lumma | 39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe
Size 940KB
Sample240703-zeeg8swerr
SHA256 39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b
MD5 423db0db0be1538dc13409dc9cdbdc2a
SHA1 2c822354971c430ddad7917043117759d22fabcb
SHA512 550ce9e2773ad855acd772bd1559b2e54cd610ca0601b71dfe881c7e15d251fc688aeba1677839d50b12af357f3283b7f8126e434b35d80cf0bbfd4230b51ea1
SSDEEP 24576:HkK/dQCtwyw2RijMs0r734C5jUZpRlDxqofV:xwyw2RijJLgjUZxbd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://extorteauhhwigw.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
620	2628	WerFault.exe	81

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1572	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	82
PID 2628 wrote to memory of 1572	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	82
PID 2628 wrote to memory of 1572	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	82
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	83

C:\Users\Admin\AppData\Local\Temp\39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe
"C:\Users\Admin\AppData\Local\Temp\39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 280
  2⤵
  - Program crash
  PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2628 -ip 2628
1⤵
PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-1-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/3576-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3576-3-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3576-4-0x0000000000400000-0x0000000000458000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads