lumma | 9d0547070e294e4158e6c446fa2295f5ae170f31cc64d677c5261d14caf38ab8

Resubmissions

01/07/2024, 19:00

240701-xnp9zstfnc5

01/07/2024, 18:54

240701-xkj9kaxflj4

01/07/2024, 18:53

240701-xjrbgstdrf10

01/07/2024, 18:44

240701-xdytdatbqe7

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JudgeLZT.exe
Size 951KB
Sample240701-xjrbgstdrf
SHA256 1c84f3a2fd0a00690b2a2e385d952ec3f7a7c94223fd0e3a80aff510d329d13c
MD5 18f16ea3096e479cc7923df5269b25d8
SHA1 c0169fdb70ca980a8ca0baebb2fc3a118fd290c6
SHA512 5a38cf66a137a51776335f520f8b6a39db025a426b0669088f813979fabfe279c38c19504db233153865c6d0f2f759c61af751465245454498ef006a85a04d36
SSDEEP 24576:vuZIdQCtwQpFZWRmqU573CYz6VJyH+np1Vu1OxkCTK:HwQpFZWRh/A6VJyH+zVueTK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://groundsmooors.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4108 set thread context of 1456	4108	JudgeLZT.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2840	4108	WerFault.exe	82

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	83
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	83
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	83
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	83
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	83
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	83
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	83
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	83
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	83

C:\Users\Admin\AppData\Local\Temp\JudgeLZT.exe
"C:\Users\Admin\AppData\Local\Temp\JudgeLZT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 280
  2⤵
  - Program crash
  PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4108 -ip 4108
1⤵
PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-0-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/1456-3-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/1456-4-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/1456-5-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/4108-1-0x0000000001570000-0x0000000001571000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads