lumma | 65f8e0e219637833386b6cfe27bd2f8446a214f02149628c63dd0329501e17e6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SkriptGG.exe
Size 554KB
Sample240709-dg2vnavgkb
SHA256 65f8e0e219637833386b6cfe27bd2f8446a214f02149628c63dd0329501e17e6
MD5 613df599866679f7f19d12ff86220db8
SHA1 33a2f464888fd8aedd2c4cd8f79e9e43321d8465
SHA512 4091dc9ce75e7ff9a1131aa200e30ca293a8619a616bce17a4f5fa6e79602848efd422be64be7af8aff3c99f75536d2ea45dbcf1d7afb0a7998a0526bf76ce13
SSDEEP 12288:2Nqf82rBbd4Qlj68ZEpv/7B+WIOzys7AsMC6WReVDTKwWZwfwsBAlny7Jc23OBuB:2s82ZWQx6AKsWL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma spyware stealer

Malware Config

Extracted

Family

lumma

https://extorteauhhwigw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
4728	SkriptGG.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4728 set thread context of 1096	4728	SkriptGG.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1096	aspnet_regiis.exe
1096	aspnet_regiis.exe
1096	aspnet_regiis.exe
1096	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1096	4728	SkriptGG.exe	85
PID 4728 wrote to memory of 1096	4728	SkriptGG.exe	85
PID 4728 wrote to memory of 1096	4728	SkriptGG.exe	85
PID 4728 wrote to memory of 1096	4728	SkriptGG.exe	85
PID 4728 wrote to memory of 1096	4728	SkriptGG.exe	85
PID 4728 wrote to memory of 1096	4728	SkriptGG.exe	85
PID 4728 wrote to memory of 1096	4728	SkriptGG.exe	85
PID 4728 wrote to memory of 1096	4728	SkriptGG.exe	85
PID 4728 wrote to memory of 1096	4728	SkriptGG.exe	85

C:\Users\Admin\AppData\Local\Temp\SkriptGG.exe
"C:\Users\Admin\AppData\Local\Temp\SkriptGG.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d3d9.dll

Path C:\Users\Admin\AppData\Roaming\d3d9.dll
Size 429KB
SHA256 d66df0795ea1a1941802c75c10603a6ad3b162ded9153f3623c3816e81e47bba
MD5 f6ba3a613a9d9be4b2b93c8ec849d239
SHA1 dadd356e8b028fd7ce67e91ddea68b4928a146d3
SHA512 0b02ddc1208abdc270637992d15ca64154b7dc5fd5420df3b5a6253655050f415f983aaed06427b3d30315a406b3c6a98d5487a9d5ad5df863cddaa9b2a92989
SSDEEP 6144:90iTw2HhW43GDk5UE3gzz+aParv1bVrcgA5gyTUwHPsf2M:9NwCQ40Q3E9PazMh5gyg7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1096-12-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1096-10-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1096-15-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1096-16-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/4728-0-0x000000007464E000-0x000000007464F000-memory.dmp

Download

memory/4728-1-0x00000000004E0000-0x0000000000574000-memory.dmp

Download

memory/4728-2-0x0000000002720000-0x0000000002726000-memory.dmp

Download

memory/4728-9-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download

memory/4728-14-0x0000000074640000-0x0000000074DF0000-memory.dmp

Download