lumma | b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2

Analysis

max time kernel
94s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2.exe
Size 4.7MB
Sample240706-b6jz2avcrd
SHA256 b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2
MD5 9635389d4492a1bb338d7467cc79a84f
SHA1 5bf4e06b683c07b6b59da041bc81fdc0e2accf5c
SHA512 106e536e589a4f76176ea5ecb564f46b6f6d1dda2bf33431fff682a3b2ef8fd4df11b6101118f52e14bb46ea2469697ac5738be07fc97fae28c7ec41dbaa5508
SSDEEP 49152:ZadqSJa0AzAku0pfKEae72f9tMcf3gBXkjV5Eh/GRJcwq7lSv5TG11kA:IbJa0AFjk5E8a1D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

https://radiationnopp.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3524 set thread context of 868	3524	b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
868	BitLockerToGo.exe
868	BitLockerToGo.exe
868	BitLockerToGo.exe
868	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 868	3524	b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2.exe	85
PID 3524 wrote to memory of 868	3524	b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2.exe	85
PID 3524 wrote to memory of 868	3524	b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2.exe	85
PID 3524 wrote to memory of 868	3524	b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2.exe	85
PID 3524 wrote to memory of 868	3524	b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2.exe	85

C:\Users\Admin\AppData\Local\Temp\b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2.exe
"C:\Users\Admin\AppData\Local\Temp\b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-4-0x0000000000740000-0x0000000000797000-memory.dmp

Download

memory/868-7-0x0000000000740000-0x0000000000797000-memory.dmp

Download

memory/868-8-0x0000000000740000-0x0000000000797000-memory.dmp

Download

memory/868-9-0x0000000000740000-0x0000000000797000-memory.dmp

Download

memory/3524-5-0x00007FF75F5D0000-0x00007FF75FAED000-memory.dmp

Download