lumma | 5a20d291100cd26f8b1d80690873ec9b34a68e659e3561028fe0b752cdd8229d

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
!!newSetup_22334_P@ssKey!!/Setup.exe
Size 2.4MB
Sample240622-bk2b7azerg
SHA256 a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
MD5 9fb4770ced09aae3b437c1c6eb6d7334
SHA1 fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA512 140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
SSDEEP 49152:Y8UMSn5cV2N9LNwtQ5gRR+moI1axGbYj6QAl4ImDkg7d5lROCDG5yzlC97W+uJUM:QMS5hN9OtQ5gRjoI8xGbYj6QAl4gg7dF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://sailorshelfquids.shop/api
https://publicitycharetew.shop/api
https://computerexcudesp.shop/api
https://leafcalfconflcitw.shop/api
https://injurypiggyoewirog.shop/api
https://bargainnygroandjwk.shop/api
https://disappointcredisotw.shop/api
https://doughtdrillyksow.shop/api
https://facilitycoursedw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
228	Setup.exe

Loads dropped DLL 1 IoCs

pid	Process
4992	httpd.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2800 set thread context of 3704	2800	Setup.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1048	228	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2800	Setup.exe
2800	Setup.exe
3704	more.com
3704	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2800	Setup.exe
3704	more.com

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2800	Setup.exe
2800	Setup.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 228	2800	Setup.exe	81
PID 2800 wrote to memory of 228	2800	Setup.exe	81
PID 2800 wrote to memory of 228	2800	Setup.exe	81
PID 2800 wrote to memory of 3704	2800	Setup.exe	86
PID 2800 wrote to memory of 3704	2800	Setup.exe	86
PID 2800 wrote to memory of 3704	2800	Setup.exe	86
PID 2800 wrote to memory of 3704	2800	Setup.exe	86
PID 3704 wrote to memory of 4992	3704	more.com	94
PID 3704 wrote to memory of 4992	3704	more.com	94
PID 3704 wrote to memory of 4992	3704	more.com	94
PID 3704 wrote to memory of 4992	3704	more.com	94

C:\Users\Admin\AppData\Local\Temp\!!newSetup_22334_P@ssKey!!\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\!!newSetup_22334_P@ssKey!!\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Roaming\loadctrltb\JOYFGSCJRNOFKMH\Setup.exe
  C:\Users\Admin\AppData\Roaming\loadctrltb\JOYFGSCJRNOFKMH\Setup.exe
  2⤵
  - Executes dropped EXE
  PID:228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 828
    3⤵
    - Program crash
    PID:1048
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Users\Admin\AppData\Local\Temp\httpd.au3
    C:\Users\Admin\AppData\Local\Temp\httpd.au3
    3⤵
    - Loads dropped DLL
    PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228
1⤵
PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

9e98cf3b

Path C:\Users\Admin\AppData\Local\Temp\9e98cf3b
Size 2.0MB
SHA256 1992a5115bff39ec5ae8b1ca5fd740e59bfc0120e40c472dcf08d0cb5ade8352
MD5 e5a222d1cd64ee309666d914dce06465
SHA1 4f4f8105917d7c0b492902c858d55e0cb7cfa4b2
SHA512 9c8bbb731db5a2ab9d32c45c45550c30990840e71eb7073026126bf1282815e902c18241222c1c66d2eb01d1a02dc6c7ef3694dc1d458819e9814fb8188910be
SSDEEP 24576:JVpTXMzxd1OrmzNMix+2oVdOsIpi6LQkONMx7EyTIIqAfU9Ie:t2jimzNBLo8pi6LQkONMmyTqAM9Ie
MD5 SHA1 SHA512 SSDEEP

Submit Download

httpd.au3

Path C:\Users\Admin\AppData\Local\Temp\httpd.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Roaming\loadctrltb\JOYFGSCJRNOFKMH\Setup.exe
Size 111KB
SHA256 56cff82b9e3ee0ed5e74a3e55115e96fd198598be26492cca7b15d9b9023a238
MD5 9f262921a7fbd432c3a694a372caf1b9
SHA1 dfd75a8835a5553d457f4f702c7fe5785227854f
SHA512 cabeaef6132444dc06e7a53332eb58446f7046069044c44b7a27693866a1d66aad7b3ebb5fe7bb79b780548a75b206528f176f5505c574b1c7ad3bcc6fc628b8
SSDEEP 1536:EDDx7Upqno3LbIGHP50vttPTHQaictCH5p5A5stCpnchYq9o:yx7UYno3v50vjzHY5p5A5stC9chYqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2800-8-0x0000000073AA2000-0x0000000073AA4000-memory.dmp

Download

memory/2800-1-0x00007FFB040D0000-0x00007FFB042C5000-memory.dmp

Download

memory/2800-9-0x0000000073A90000-0x0000000073C0B000-memory.dmp

Download

memory/2800-13-0x0000000073A90000-0x0000000073C0B000-memory.dmp

Download

memory/2800-0-0x0000000073A90000-0x0000000073C0B000-memory.dmp

Download

memory/2800-7-0x0000000073A90000-0x0000000073C0B000-memory.dmp

Download

memory/3704-16-0x0000000073A90000-0x0000000073C0B000-memory.dmp

Download

memory/3704-20-0x0000000073A90000-0x0000000073C0B000-memory.dmp

Download

memory/3704-22-0x0000000073A90000-0x0000000073C0B000-memory.dmp

Download

memory/3704-24-0x0000000073A90000-0x0000000073C0B000-memory.dmp

Download

memory/3704-18-0x00007FFB040D0000-0x00007FFB042C5000-memory.dmp

Download

memory/4992-26-0x00007FFB040D0000-0x00007FFB042C5000-memory.dmp

Download

memory/4992-27-0x0000000000BA0000-0x0000000000BF8000-memory.dmp

Download

memory/4992-29-0x0000000000BA0000-0x0000000000BF8000-memory.dmp

Download