lumma | 67ece3106f3e07ae7756b8e88e20b9ff59a5fc4ef253b07cd215085ff3adab82

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 521KB
Sample240709-dhbd4ashkl
SHA256 67ece3106f3e07ae7756b8e88e20b9ff59a5fc4ef253b07cd215085ff3adab82
MD5 0e6f574883cf8d2d46a73a4ef0c2a1d5
SHA1 5825b85987a409471446c878eec16804bd23c100
SHA512 63044deac29e596b0226997f01d42ba1132ae3260883932521b0e72b04e2ec7a7bde4e6381b20c1e81846d52121d10e3e94b7b3d8c22f81520625be1c0cf999b
SSDEEP 12288:k07v1x51ZVq4WrCvkMjCDcrYaPftabsCgtsJRG0Mx:k07Nx51bNGC4DI1P4otsJfM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma discovery spyware stealer

Malware Config

Extracted

Family

lumma

https://piedsiggnycliquieaw.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4416 set thread context of 3936	4416	Setup.exe	87

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3936	RegAsm.exe
3936	RegAsm.exe
3936	RegAsm.exe
3936	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4112	4416	Setup.exe	86
PID 4416 wrote to memory of 4112	4416	Setup.exe	86
PID 4416 wrote to memory of 4112	4416	Setup.exe	86
PID 4416 wrote to memory of 3936	4416	Setup.exe	87
PID 4416 wrote to memory of 3936	4416	Setup.exe	87
PID 4416 wrote to memory of 3936	4416	Setup.exe	87
PID 4416 wrote to memory of 3936	4416	Setup.exe	87
PID 4416 wrote to memory of 3936	4416	Setup.exe	87
PID 4416 wrote to memory of 3936	4416	Setup.exe	87
PID 4416 wrote to memory of 3936	4416	Setup.exe	87
PID 4416 wrote to memory of 3936	4416	Setup.exe	87
PID 4416 wrote to memory of 3936	4416	Setup.exe	87

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3936-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3936-3-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3936-4-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3936-5-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/4416-1-0x0000000000850000-0x0000000000851000-memory.dmp

Download