lumma | 64ac35ae2c9dc29efb1342f9748c02ba4edab217ececf060f2338e5069c7d5f5

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
18/06/2024, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DaBaby/ElConejoV1.exe
Size 665KB
Sample240618-vpgccswhjp
SHA256 4b4126b38590bf32d620c0138732152c884270d17250132e33dee8278b8618d4
MD5 ac0ec8db29b88d0c07466c71c4b6ce8c
SHA1 9d31380fc2316e3e5ae6c1e0137146fdf3963a78
SHA512 c5fda04217731d46856819defdac17790ce069b74fce3260cd8669ac557c51f4aae2d861e59620aca40995e106c4961e29d17139d20b9d19753ba85c40367eab
SSDEEP 12288:FYjVU0m9IYFgS3kO/wGuOhFZEWCo5b8nYO5GMBzmFcB1tGdcl1YtQNALsxC3+5v4:F+m9IYFzVwOhFZEt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://employeedscratshj.shop/api
https://marathonbeedksow.shop/api
https://feighminoritsjda.shop/api
https://pleasurenarrowsdla.shop/api
https://falseaudiencekd.shop/api
https://raiseboltskdlwpow.shop/api
https://justifycanddidatewd.shop/api
https://strwawrunnygjwu.shop/api
https://richardflorespoew.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
4212	ElConejoV1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4212 set thread context of 3436	4212	ElConejoV1.exe	86

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 3436	4212	ElConejoV1.exe	86
PID 4212 wrote to memory of 3436	4212	ElConejoV1.exe	86
PID 4212 wrote to memory of 3436	4212	ElConejoV1.exe	86
PID 4212 wrote to memory of 3436	4212	ElConejoV1.exe	86
PID 4212 wrote to memory of 3436	4212	ElConejoV1.exe	86
PID 4212 wrote to memory of 3436	4212	ElConejoV1.exe	86
PID 4212 wrote to memory of 3436	4212	ElConejoV1.exe	86
PID 4212 wrote to memory of 3436	4212	ElConejoV1.exe	86
PID 4212 wrote to memory of 3436	4212	ElConejoV1.exe	86

C:\Users\Admin\AppData\Local\Temp\DaBaby\ElConejoV1.exe
"C:\Users\Admin\AppData\Local\Temp\DaBaby\ElConejoV1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:3436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

d3d9.dll

Path C:\Users\Admin\AppData\Roaming\d3d9.dll
Size 418KB
SHA256 994ca7a581ac3d215e9ff2de184ec750e1ab1d8b6c96cc83ea6e6187d35f50db
MD5 4d8a2414c8212fdc5cdc59595fa34744
SHA1 04b13ba741bd1ef41f0c4275f395540219cda1a7
SHA512 e4c567bbaffe9dc17666d44a8cf494366274b168262aed196befa20abdd7a73de85eaec795396ed6aa0b2f47a0a3d8a6ab964f73c287a0c63360f75a56731e32
SSDEEP 6144:pPac9oSGzzZIfTkVtrhprdkBvxa/kWrPS5oKOh/C+r3ODvR86O/TpqC:pyc9oPBtPkoFpVr3Ol8XYC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3436-8-0x0000000000590000-0x00000000005E4000-memory.dmp

Download

memory/3436-12-0x0000000000590000-0x00000000005E4000-memory.dmp

Download

memory/3436-15-0x0000000000590000-0x00000000005E4000-memory.dmp

Download

memory/4212-0-0x0000000074FDE000-0x0000000074FDF000-memory.dmp

Download

memory/4212-1-0x0000000000D60000-0x0000000000E0C000-memory.dmp

Download

memory/4212-17-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

memory/4212-18-0x0000000074FD0000-0x0000000075780000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads