lumma | 35532c5fa9c8758c06c256b97b8438b8035a82f37bfad1bb8602be0b10f1e98b

Analysis

max time kernel
195s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
10/06/2024, 06:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
35532c5fa9c8758c06c256b97b8438b8035a82f37bfad1bb8602be0b10f1e98b.exe
Size 6.4MB
Sample240610-gs4eeadf74
SHA256 35532c5fa9c8758c06c256b97b8438b8035a82f37bfad1bb8602be0b10f1e98b
MD5 e449b00a853e6d34e0bb11a92991e9f0
SHA1 10ac02b318b892bbb0d1d4c337f56fa9c57a751d
SHA512 c6997a3c15ef4abb0ee56fa5fabbb717b4fb4df189464b864f9fdca486e3ee5aec7d7ef181dc02b6bdb1691a036a78b6ce09fbc6e8972455516241855503c263
SSDEEP 196608:6qwJqw1DgShkfsNFE1yZcVDJDR0wqW+/BW9Bl:0gS2fsNFEecVpRzZIA9v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer vmprotect

Malware Config

Extracted

Family

lumma

https://greetclassifytalk.shop/api
https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 2 IoCs

pid	Process
828	world.exe
4836	moigsaw.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000800000001ac46-19.dat	vmprotect
behavioral2/memory/4836-22-0x0000000000850000-0x000000000115A000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	moigsaw.exe
4836	moigsaw.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 4588	748	35532c5fa9c8758c06c256b97b8438b8035a82f37bfad1bb8602be0b10f1e98b.exe	73
PID 748 wrote to memory of 4588	748	35532c5fa9c8758c06c256b97b8438b8035a82f37bfad1bb8602be0b10f1e98b.exe	73
PID 4588 wrote to memory of 828	4588	cmd.exe	76
PID 4588 wrote to memory of 828	4588	cmd.exe	76
PID 828 wrote to memory of 4836	828	world.exe	77
PID 828 wrote to memory of 4836	828	world.exe	77
PID 828 wrote to memory of 4836	828	world.exe	77

C:\Users\Admin\AppData\Local\Temp\35532c5fa9c8758c06c256b97b8438b8035a82f37bfad1bb8602be0b10f1e98b.exe
"C:\Users\Admin\AppData\Local\Temp\35532c5fa9c8758c06c256b97b8438b8035a82f37bfad1bb8602be0b10f1e98b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\world.exe
    world.exe -priverdD
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\moigsaw.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\moigsaw.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat
Size 36B
SHA256 59572cc0f185d253d9ce814fe5911a32dd0864e25e5c32749e4e23d9363db75e
MD5 974050db6bb7b820e3467fea7aa8f3b7
SHA1 4006ff3d281a64e7a172d239ba365e3eae9f0bbf
SHA512 2653116cfa4ef95aa96660130cbb914e6adf9d5d2f9be6353d8f362fb0529f6d0130106542063c5eb5e44466d28df461573fa0632d774dd343b09d4abfb7b0df
MD5 SHA1 SHA512

Submit Download

world.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\world.exe
Size 5.9MB
SHA256 a997b8f3acaf4ab43940e12a8bf584e480d31a65ff005d55d7ae60f76389a2dc
MD5 c4093c49e4793e02e340c9e2ba0c1d45
SHA1 dabdb311ea23eda73187d8d19d001b52661e056a
SHA512 dc544e56605ff4a1a44c41cd6df42215c5da171bb71b32e09fed1f1c48567cf8b67e0b123adf95a63667319aeb83211885ad0142a155dced8f80730c22544690
SSDEEP 98304:ZqwwEZdgSZVFkJd4hNNYOE1yLlc3FMULV8lL598Rn3kwtIcAOc1ypQBW1yabYg/i:Zqw1DgShkfsNFE1yZcVDJDR0wqW+/BWm
MD5 SHA1 SHA512 SSDEEP

Submit Download

moigsaw.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\moigsaw.exe
Size 5.5MB
SHA256 f95a081447c47dc812d533b782d4800dc44a0f9c9ae082eec24b5dc43b6742e0
MD5 e7a4d1b14e1821172c63a12335f59a95
SHA1 15e032dc092679591712a66f9a0dd697acea8926
SHA512 14f48f6a6893a1d9aab82c85d9c87aa05593055ba05046506bfe0f15c66649de1b11f63b5e4c37f0e3688cb2f86fbe84a862678e439089d4f09fa263ffa38c2d
SSDEEP 98304:Y1Slr3hMzhwwtse9WKPaSNFTedu1Wgt8INRsIQ+O7csjjJDkzN3hiXCHnSt1J7:YuhMdeeMKPHN0du1WgtXNa+OFjjTC01p
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4836-20-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/4836-22-0x0000000000850000-0x000000000115A000-memory.dmp

Download