lumma | bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b

Analysis

max time kernel
195s
max time network
255s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 23:07

Target

bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe
Size

308KB
MD5

685eb309083828ed000f400139af068b
SHA1

c53c23f4e29c39b6801ab5b7302d2839b8e115d9
SHA256

bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b
SHA512

aa347383e3a20a50fe93783bb73c5976e229700eb646623b3334eedc2235ec2b96451efe21838b8bd5baa86a5f77bf439c1c9445304634ae6fc178c269a1d7ed
SSDEEP

6144:nU0qYuTVRFiXLhUI00Fhc8b3W6DvvCimXu/fxKXpkEVKGuUqe8u6:n/qlrsN300FGl6TT3x6kzGMVu6

Score

10^/10

lumma stealer

Family

lumma

https://palmeventeryjusk.shop/api

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://bordersoarmanusjuw.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe

description	pid	process	target process
PID 2544 set thread context of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe

description	pid	process	target process
PID 2544 wrote to memory of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe
PID 2544 wrote to memory of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe
PID 2544 wrote to memory of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe
PID 2544 wrote to memory of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe
PID 2544 wrote to memory of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe
PID 2544 wrote to memory of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe
PID 2544 wrote to memory of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe
PID 2544 wrote to memory of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe
PID 2544 wrote to memory of 696	2544	bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe
"C:\Users\Admin\AppData\Local\Temp\bf8980482fbadbf2825a44966e7141a9f56a19b6cc812659e793bb82ca264c0b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:696

memory/696-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/696-9-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/696-11-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2544-0-0x00000000007F0000-0x0000000000844000-memory.dmp

Filesize
336KB

Download
memory/2544-2-0x0000000073D30000-0x000000007441E000-memory.dmp

Filesize
6.9MB

Download
memory/2544-8-0x0000000073D30000-0x000000007441E000-memory.dmp

Filesize
6.9MB

Download
memory/2544-10-0x0000000002A40000-0x0000000004A40000-memory.dmp

Filesize
32.0MB

Download
memory/2544-12-0x0000000002A40000-0x0000000004A40000-memory.dmp

Filesize
32.0MB

Download