lumma | d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d

Analysis

max time kernel
108s
max time network
188s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/06/2024, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe
Size 3.1MB
Sample240620-3affhssbpf
SHA256 d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d
MD5 706d3fa10a8f951ff64892a998312268
SHA1 6de7ded4759fa2ac5a706d667c2ffd5551adf37a
SHA512 f4d4620ab9a135aa2646e2e6654bfd5386bd9acf55d495450bad98c5e0e711fe25792761b4b2753ce6399fd710464a17229f63cf3dfb3c88863452f008148b6b
SSDEEP 49152:PK3OLWbxGVJ9DxzLvOV5Tk7oWCg+MovIduIH:Pa5l4J9DVMFW8W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

https://thumbdriverrylinnw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 2896	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	73
PID 1260 set thread context of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 2896 set thread context of 4132	2896	AddInProcess32.exe	77

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe
1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe
2896	AddInProcess32.exe
2896	AddInProcess32.exe
2896	AddInProcess32.exe
2896	AddInProcess32.exe
2896	AddInProcess32.exe
2896	AddInProcess32.exe
4132	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe
Token: SeDebugPrivilege	2896	AddInProcess32.exe
Token: SeDebugPrivilege	4132	InstallUtil.exe
Token: SeBackupPrivilege	4132	InstallUtil.exe
Token: SeSecurityPrivilege	4132	InstallUtil.exe
Token: SeSecurityPrivilege	4132	InstallUtil.exe
Token: SeSecurityPrivilege	4132	InstallUtil.exe
Token: SeSecurityPrivilege	4132	InstallUtil.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2896	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	73
PID 1260 wrote to memory of 2896	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	73
PID 1260 wrote to memory of 2896	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	73
PID 1260 wrote to memory of 2896	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	73
PID 1260 wrote to memory of 2896	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	73
PID 1260 wrote to memory of 2896	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	73
PID 1260 wrote to memory of 2896	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	73
PID 1260 wrote to memory of 2896	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	73
PID 1260 wrote to memory of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 1260 wrote to memory of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 1260 wrote to memory of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 1260 wrote to memory of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 1260 wrote to memory of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 1260 wrote to memory of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 1260 wrote to memory of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 1260 wrote to memory of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 1260 wrote to memory of 5052	1260	d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe	74
PID 2896 wrote to memory of 4292	2896	AddInProcess32.exe	75
PID 2896 wrote to memory of 4292	2896	AddInProcess32.exe	75
PID 2896 wrote to memory of 4292	2896	AddInProcess32.exe	75
PID 2896 wrote to memory of 4292	2896	AddInProcess32.exe	75
PID 2896 wrote to memory of 4292	2896	AddInProcess32.exe	75
PID 2896 wrote to memory of 4292	2896	AddInProcess32.exe	75
PID 2896 wrote to memory of 4292	2896	AddInProcess32.exe	75
PID 2896 wrote to memory of 4292	2896	AddInProcess32.exe	75
PID 2896 wrote to memory of 3112	2896	AddInProcess32.exe	76
PID 2896 wrote to memory of 3112	2896	AddInProcess32.exe	76
PID 2896 wrote to memory of 3112	2896	AddInProcess32.exe	76
PID 2896 wrote to memory of 3112	2896	AddInProcess32.exe	76
PID 2896 wrote to memory of 3112	2896	AddInProcess32.exe	76
PID 2896 wrote to memory of 3112	2896	AddInProcess32.exe	76
PID 2896 wrote to memory of 3112	2896	AddInProcess32.exe	76
PID 2896 wrote to memory of 3112	2896	AddInProcess32.exe	76
PID 2896 wrote to memory of 4132	2896	AddInProcess32.exe	77
PID 2896 wrote to memory of 4132	2896	AddInProcess32.exe	77
PID 2896 wrote to memory of 4132	2896	AddInProcess32.exe	77
PID 2896 wrote to memory of 4132	2896	AddInProcess32.exe	77
PID 2896 wrote to memory of 4132	2896	AddInProcess32.exe	77
PID 2896 wrote to memory of 4132	2896	AddInProcess32.exe	77
PID 2896 wrote to memory of 4132	2896	AddInProcess32.exe	77
PID 2896 wrote to memory of 4132	2896	AddInProcess32.exe	77

C:\Users\Admin\AppData\Local\Temp\d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe
"C:\Users\Admin\AppData\Local\Temp\d3449a8d28566e6973e4bf9a2acaf721454c2f15b48831dd6dde2085696c8b8d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:4292
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:3112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-60-0x0000000073220000-0x000000007390E000-memory.dmp

Download

memory/1260-1-0x0000000001140000-0x0000000001460000-memory.dmp

Download

memory/1260-2-0x0000000004BA0000-0x0000000004C3C000-memory.dmp

Download

memory/1260-3-0x0000000073220000-0x000000007390E000-memory.dmp

Download

memory/1260-4-0x00000000070D0000-0x0000000007392000-memory.dmp

Download

memory/1260-5-0x0000000000E70000-0x0000000000E76000-memory.dmp

Download

memory/1260-6-0x000000000AD70000-0x000000000B26E000-memory.dmp

Download

memory/1260-7-0x000000000A910000-0x000000000A9A2000-memory.dmp

Download

memory/1260-8-0x000000000A8F0000-0x000000000A8FA000-memory.dmp

Download

memory/1260-9-0x0000000073220000-0x000000007390E000-memory.dmp

Download

memory/1260-10-0x00000000074F0000-0x000000000750A000-memory.dmp

Download

memory/1260-11-0x0000000007510000-0x0000000007516000-memory.dmp

Download

memory/1260-12-0x000000007322E000-0x000000007322F000-memory.dmp

Download

memory/1260-13-0x0000000073220000-0x000000007390E000-memory.dmp

Download

memory/1260-0-0x000000007322E000-0x000000007322F000-memory.dmp

Download

memory/2896-22-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-17-0x0000000073220000-0x000000007390E000-memory.dmp

Download

memory/2896-24-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-20-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-34-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-16-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-26-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-40-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-44-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-42-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/2896-55-0x0000000073220000-0x000000007390E000-memory.dmp

Download

memory/2896-56-0x0000000073220000-0x000000007390E000-memory.dmp

Download

memory/2896-18-0x0000000073220000-0x000000007390E000-memory.dmp

Download

memory/2896-63-0x0000000073220000-0x000000007390E000-memory.dmp

Download

memory/4132-65-0x00000000088C0000-0x00000000089CA000-memory.dmp

Download

memory/4132-61-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/4132-64-0x0000000008D70000-0x0000000009376000-memory.dmp

Download

memory/4132-66-0x0000000008800000-0x0000000008812000-memory.dmp

Download

memory/4132-67-0x0000000008860000-0x000000000889E000-memory.dmp

Download

memory/4132-68-0x00000000089D0000-0x0000000008A1B000-memory.dmp

Download

memory/4132-71-0x0000000009680000-0x00000000096E6000-memory.dmp

Download

memory/4132-72-0x00000000099B0000-0x0000000009A26000-memory.dmp

Download

memory/4132-73-0x0000000009A30000-0x0000000009A4E000-memory.dmp

Download

memory/4132-74-0x000000000A480000-0x000000000A642000-memory.dmp

Download

memory/4132-75-0x000000000AB80000-0x000000000B0AC000-memory.dmp

Download

memory/5052-58-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/5052-57-0x0000000000400000-0x0000000000458000-memory.dmp

Download