lumma | 1144dff41fa0f58fc7cc3d127c07fd02a3052dc6db22d181d9340b6ffe552fa6

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 2.4MB
Sample240622-l88fhstcle
SHA256 a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
MD5 9fb4770ced09aae3b437c1c6eb6d7334
SHA1 fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA512 140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
SSDEEP 49152:Y8UMSn5cV2N9LNwtQ5gRR+moI1axGbYj6QAl4ImDkg7d5lROCDG5yzlC97W+uJUM:QMS5hN9OtQ5gRjoI8xGbYj6QAl4gg7dF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://sailorshelfquids.shop/api
https://publicitycharetew.shop/api
https://computerexcudesp.shop/api
https://leafcalfconflcitw.shop/api
https://injurypiggyoewirog.shop/api
https://bargainnygroandjwk.shop/api
https://disappointcredisotw.shop/api
https://doughtdrillyksow.shop/api
https://facilitycoursedw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 1 IoCs

pid	Process
944	Setup.exe

Loads dropped DLL 1 IoCs

pid	Process
60	httpd.au3

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 2132	1312	Setup.exe	91

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	944	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1312	Setup.exe
1312	Setup.exe
2132	more.com
2132	more.com

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1312	Setup.exe
2132	more.com

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1312	Setup.exe
1312	Setup.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 944	1312	Setup.exe	85
PID 1312 wrote to memory of 944	1312	Setup.exe	85
PID 1312 wrote to memory of 944	1312	Setup.exe	85
PID 1312 wrote to memory of 2132	1312	Setup.exe	91
PID 1312 wrote to memory of 2132	1312	Setup.exe	91
PID 1312 wrote to memory of 2132	1312	Setup.exe	91
PID 1312 wrote to memory of 2132	1312	Setup.exe	91
PID 2132 wrote to memory of 60	2132	more.com	99
PID 2132 wrote to memory of 60	2132	more.com	99
PID 2132 wrote to memory of 60	2132	more.com	99
PID 2132 wrote to memory of 60	2132	more.com	99

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Roaming\loadctrltb\WEGTGVJKVLV\Setup.exe
  C:\Users\Admin\AppData\Roaming\loadctrltb\WEGTGVJKVLV\Setup.exe
  2⤵
  - Executes dropped EXE
  PID:944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 944 -s 820
    3⤵
    - Program crash
    PID:2952
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\httpd.au3
    C:\Users\Admin\AppData\Local\Temp\httpd.au3
    3⤵
    - Loads dropped DLL
    PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 944 -ip 944
1⤵
PID:384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

a6a0514d

Path C:\Users\Admin\AppData\Local\Temp\a6a0514d
Size 2.0MB
SHA256 9bb3db0dcf8e372699a00ac9e919bb2f089941002c5f9f2ece92357a92c6504f
MD5 3d59a767e6503c10c232a7d37b10d6af
SHA1 24b75fe4e5d210ce64d7289c9f513a7cb53731b8
SHA512 24dbaa2e1d33de79329208c8fa3695123f3e50e2fc72dd35ad1a5632ed0cee88bc7cd9d4742c8fc2612026eece7064c596f8c1a490c190ccbce383249ace3615
SSDEEP 49152:RKGxvcvvLfXROGiMPbMoTrJmJY09Hj5J6uwMv+:bv2DROGbMoTrJmJY0918Mv+
MD5 SHA1 SHA512 SSDEEP

Submit Download

httpd.au3

Path C:\Users\Admin\AppData\Local\Temp\httpd.au3
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Roaming\loadctrltb\WEGTGVJKVLV\Setup.exe
Size 111KB
SHA256 56cff82b9e3ee0ed5e74a3e55115e96fd198598be26492cca7b15d9b9023a238
MD5 9f262921a7fbd432c3a694a372caf1b9
SHA1 dfd75a8835a5553d457f4f702c7fe5785227854f
SHA512 cabeaef6132444dc06e7a53332eb58446f7046069044c44b7a27693866a1d66aad7b3ebb5fe7bb79b780548a75b206528f176f5505c574b1c7ad3bcc6fc628b8
SSDEEP 1536:EDDx7Upqno3LbIGHP50vttPTHQaictCH5p5A5stCpnchYq9o:yx7UYno3v50vjzHY5p5A5stC9chYqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-29-0x0000000000630000-0x0000000000688000-memory.dmp

Download

memory/60-27-0x0000000000630000-0x0000000000688000-memory.dmp

Download

memory/60-26-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp

Download

memory/1312-9-0x00000000730D0000-0x000000007324B000-memory.dmp

Download

memory/1312-13-0x00000000730D0000-0x000000007324B000-memory.dmp

Download

memory/1312-0-0x00000000730D0000-0x000000007324B000-memory.dmp

Download

memory/1312-7-0x00000000730D0000-0x000000007324B000-memory.dmp

Download

memory/1312-8-0x00000000730E2000-0x00000000730E4000-memory.dmp

Download

memory/1312-1-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp

Download

memory/2132-16-0x00000000730D0000-0x000000007324B000-memory.dmp

Download

memory/2132-18-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp

Download

memory/2132-20-0x00000000730D0000-0x000000007324B000-memory.dmp

Download

memory/2132-22-0x00000000730D0000-0x000000007324B000-memory.dmp

Download

memory/2132-24-0x00000000730D0000-0x000000007324B000-memory.dmp

Download