lumma | 8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478

Analysis

max time kernel
137s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 01:19

Target

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe
Size

308KB
MD5

818b475b766c54df6d845cb10b6eedcf
SHA1

69ba418b84f5eb0930ba483c8fb1d8416b0b8749
SHA256

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478
SHA512

93371ece9326b2e88425c01d4f6f7dcc19ae5ee252295d8ddf283bc21ae4f5a72761b0f3ae1204dc85fcd1a11096ccd6c3af4b9e6a85ad9833e8cb06b85c5ca4
SSDEEP

6144:YsFFiBD/2f50sJknDeebx5pAsqL3N8MYk7ZA9k+AEGYeBTNEV:0ghHunDeebx5U2MYkZDEGYeBTiV

Score

10^/10

lumma stealer

Family

lumma

https://economicscreateojsu.shop/api

https://entitlementappwo.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://bordersoarmanusjuw.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2836 set thread context of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91
PID 2836 wrote to memory of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91
PID 2836 wrote to memory of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91
PID 2836 wrote to memory of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91
PID 2836 wrote to memory of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91
PID 2836 wrote to memory of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91
PID 2836 wrote to memory of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91
PID 2836 wrote to memory of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91
PID 2836 wrote to memory of 4972	2836	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	91

C:\Users\Admin\AppData\Local\Temp\8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe
"C:\Users\Admin\AppData\Local\Temp\8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:2188

memory/2836-0-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/2836-1-0x00000000007B0000-0x0000000000804000-memory.dmp

Filesize
336KB

Download
memory/2836-9-0x0000000002C30000-0x0000000004C30000-memory.dmp

Filesize
32.0MB

Download
memory/2836-11-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/4972-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4972-8-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4972-10-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4972-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download