Analysis

  • max time kernel
    34s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2024 01:56

General

  • Target

    0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe

  • Size

    127.6MB

  • MD5

    61c04f7b7aa1d782cc08a3fda3421883

  • SHA1

    9ff160e1364c3143a573d49bbc7edfc5f4ac500b

  • SHA256

    0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4

  • SHA512

    317d72ae0e113e107a04dbddb4f155ae8ee601daa6d4c22bcf3e249ef2ba242a6939aafe623429c235cb02577c76beff9cc41aa8d7ecaba5502b3b43ff409406

  • SSDEEP

    12288:NSoR5kM0NRovC58AHgkOWkeQi4LNBoiZPm6J+FdgADD39h8Vl6L6pLQc6+dwkPFd:NSod0NRov4vgXX

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://demandlinzei.shop/api

https://applyzxcksdia.shop/api

https://replacedoxcjzp.shop/api

https://declaredczxi.shop/api

https://catchddkxozvp.shop/api

https://arriveoxpzxo.shop/api

https://contemplateodszsv.shop/api

https://bindceasdiwozx.shop/api

https://conformfucdioz.shop/api

https://reinforcedirectorywd.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe
    "C:\Users\Admin\AppData\Local\Temp\0991b89416529ba9430580b936b91fbd22692c4ccf0b95a1146db10b6d55efc4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      2⤵
        PID:1740

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\d3d9.dll

      Filesize

      437KB

      MD5

      bb25a1b9cc4e7f73119c5d88501a3f42

      SHA1

      a60d282ad86582e3a4a1aac56ec93fc6232bec21

      SHA256

      94563140c985b4d77ccff4f39b9af9d882847100018b26e63032a529158b75d1

      SHA512

      3ca098d3e3b50a4d6a70dc6e1197f3e7af5d1cbb2cf9c0fcc392e9db4a6de2e0616f29d995e825d35dd67cfebcb0caebcdfe9fd3a42456db88220a1500774974

    • memory/1740-8-0x0000000000700000-0x0000000000755000-memory.dmp

      Filesize

      340KB

    • memory/1740-12-0x0000000000700000-0x0000000000755000-memory.dmp

      Filesize

      340KB

    • memory/1740-16-0x0000000000700000-0x0000000000755000-memory.dmp

      Filesize

      340KB

    • memory/4508-0-0x000000007501E000-0x000000007501F000-memory.dmp

      Filesize

      4KB

    • memory/4508-1-0x0000000000EC0000-0x0000000000F62000-memory.dmp

      Filesize

      648KB

    • memory/4508-17-0x0000000075010000-0x00000000757C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4508-18-0x0000000075010000-0x00000000757C0000-memory.dmp

      Filesize

      7.7MB