lumma | cdb0621892adf55602c0b39e81047764f16cf6e76aabd0438a02525c84a72c9d

Analysis

max time kernel
101s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 13:47

Target

23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe
Size

379KB
MD5

90f41880d631e243cec086557cb74d63
SHA1

cb385e4172cc227ba72baf29ca1c4411fa99a26d
SHA256

23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0
SHA512

eeb85b34aa66a7e9a1b1807012999ee439433df23126a52ffa8d4b3cb2026be3bcf63ca25f143de58ba929c0d4feeaf2a603fd6ec6b5379fc48147c22f3783e3
SSDEEP

6144:bJpEcFOcL0W0UXTAwutvdygbqD7jHSm6xBkNLt9kAWHtXMErCU8Oe:bJpdFOg0UUXNdxqLf6Xy8H/rCU8Oe

Score

10^/10

lumma stealer

Family

lumma

https://enthusiasimtitleow.shop/api

https://cleartotalfisherwo.shop/api

https://worryfillvolcawoi.shop/api

https://dismissalcylinderhostw.shop/api

https://affordcharmcropwo.shop/api

https://diskretainvigorousiw.shop/api

https://communicationgenerwo.shop/api

https://pillowbrocccolipe.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe

description	pid	process	target process
PID 3120 set thread context of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3360 3120 WerFault.exe 23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe

pid	pid_target	process	target process
3360	3120	WerFault.exe	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe

description	pid	process	target process
PID 3120 wrote to memory of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe
PID 3120 wrote to memory of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe
PID 3120 wrote to memory of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe
PID 3120 wrote to memory of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe
PID 3120 wrote to memory of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe
PID 3120 wrote to memory of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe
PID 3120 wrote to memory of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe
PID 3120 wrote to memory of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe
PID 3120 wrote to memory of 3248	3120	23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe
"C:\Users\Admin\AppData\Local\Temp\23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 828
  2⤵
  - Program crash
  PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3120 -ip 3120
1⤵
PID:3928

memory/3120-0-0x0000000000AE0000-0x0000000000B46000-memory.dmp

Filesize
408KB

Download
memory/3120-1-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/3120-8-0x0000000002E80000-0x0000000004E80000-memory.dmp

Filesize
32.0MB

Download
memory/3120-14-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/3248-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3248-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3248-9-0x0000000000F80000-0x0000000000FB2000-memory.dmp

Filesize
200KB

Download
memory/3248-11-0x0000000000F80000-0x0000000000FB2000-memory.dmp

Filesize
200KB

Download
memory/3248-12-0x0000000000F80000-0x0000000000FB2000-memory.dmp

Filesize
200KB

Download
memory/3248-10-0x0000000000F80000-0x0000000000FB2000-memory.dmp

Filesize
200KB

Download
memory/3248-13-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download