Analysis
- max time kernel
93s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
09/07/2024, 02:17
General
- Target github.software.1.3.6.exe
- Size 21.5MB
- Sample240709-cq5r8stdpe
- SHA256 97bb4ce1bc7351f928dde0a74f4e6a554769a948ebb26184d1d2734a574a7364
Score
10/10
Malware Config
Extracted
Family
-
lumma
C2
-
https://nobledpcowep.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\github.software.1.3.6.exe"C:\Users\Admin\AppData\Local\Temp\github.software.1.3.6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3496-4-0x0000000000B60000-0x0000000000BB1000-memory.dmp
memory/3496-7-0x0000000000B60000-0x0000000000BB1000-memory.dmp
memory/3496-8-0x0000000000B60000-0x0000000000BB1000-memory.dmp
memory/3496-9-0x0000000000B60000-0x0000000000BB1000-memory.dmp
memory/4440-5-0x00007FF7CC8B0000-0x00007FF7CDEC4000-memory.dmp