lumma | 42f6ed3f3f25e52787a9e43dec53306eb63e581d87882f3fbc4756685714e39a

Resubmissions

07-01-2024 18:26

max time kernel
187s
max time network
261s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 18:26

Target

Samples 7/dcf250dc8a9683cf5a3e7dfdb441b06e15b391a8c5d97b31431c650a715432a6.exe
Size

5.3MB
MD5

0943d1d429a98057dbd293bd3e25acc3
SHA1

5cec545b9061ca87f2556409ebb965930b51cecb
SHA256

dcf250dc8a9683cf5a3e7dfdb441b06e15b391a8c5d97b31431c650a715432a6
SHA512

4fd88ff35eddd0a26c604c831d14a5f32a8c98d8626c79cf2ff88d1ca47ad21b2cc0c10c463080abdbf1fd04603404c72149ce3cc11dbd433d73115562f7fcd8
SSDEEP

98304:611Y2C1jo5h/lR77cMBUe+xsi9qah1ezissbulaIQA6PXcGQv9xdY/oRizbBAtq9:61CP1ohNDUrxwAgziXqlaFPXNQv9bY/P

Score

10^/10

lumma stealer

Family

lumma

http://oluaskaz.pw/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4324	3952	WerFault.exe	40
4056	3952	WerFault.exe	40

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4324	3952	dcf250dc8a9683cf5a3e7dfdb441b06e15b391a8c5d97b31431c650a715432a6.exe	97
PID 3952 wrote to memory of 4324	3952	dcf250dc8a9683cf5a3e7dfdb441b06e15b391a8c5d97b31431c650a715432a6.exe	97
PID 3952 wrote to memory of 4324	3952	dcf250dc8a9683cf5a3e7dfdb441b06e15b391a8c5d97b31431c650a715432a6.exe	97

C:\Users\Admin\AppData\Local\Temp\Samples 7\dcf250dc8a9683cf5a3e7dfdb441b06e15b391a8c5d97b31431c650a715432a6.exe
"C:\Users\Admin\AppData\Local\Temp\Samples 7\dcf250dc8a9683cf5a3e7dfdb441b06e15b391a8c5d97b31431c650a715432a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1252
  2⤵
  - Program crash
  PID:4324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1252
  2⤵
  - Program crash
  PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3952 -ip 3952
1⤵
PID:3948

memory/3952-0-0x0000000000400000-0x0000000000E1F000-memory.dmp

Filesize
10.1MB

Download
memory/3952-5-0x0000000000400000-0x0000000000E1F000-memory.dmp

Filesize
10.1MB

Download