lumma | 0f4d4adabeb2311e87529dd6806572b9d26472f7b34935ca184287b798f9957f | Triage

Analysis

max time kernel
12s
max time network
18s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 09:10

Sharing

Report Analysis Logs

General

Target

all.exe
Size

65.9MB
MD5

9996abe82bc7914baa86f373894e14d3
SHA1

22c529bbdd5909dcc46f653e64ea796b9e62e9d0
SHA256

b9ec0f1d72edf73e8ce680dbc58328ea57a17503607e72e4174a9e052b2cd805
SHA512

27397a1b7d91d5ba3da76cd14d40cd0be66650d80379f68f0c3913399957bd60a2a8bed9548dfb4a878ea759585f5cb8fb3e060cb17139677abfbc2f3523c44a
SSDEEP

1572864:NsctqFeWSmx3m00cfFjVg1HTM7U0aCtIsctqFeWSmx3ma:NsqI3v0cfJrRaCOsqI3f

Score

10^/10

Malware Config

Extracted

Family

lumma

C2

https://exporttearryliveedko.shop/api

https://harmfullyelobardek.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

all.exe

pid process

4188 all.exe
4188 all.exe

C:\Users\Admin\AppData\Local\Temp\all.exe
"C:\Users\Admin\AppData\Local\Temp\all.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4188-1-0x0000000000690000-0x00000000006E3000-memory.dmp

Filesize
332KB

Download
memory/4188-3-0x0000000000690000-0x00000000006E3000-memory.dmp

Filesize
332KB

Download
memory/4188-5-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download