lumma | 00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3

Analysis

max time kernel
195s
max time network
258s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04/07/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe
Size 520KB
Sample240704-2ev64asgpp
SHA256 00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3
MD5 3900de86228c8f839d6d4b483794457b
SHA1 90e24676fd3ebcda8635704e762e83d3fbd9cfba
SHA512 5bd0c7f623a6a3c11091391c72868c4462525618164d40a28a19dc5913766b7ebb2878206b4077a7374de23562343748e27e4594ad5c56434fb9fff40e91f4dc
SSDEEP 12288:EnlK6zDfP9TWIBmoWUlANmKr1AAMiBPM1:ErPf1CIUYJKrrPM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://contintnetksows.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3192 set thread context of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73

Program crash 1 IoCs

pid	pid_target	Process	procid_target
316	3192	WerFault.exe	71

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
168	RegAsm.exe
168	RegAsm.exe
168	RegAsm.exe
168	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73
PID 3192 wrote to memory of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73
PID 3192 wrote to memory of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73
PID 3192 wrote to memory of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73
PID 3192 wrote to memory of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73
PID 3192 wrote to memory of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73
PID 3192 wrote to memory of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73
PID 3192 wrote to memory of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73
PID 3192 wrote to memory of 168	3192	00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe	73

C:\Users\Admin\AppData\Local\Temp\00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe
"C:\Users\Admin\AppData\Local\Temp\00c4e525ffb64ff858bb8922e3ab46ee6d65c67a3fa7d9f3a614aaf1604f27e3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 336
  2⤵
  - Program crash
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/168-0-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/168-3-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/168-4-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/168-5-0x0000000000400000-0x0000000000459000-memory.dmp

Download

memory/3192-1-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Download