lumma | 46ed2e58e5b02d6e62b6863e30659fe01aae9174023628a08bb977c08a3f1087

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5900dba92dda0c5c57825b576e1650fc.exe
Size 1.3MB
Sample240614-rdtxjaxejn
SHA256 46ed2e58e5b02d6e62b6863e30659fe01aae9174023628a08bb977c08a3f1087
MD5 5900dba92dda0c5c57825b576e1650fc
SHA1 bf4d681bf41c4eb28119df58cd0e320d581c0542
SHA512 680fec18abfe2e78e57ae29bb419d58089f13c18c2d01f725e05c3b665e41a714fb46826ea572fbfae07309e3441d5a80b43a83900d15c0602ee9fe380c195d2
SSDEEP 24576:yswFzoEE9fOAj2uxTZquLRce3OwnI4PJ:5wFzoEE9WihZq+ce37I4x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://thidrsorebahsufll.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	bitbucket.org
12	bitbucket.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2832 set thread context of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
740	2832	WerFault.exe	80

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84
PID 2832 wrote to memory of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84
PID 2832 wrote to memory of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84
PID 2832 wrote to memory of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84
PID 2832 wrote to memory of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84
PID 2832 wrote to memory of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84
PID 2832 wrote to memory of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84
PID 2832 wrote to memory of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84
PID 2832 wrote to memory of 100	2832	5900dba92dda0c5c57825b576e1650fc.exe	84

C:\Users\Admin\AppData\Local\Temp\5900dba92dda0c5c57825b576e1650fc.exe
"C:\Users\Admin\AppData\Local\Temp\5900dba92dda0c5c57825b576e1650fc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 1784
  2⤵
  - Program crash
  PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2832 -ip 2832
1⤵
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/100-3-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/100-5-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/100-6-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/100-7-0x0000000000400000-0x000000000045A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads