Analysis
- max time kernel
93s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
06/07/2024, 01:58
General
- Target !ŞetUp_51286--#PaSꞨKḙy#$$/Setup.exe
- Size 1.1MB
- Sample240706-cd8y5asejp
- SHA256 6a2d3876003f6c68f824df4f0033564d8c230716908ba2e6c06ea1dd6d5f98e8
Malware Config
Extracted
-
lumma
-
https://unwielldyzpwo.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\Setup.exe"C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchIndexer.exeC:\Windows\SysWOW64\SearchIndexer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
544fcc85
memory/2332-16-0x00007FFC36C30000-0x00007FFC36E25000-memory.dmp
memory/2332-19-0x0000000000FD0000-0x0000000001028000-memory.dmp
memory/2332-18-0x00000000008BB000-0x00000000008C2000-memory.dmp
memory/2332-17-0x0000000000FD0000-0x0000000001028000-memory.dmp
memory/3012-4-0x00007FFC2FD38000-0x00007FFC2FD39000-memory.dmp
memory/3012-5-0x00007FFC2FD20000-0x00007FFC2FD3C000-memory.dmp
memory/3012-6-0x00007FFC2FD20000-0x00007FFC2FD3C000-memory.dmp
memory/3012-0-0x00007FFC2FD20000-0x00007FFC2FD3C000-memory.dmp
memory/3412-11-0x00000000752B0000-0x00000000752C4000-memory.dmp
memory/3412-15-0x00000000752B0000-0x00000000752C4000-memory.dmp
memory/3412-12-0x00000000752BE000-0x00000000752C0000-memory.dmp
memory/3412-13-0x00000000752B0000-0x00000000752C4000-memory.dmp
memory/3412-20-0x00000000752BE000-0x00000000752C0000-memory.dmp
memory/3412-10-0x00007FFC36C30000-0x00007FFC36E25000-memory.dmp