lumma | 3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 02:09

Target

3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe
Size

340KB
MD5

e79d42e6b51653c6a459adc6e6cd0e7d
SHA1

19590e4efcea7b916825669075fb59de0aae0600
SHA256

3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14
SHA512

17f70d269b7be8fe4d8fa2b5bca88188c318991ac168d54f37237bbacaf9804e8aa7e6b81a2320bcd61d2a109728461d8082cd69e6b0ed8f1f90600b1ecaed9f
SSDEEP

6144:9cfbg4zibFpLoydp2T7NJ6/mL21Zq15LWJk59VaEh6oMHgKqHxg:Ofs0IFpq6t1Zq1h5CEhXMAKqRg

Score

10^/10

lumma stealer

Family

lumma

https://colorfulequalugliess.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4432 set thread context of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1884	1436	WerFault.exe	90
2332	1436	WerFault.exe	90

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 1608	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	89
PID 4432 wrote to memory of 1608	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	89
PID 4432 wrote to memory of 1608	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	89
PID 4432 wrote to memory of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90
PID 4432 wrote to memory of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90
PID 4432 wrote to memory of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90
PID 4432 wrote to memory of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90
PID 4432 wrote to memory of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90
PID 4432 wrote to memory of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90
PID 4432 wrote to memory of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90
PID 4432 wrote to memory of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90
PID 4432 wrote to memory of 1436	4432	3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe	90

C:\Users\Admin\AppData\Local\Temp\3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe
"C:\Users\Admin\AppData\Local\Temp\3e1451fbd94c852f561fdb5332a5a8576d940d95b1a8cff4dfc0285bc9fc0b14.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1224
    3⤵
    - Program crash
    PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 1216
    3⤵
    - Program crash
    PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1436 -ip 1436
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1436 -ip 1436
1⤵
PID:2416

memory/1436-14-0x0000000000CE0000-0x0000000000D12000-memory.dmp

Filesize
200KB

Download
memory/1436-11-0x0000000000CE0000-0x0000000000D12000-memory.dmp

Filesize
200KB

Download
memory/1436-4-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1436-17-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1436-9-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1436-15-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1436-12-0x0000000000CE0000-0x0000000000D12000-memory.dmp

Filesize
200KB

Download
memory/1436-13-0x0000000000CE0000-0x0000000000D12000-memory.dmp

Filesize
200KB

Download
memory/1436-16-0x0000000000CE0000-0x0000000000D12000-memory.dmp

Filesize
200KB

Download
memory/4432-0-0x00000000008C0000-0x0000000000916000-memory.dmp

Filesize
344KB

Download
memory/4432-1-0x00000000745D0000-0x0000000074D80000-memory.dmp

Filesize
7.7MB

Download
memory/4432-10-0x0000000002D70000-0x0000000004D70000-memory.dmp

Filesize
32.0MB

Download
memory/4432-8-0x00000000745D0000-0x0000000074D80000-memory.dmp

Filesize
7.7MB

Download
memory/4432-18-0x0000000002D70000-0x0000000004D70000-memory.dmp

Filesize
32.0MB

Download