lumma | a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928

Analysis

max time kernel
192s
max time network
256s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04/07/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe
Size 7.1MB
Sample240704-2naazswbpd
SHA256 a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928
MD5 d0e0173cc55e6c05976a99c9184e8e7b
SHA1 e6dff80e3fbc138669f2a00d980e56c90168b596
SHA512 ffa0cfb950354fdfa2e95fe3b0c0ac12780904658fafbb88967be5cd0a208db7ff79c22deef99b0971554348067ea652fc32dc6d36f1118d772d1caf4f43abb2
SSDEEP 49152:g/BXLTVIEpSDDXjDU9oAlGSQcqLMmVssAbVSrpcWPME0d0GGlzuO3NzAojj05EiT:CdnV1azs9oAuW7s2FE0/GlS1EV+s9QO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

https://invisibledovereats.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4684 set thread context of 4508	4684	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	73

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4508	BitLockerToGo.exe
4508	BitLockerToGo.exe
4508	BitLockerToGo.exe
4508	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4508	4684	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	73
PID 4684 wrote to memory of 4508	4684	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	73
PID 4684 wrote to memory of 4508	4684	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	73
PID 4684 wrote to memory of 4508	4684	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	73
PID 4684 wrote to memory of 4508	4684	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	73

C:\Users\Admin\AppData\Local\Temp\a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe
"C:\Users\Admin\AppData\Local\Temp\a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4508-4-0x00000000030B0000-0x0000000003107000-memory.dmp

Download

memory/4508-7-0x00000000030B0000-0x0000000003107000-memory.dmp

Download

memory/4508-8-0x00000000030B0000-0x0000000003107000-memory.dmp

Download

memory/4508-9-0x00000000030B0000-0x0000000003107000-memory.dmp

Download

memory/4684-5-0x00007FF67B2C0000-0x00007FF67BA32000-memory.dmp

Download