lumma | a4f7b21dc88bdcf27cbe929d4bba979f759320b53f7e826bc0a77f55ebbf866c

Analysis

max time kernel
130s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
!ŞetUp_51286--#PaSꞨKḙy#$$/Setup.exe
Size 1.1MB
Sample240706-bgs7ea1dmn
SHA256 6a2d3876003f6c68f824df4f0033564d8c230716908ba2e6c06ea1dd6d5f98e8
MD5 f975a2d83d63a473fa2fc5206b66bb79
SHA1 e49d21f112ab27ae0953aff30ae122440cf164b9
SHA512 4af4ce56bf131432d488ed112f8858c1e1392d013c6ac0603f2fd70ed513091e35854c0f678efeab7fa9a551517c6b9698f40a92729112de4b852fa3c0c69d64
SSDEEP 12288:IbCylcTVPbi7vT1K7n6HpVkg8KHIo5u0K1VmMxEnbuvuY2jTU+LHMA+nk2oG1ts:4lcTVPbikTMkg8KH/mmMxnvfphx8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

https://unwielldyzpwo.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4712 set thread context of 208	4712	Setup.exe	91

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4712	Setup.exe
4712	Setup.exe
208	more.com
208	more.com
332	SearchIndexer.exe
332	SearchIndexer.exe
332	SearchIndexer.exe
332	SearchIndexer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4712	Setup.exe
208	more.com

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 208	4712	Setup.exe	91
PID 4712 wrote to memory of 208	4712	Setup.exe	91
PID 4712 wrote to memory of 208	4712	Setup.exe	91
PID 4712 wrote to memory of 208	4712	Setup.exe	91
PID 208 wrote to memory of 332	208	more.com	95
PID 208 wrote to memory of 332	208	more.com	95
PID 208 wrote to memory of 332	208	more.com	95
PID 208 wrote to memory of 332	208	more.com	95

C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\more.com
  C:\Windows\SysWOW64\more.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\SearchIndexer.exe
    C:\Windows\SysWOW64\SearchIndexer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,8550138573348074061,7308779696487990535,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
1⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2968,i,8550138573348074061,7308779696487990535,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:3
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

2be2be4f

Path C:\Users\Admin\AppData\Local\Temp\2be2be4f
Size 1011KB
SHA256 a368907eb5634032e4129ed82ec8a837c9fecaf230f8180b5bcff93a5767a8e2
MD5 c94b302bb7788793d198ef48c505405e
SHA1 d8f8a6cf0f737e15d2be3051cf32f022fb820c35
SHA512 3c7c14916cd2b3f5c32480e488e147f987e5a7f4c424dee071f9b6f3d2ce3cf4489d48b0044e47f91f4981379a342c19dc4d2acd400135934a60c3bfdac07c31
SSDEEP 24576:3bdYL70Zvkpcmciqc513Zh1xTLRlwGMpOiiJ7toakW3YgoRA5NJJo:g7uvCciq4FZhDLRlwGkgoakW37rNJJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-12-0x000000007519E000-0x00000000751A0000-memory.dmp

Download

memory/208-15-0x0000000075190000-0x00000000751A4000-memory.dmp

Download

memory/208-10-0x00007FF84B270000-0x00007FF84B465000-memory.dmp

Download

memory/208-11-0x0000000075190000-0x00000000751A4000-memory.dmp

Download

memory/208-13-0x0000000075190000-0x00000000751A4000-memory.dmp

Download

memory/208-27-0x000000007519E000-0x00000000751A0000-memory.dmp

Download

memory/332-16-0x00007FF84B270000-0x00007FF84B465000-memory.dmp

Download

memory/332-17-0x0000000000660000-0x00000000006B8000-memory.dmp

Download

memory/332-18-0x0000000000F0B000-0x0000000000F12000-memory.dmp

Download

memory/332-25-0x0000000000660000-0x00000000006B8000-memory.dmp

Download

memory/4712-6-0x00007FF841820000-0x00007FF84183C000-memory.dmp

Download

memory/4712-5-0x00007FF841820000-0x00007FF84183C000-memory.dmp

Download

memory/4712-0-0x00007FF841820000-0x00007FF84183C000-memory.dmp

Download

memory/4712-4-0x00007FF841838000-0x00007FF841839000-memory.dmp

Download