lumma | b9af457abc6a1ba8abf2b857847578b888964dfa671599985fe7649695a6cb60

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 04:38

Target

e5693e87e9b7e438f4246f80f13d0f5e.exe
Size

3.9MB
MD5

e5693e87e9b7e438f4246f80f13d0f5e
SHA1

bfa226389fbeed4172d6c06dd9e5865c085945f0
SHA256

b9af457abc6a1ba8abf2b857847578b888964dfa671599985fe7649695a6cb60
SHA512

7cb5765cf7c60b9ab4ec96f600572ace3f93ba98cb899a05ad8d0ee7c62cba6c97f7308be4a7ea70bdc72225b127e2b67ae7b52b1fd53f3c33bb999670ad50d0
SSDEEP

98304:WbzczBM9Czp5+Yq501qQQS4pJ+02Ww/GJcBYX8QbvxLptP6FbKEqT:Wb4zjzKY/F4pJ2KJcBYsmxL76FbKEqT

Score

10^/10

lumma stealer

Family

lumma

https://sailsystemeyeusjw.shop/api

https://associationokeo.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2644 set thread context of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2320	5072	WerFault.exe	88

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88
PID 2644 wrote to memory of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88
PID 2644 wrote to memory of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88
PID 2644 wrote to memory of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88
PID 2644 wrote to memory of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88
PID 2644 wrote to memory of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88
PID 2644 wrote to memory of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88
PID 2644 wrote to memory of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88
PID 2644 wrote to memory of 5072	2644	e5693e87e9b7e438f4246f80f13d0f5e.exe	88

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5072 -ip 5072
1⤵
PID:3644

memory/2644-0-0x0000000000340000-0x0000000000396000-memory.dmp

Filesize
344KB

Download
memory/2644-1-0x0000000074400000-0x0000000074BB0000-memory.dmp

Filesize
7.7MB

Download
memory/2644-8-0x0000000074400000-0x0000000074BB0000-memory.dmp

Filesize
7.7MB

Download
memory/2644-10-0x0000000002750000-0x0000000004750000-memory.dmp

Filesize
32.0MB

Download
memory/2644-14-0x0000000002750000-0x0000000004750000-memory.dmp

Filesize
32.0MB

Download
memory/5072-4-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5072-9-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5072-11-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/5072-12-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/5072-13-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download