lumma | 5cf127ccb4d461cd11701d8b949ed45af04f6ca188a24c482cefc2a26583c721

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

!!SetUp_!PaS$Kḙy$!_60814/Setup.exe
Size

1.1MB
MD5

f975a2d83d63a473fa2fc5206b66bb79
SHA1

e49d21f112ab27ae0953aff30ae122440cf164b9
SHA256

6a2d3876003f6c68f824df4f0033564d8c230716908ba2e6c06ea1dd6d5f98e8
SHA512

4af4ce56bf131432d488ed112f8858c1e1392d013c6ac0603f2fd70ed513091e35854c0f678efeab7fa9a551517c6b9698f40a92729112de4b852fa3c0c69d64
SSDEEP

12288:IbCylcTVPbi7vT1K7n6HpVkg8KHIo5u0K1VmMxEnbuvuY2jTU+LHMA+nk2oG1ts:4lcTVPbikTMkg8KH/mmMxnvfphx8

Score

10^/10

lumma stealer

Malware Config

Extracted

Family

lumma

https://bouncedgowp.shop/api

https://bannngwko.shop/api

https://bargainnykwo.shop/api

https://affecthorsedpo.shop/api

https://radiationnopp.shop/api

https://answerrsdo.shop/api

https://publicitttyps.shop/api

https://benchillppwo.shop/api

https://reinforcedirectorywd.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 4768 set thread context of 1732 4768 Setup.exe more.com
Loads dropped DLL 1 IoCs

Processes:

Beep.au3

pid process

620 Beep.au3
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Setup.exemore.com

pid process

4768 Setup.exe
4768 Setup.exe
1732 more.com
1732 more.com
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Setup.exemore.com

pid process

4768 Setup.exe
1732 more.com

description	pid	process	target process
PID 4768 set thread context of 1732	4768	Setup.exe	more.com

pid	process
620	Beep.au3

pid	process
4768	Setup.exe
4768	Setup.exe
1732	more.com
1732	more.com

pid	process
4768	Setup.exe
1732	more.com

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Setup.exemore.com

description	pid	process	target process
PID 4768 wrote to memory of 1732	4768	Setup.exe	more.com
PID 4768 wrote to memory of 1732	4768	Setup.exe	more.com
PID 4768 wrote to memory of 1732	4768	Setup.exe	more.com
PID 4768 wrote to memory of 1732	4768	Setup.exe	more.com
PID 1732 wrote to memory of 620	1732	more.com	Beep.au3
PID 1732 wrote to memory of 620	1732	more.com	Beep.au3
PID 1732 wrote to memory of 620	1732	more.com	Beep.au3
PID 1732 wrote to memory of 620	1732	more.com	Beep.au3
PID 1732 wrote to memory of 620	1732	more.com	Beep.au3

C:\Users\Admin\AppData\Local\Temp\!!SetUp_!PaS$Kḙy$!_60814\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\!!SetUp_!PaS$Kḙy$!_60814\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\SysWOW64\more.com
C:\Windows\SysWOW64\more.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\Beep.au3
C:\Users\Admin\AppData\Local\Temp\Beep.au3
3⤵
- Loads dropped DLL
PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Beep.au3
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0cce305
Filesize
1.9MB

MD5
45cf874d8037e32cc32e64dde8b95ac5

SHA1
dd9c71317fd4f9da509ab2fda55bb63b281e7a65

SHA256
f6fca264a2916d0184ce0f7940cc45ffca4d8a0680b76ab0526eb05f8c9a99ae

SHA512
813551637033440da7dbef70899205532399839f655ff09d3be1c2e8fba475caa492e594b6e1ab1a22e6a06e7da525f19895757cfdd88ce944067e8d3703bae1

Download Submit
memory/620-19-0x0000000000070000-0x00000000000CD000-memory.dmp

Filesize
372KB

Download
memory/620-18-0x00007FFF07090000-0x00007FFF07285000-memory.dmp

Filesize
2.0MB

Download
memory/620-24-0x0000000000070000-0x00000000000CD000-memory.dmp

Filesize
372KB

Download
memory/620-23-0x0000000000070000-0x00000000000CD000-memory.dmp

Filesize
372KB

Download
memory/620-21-0x0000000000FD7000-0x0000000000FDF000-memory.dmp

Filesize
32KB

Download
memory/1732-16-0x0000000075A60000-0x0000000075BDB000-memory.dmp

Filesize
1.5MB

Download
memory/1732-11-0x0000000075A60000-0x0000000075BDB000-memory.dmp

Filesize
1.5MB

Download
memory/1732-13-0x0000000075A60000-0x0000000075BDB000-memory.dmp

Filesize
1.5MB

Download
memory/1732-12-0x0000000075A6E000-0x0000000075A70000-memory.dmp

Filesize
8KB

Download
memory/1732-22-0x0000000075A6E000-0x0000000075A70000-memory.dmp

Filesize
8KB

Download
memory/1732-9-0x00007FFF07090000-0x00007FFF07285000-memory.dmp

Filesize
2.0MB

Download
memory/4768-6-0x00007FFEE9980000-0x00007FFEE9AF2000-memory.dmp

Filesize
1.4MB

Download
memory/4768-5-0x00007FFEE9980000-0x00007FFEE9AF2000-memory.dmp

Filesize
1.4MB

Download
memory/4768-0-0x00007FFEE9980000-0x00007FFEE9AF2000-memory.dmp

Filesize
1.4MB

Download
memory/4768-4-0x00007FFEE9998000-0x00007FFEE9999000-memory.dmp

Filesize
4KB

Download