lumma | d6c072aa863f06dce76099d55d3ec2f5400b0dadc9cefa781afe190e41f948e1

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe
Size 7.1MB
Sample240705-dstcnatenf
SHA256 a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928
MD5 d0e0173cc55e6c05976a99c9184e8e7b
SHA1 e6dff80e3fbc138669f2a00d980e56c90168b596
SHA512 ffa0cfb950354fdfa2e95fe3b0c0ac12780904658fafbb88967be5cd0a208db7ff79c22deef99b0971554348067ea652fc32dc6d36f1118d772d1caf4f43abb2
SSDEEP 49152:g/BXLTVIEpSDDXjDU9oAlGSQcqLMmVssAbVSrpcWPME0d0GGlzuO3NzAojj05EiT:CdnV1azs9oAuW7s2FE0/GlS1EV+s9QO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

https://invisibledovereats.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5036 set thread context of 980	5036	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
980	BitLockerToGo.exe
980	BitLockerToGo.exe
980	BitLockerToGo.exe
980	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 980	5036	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	83
PID 5036 wrote to memory of 980	5036	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	83
PID 5036 wrote to memory of 980	5036	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	83
PID 5036 wrote to memory of 980	5036	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	83
PID 5036 wrote to memory of 980	5036	a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe	83

C:\Users\Admin\AppData\Local\Temp\a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe
"C:\Users\Admin\AppData\Local\Temp\a4ecad90d0192439284faa90ba1322d1fcb4a3d62ba110601a2b6420129ee928.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-5-0x0000000000FA0000-0x0000000000FF7000-memory.dmp

Download

memory/980-8-0x0000000000FA0000-0x0000000000FF7000-memory.dmp

Download

memory/980-9-0x0000000000FA0000-0x0000000000FF7000-memory.dmp

Download

memory/980-10-0x0000000000FA0000-0x0000000000FF7000-memory.dmp

Download

memory/5036-4-0x00007FF704980000-0x00007FF7050F2000-memory.dmp

Download

memory/5036-6-0x00007FF704980000-0x00007FF7050F2000-memory.dmp

Download