lumma | 73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d

Analysis

max time kernel
193s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13/06/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d.exe
Size 12.0MB
Sample240613-3c7b1sveph
SHA256 73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d
MD5 4f8fd9926364dac5437bde07be8f12ce
SHA1 122410cde30c2bad80cd70ec24f7801a65c11200
SHA512 9e0101225c9b6b08b4c694e269708ba8aa0b9ccc64db7373daf30bc4824562f92abb816cd5654d03f23d66ea6de1112ab000041e8a273d4e6076b1636b00c33b
SSDEEP 49152:jrHgEtB/uFLOy/PrnpHKMQ3wGOtbYEnug88dzlN5Ve0RqEypwjV5EL2YEWxlHymV:h/WiUYMQgGw6+c0jEL2YlTxTzy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://stronggemateraislw.shop/api
https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3508 set thread context of 4784	3508	73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d.exe	73

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 4784	3508	73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d.exe	73
PID 3508 wrote to memory of 4784	3508	73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d.exe	73
PID 3508 wrote to memory of 4784	3508	73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d.exe	73
PID 3508 wrote to memory of 4784	3508	73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d.exe	73
PID 3508 wrote to memory of 4784	3508	73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d.exe	73

C:\Users\Admin\AppData\Local\Temp\73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d.exe
"C:\Users\Admin\AppData\Local\Temp\73f8d381bda19dd0349090faa45e0296e150b6ac01b15c7514054ac5ecc7288d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:4784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3508-2-0x00007FF7986D0000-0x00007FF79936A000-memory.dmp

Download

memory/3508-5-0x00007FF7986D0000-0x00007FF79936A000-memory.dmp

Download

memory/3508-7-0x00007FF7986D0000-0x00007FF79936A000-memory.dmp

Download

memory/4784-6-0x0000000000B10000-0x0000000000B6B000-memory.dmp

Download

memory/4784-9-0x0000000000B10000-0x0000000000B6B000-memory.dmp

Download

memory/4784-10-0x0000000000B10000-0x0000000000B6B000-memory.dmp

Download

memory/4784-11-0x0000000000B10000-0x0000000000B6B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads