lumma | 0fef0b66199dc27ed7691e63852b9c19b9f2a1a19d16811e08a834013b038576

Analysis

max time kernel
123s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SapphireX.exe
Size 97.4MB
Sample240701-ty9vlasdrm
SHA256 0fef0b66199dc27ed7691e63852b9c19b9f2a1a19d16811e08a834013b038576
MD5 2fd6ab9ede29579295b396a7d9c8e935
SHA1 9a8207071c65e19c360f2d574c7205aa710582be
SHA512 e64b442f021a17d4b9cda50c99cec33594d42e496f4afd6ce48d91c3d1d664fa5082598f04cf9f1186a2d03d3d2361666e4c0f12500cdbefecaebbc48255146d
SSDEEP 393216:TMgE1A1/9F6DncvuyJAlgoy7AacE7+fa:TXE1AB9MncvuzEMS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://citizencenturygoodwk.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3316 set thread context of 4564	3316	SapphireX.exe	97

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	97
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	97
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	97
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	97
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	97

C:\Users\Admin\AppData\Local\Temp\SapphireX.exe
"C:\Users\Admin\AppData\Local\Temp\SapphireX.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3924,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
1⤵
PID:3620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3316-2-0x00007FF7EF860000-0x00007FF7F1E7C000-memory.dmp

Download

memory/3316-6-0x00007FF7EF860000-0x00007FF7F1E7C000-memory.dmp

Download

memory/4564-5-0x0000000000900000-0x0000000000959000-memory.dmp

Download

memory/4564-8-0x0000000000900000-0x0000000000959000-memory.dmp

Download

memory/4564-9-0x0000000000900000-0x0000000000959000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads