lumma | 6d69b17bda1ff9f48b17c493291a93d5f98d0ae2395d326cdbae41c96d3ccd87

Resubmissions

29-06-2024 03:36

240629-d54zxstbmq 10

28-06-2024 13:39

240628-qygbhasdle 10

28-06-2024 13:29

240628-qq9yvavdjm 3

Analysis

max time kernel
204s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YuQu Loader.rar (USE ONLY IF NOT WORKING).zip
Size

117.4MB
MD5

3ea9457e45cbb04a30aa8ae12ab71891
SHA1

26259b9ec0d8d32a003ec64060672aaf27beae85
SHA256

6d69b17bda1ff9f48b17c493291a93d5f98d0ae2395d326cdbae41c96d3ccd87
SHA512

f60abc13879eb2d488b4885c36d77e96f398f55c5f181006e5c9a4e8bb1686f5c584c99fcf57482fe521d81fb9b46e5ec5ec6f1e1acaa24500585d54fa674aa1
SSDEEP

3145728:2hJPhl2pXF40X0xnav4as6dpfp9M3cOPyc:2DPLcmMLs6np9MJ

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://extorteauhhwigw.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Executes dropped EXE 2 IoCs

Processes:

YuQu Loader.exeYuQu Loader.exe

pid process

1252 YuQu Loader.exe
1168 YuQu Loader.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

YuQu Loader.exeYuQu Loader.exe

description pid process target process

PID 1252 set thread context of 2864 1252 YuQu Loader.exe RegAsm.exe
PID 1168 set thread context of 4784 1168 YuQu Loader.exe RegAsm.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4280 1252 WerFault.exe YuQu Loader.exe
1680 1168 WerFault.exe YuQu Loader.exe
Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zG.exe

description pid process

Token: SeRestorePrivilege 2548 7zG.exe
Token: 35 2548 7zG.exe
Token: SeSecurityPrivilege 2548 7zG.exe
Token: SeSecurityPrivilege 2548 7zG.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zG.exe

pid process

2548 7zG.exe

pid	process
1252	YuQu Loader.exe
1168	YuQu Loader.exe

description	pid	process	target process
PID 1252 set thread context of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1168 set thread context of 4784	1168	YuQu Loader.exe	RegAsm.exe

pid	pid_target	process	target process
4280	1252	WerFault.exe	YuQu Loader.exe
1680	1168	WerFault.exe	YuQu Loader.exe

description	pid	process
Token: SeRestorePrivilege	2548	7zG.exe
Token: 35	2548	7zG.exe
Token: SeSecurityPrivilege	2548	7zG.exe
Token: SeSecurityPrivilege	2548	7zG.exe

pid	process
2548	7zG.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

YuQu Loader.exeYuQu Loader.exe

description	pid	process	target process
PID 1252 wrote to memory of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1252 wrote to memory of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1252 wrote to memory of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1252 wrote to memory of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1252 wrote to memory of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1252 wrote to memory of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1252 wrote to memory of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1252 wrote to memory of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1252 wrote to memory of 2864	1252	YuQu Loader.exe	RegAsm.exe
PID 1168 wrote to memory of 4784	1168	YuQu Loader.exe	RegAsm.exe
PID 1168 wrote to memory of 4784	1168	YuQu Loader.exe	RegAsm.exe
PID 1168 wrote to memory of 4784	1168	YuQu Loader.exe	RegAsm.exe
PID 1168 wrote to memory of 4784	1168	YuQu Loader.exe	RegAsm.exe
PID 1168 wrote to memory of 4784	1168	YuQu Loader.exe	RegAsm.exe
PID 1168 wrote to memory of 4784	1168	YuQu Loader.exe	RegAsm.exe
PID 1168 wrote to memory of 4784	1168	YuQu Loader.exe	RegAsm.exe
PID 1168 wrote to memory of 4784	1168	YuQu Loader.exe	RegAsm.exe
PID 1168 wrote to memory of 4784	1168	YuQu Loader.exe	RegAsm.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\YuQu Loader.rar (USE ONLY IF NOT WORKING).zip"
1⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4272,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:8
1⤵
PID:3368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1492

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\YuQu Loader.rar (USE ONLY IF NOT WORKING)\" -spe -an -ai#7zMap28024:162:7zEvent4702
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2548

C:\Users\Admin\AppData\Local\Temp\YuQu Loader.rar (USE ONLY IF NOT WORKING)\YuQu Loader\YuQu Loader.exe
"C:\Users\Admin\AppData\Local\Temp\YuQu Loader.rar (USE ONLY IF NOT WORKING)\YuQu Loader\YuQu Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 284
2⤵
- Program crash
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1252 -ip 1252
1⤵
PID:2592

C:\Users\Admin\AppData\Local\Temp\YuQu Loader.rar (USE ONLY IF NOT WORKING)\YuQu Loader\YuQu Loader.exe
"C:\Users\Admin\AppData\Local\Temp\YuQu Loader.rar (USE ONLY IF NOT WORKING)\YuQu Loader\YuQu Loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 244
2⤵
- Program crash
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1168 -ip 1168
1⤵
PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\YuQu Loader.rar (USE ONLY IF NOT WORKING)\YuQu Loader\Debug\x364.dll
Filesize
17.0MB

MD5
8b6e3f0cd5bcd2cf2ce2e16fe7070dc3

SHA1
ab47e5bde61d65f14a2ef72fedab2320ef282d5a

SHA256
a4ce9a380d6faedeef5b29874c9f47d122a27e038503ef4ca1e2d3a8b528c9d5

SHA512
61a518fffcf76802ef016d0f77f738dc1754832fed8202f7106262a3c4ea6d5ac213297839a6e78e365608ab9e7f4eb04f30c9d025ecfa45f8fcb7c47c2a87e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\YuQu Loader.rar (USE ONLY IF NOT WORKING)\YuQu Loader\YuQu Loader.exe
Filesize
513KB

MD5
b4d55322e5018943ce7bd23eef86aaaa

SHA1
fe67bceb035897925d46a49cb21dad2f94ca785b

SHA256
67c7720694e4f280f0b7f398f6355b5a452673dce008d76d99279078a750b5df

SHA512
7956308b35f91932ab03c38e9e6ba0ad518781c29194b3e51925f1006446abe209570988bab4ba2b989093ab331353535ac21c622ca6ac5b9158d85c934733ef

Download Submit
memory/1252-150-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2864-151-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-153-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-154-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2864-155-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download