512 f146c24ec2d9a4b476cf7d81f0f9938dd0be7caf8108e08619524d3e3d5304445228712a7fe41d8be1b03ecc2a73adf24f67c448c4ded0c93f4197cf15d3c077
SSDEEP 12288:+Us9aW5K2J8HiUKzcO29Z0d5zPEnMl0+ssyse7ZqEO:+ULW1JJAOtWMW+09Zqt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://notoriousdcellkw.shop/api
https://liabiliytshareodlkv.shop/api
https://conferencefreckewl.shop/api
https://flourhishdiscovrw.shop/api
https://landdumpycolorwskfw.shop/api
https://ohfantasyproclaiwlo.shop/api
https://parallelmercywksoffw.shop/api
https://barebrilliancedkoso.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81
PID 2756 wrote to memory of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81
PID 2756 wrote to memory of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81
PID 2756 wrote to memory of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81
PID 2756 wrote to memory of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81
PID 2756 wrote to memory of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81
PID 2756 wrote to memory of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81
PID 2756 wrote to memory of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81
PID 2756 wrote to memory of 3968	2756	4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe	81

C:\Users\Admin\AppData\Local\Temp\4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe
"C:\Users\Admin\AppData\Local\Temp\4dc922d5a290db15ef3213c63f707770667944f3d65b2035ecd37327ea35f1c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-0-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/2756-1-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/2756-3-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/3968-2-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3968-5-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3968-6-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3968-7-0x0000000000400000-0x0000000000459000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads