lumma | a870dfe3f0a885f031c1c74df26eb9083929cc10c394122439dd5822ca39e6c9

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 538KB
Sample240614-xkrnmssdpc
SHA256 a870dfe3f0a885f031c1c74df26eb9083929cc10c394122439dd5822ca39e6c9
MD5 9215b4a2cdeb9cd57c8354cc296d4b17
SHA1 456a70d417748f6ca3c3aff4e29b4b64d6ae5fb0
SHA512 9385b2cb1260c068dfa9dbe03c2d463ba466c3e37ddb86573d237b3fdb4433baf497fbceb9ed5fdeb3b86b44acd83ce8dd845a989bb0911a18430325d6e7a06c
SSDEEP 12288:sVfYDEh7qrd4460wtld+lt3431BTvZvNNkEO:sdjZqRj63fQt38Rvkt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://strwawrunnygjwu.shop/api
https://marathonbeedksow.shop/api
https://feighminoritsjda.shop/api
https://pleasurenarrowsdla.shop/api
https://falseaudiencekd.shop/api
https://raiseboltskdlwpow.shop/api
https://justifycanddidatewd.shop/api
https://richardflorespoew.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1804 set thread context of 1980	1804	Setup.exe	90

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1980	1804	Setup.exe	90
PID 1804 wrote to memory of 1980	1804	Setup.exe	90
PID 1804 wrote to memory of 1980	1804	Setup.exe	90
PID 1804 wrote to memory of 1980	1804	Setup.exe	90
PID 1804 wrote to memory of 1980	1804	Setup.exe	90
PID 1804 wrote to memory of 1980	1804	Setup.exe	90
PID 1804 wrote to memory of 1980	1804	Setup.exe	90
PID 1804 wrote to memory of 1980	1804	Setup.exe	90
PID 1804 wrote to memory of 1980	1804	Setup.exe	90

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1804-0-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

memory/1980-1-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/1980-3-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/1980-4-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/1980-5-0x0000000000400000-0x0000000000455000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads