lumma | d716067dbc280962523615988e83b1013bafd4c3a2352d57d67231809bef0e72

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe
Size

597KB
MD5

1a2a26995d43c4ad2f2c9e9e9373d5c8
SHA1

bc9592e1846b06b6e770d443c3802a887fb92987
SHA256

e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c
SHA512

b7138aaef1d2e98c898983fdc5e2255f965e6c1a03fd8b01fe22197f23f61c8e237ce15b582f50d28e64e312a6f565c0d8a13efeeb83a898bd2f2b75165d9743
SSDEEP

12288:y58K1Ff7F68gwFVUHWtOhYQ6YtQRkl904F2VHCU8MAwWoTVLiPgsFEO:y51bCYUHR/j0kzUVHCBwhTkt

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://composepayyersellew.shop/api

https://publicitycharetew.shop/api

https://computerexcudesp.shop/api

https://leafcalfconflcitw.shop/api

https://injurypiggyoewirog.shop/api

https://bargainnygroandjwk.shop/api

https://disappointcredisotw.shop/api

https://doughtdrillyksow.shop/api

https://facilitycoursedw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3412 set thread context of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	87

C:\Users\Admin\AppData\Local\Temp\e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe
"C:\Users\Admin\AppData\Local\Temp\e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3164-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3164-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3164-4-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3164-5-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3412-0-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download