lumma | ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4

Analysis

max time kernel
190s
max time network
306s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 23:16

Target

ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe
Size

8.9MB
MD5

a4ac2edda7280dfabfc0e168ad4a0f71
SHA1

c545cd8c7801f480ea3f311d7ab2fe8b79b8c85b
SHA256

ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4
SHA512

915f40c008695d1ecb656e6a54ec79f8a69eff42b9a33f5060a0ec0b58b80f3493773e229a9dc10855ce457b8ab138b4750541fccf4eb1196aca792943bdecd8
SSDEEP

49152:UJfUsBjuiwj8R2L0SZEGpG0bHMrpZWHyQiyz6y26vDNhsx8dJPxTtja25EHZKeqT:c9KiwgRu09ZWHyQi1yRBEHZ7xUnne8

Score

10^/10

lumma stealer

Family

lumma

https://democraticseekysiwo.shop/api

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://bordersoarmanusjuw.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe

description	pid	process	target process
PID 944 set thread context of 4572	944	ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe

description	pid	process	target process
PID 944 wrote to memory of 4572	944	ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe	BitLockerToGo.exe
PID 944 wrote to memory of 4572	944	ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe	BitLockerToGo.exe
PID 944 wrote to memory of 4572	944	ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe	BitLockerToGo.exe
PID 944 wrote to memory of 4572	944	ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe	BitLockerToGo.exe
PID 944 wrote to memory of 4572	944	ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe	BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe
"C:\Users\Admin\AppData\Local\Temp\ec0949ba67afa666619ee7906753c470adaac94331f67a9d968405c57f3474d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:4572

memory/944-4-0x00007FF63D9A0000-0x00007FF63E329000-memory.dmp

Filesize
9.5MB

Download
memory/944-6-0x00007FF63D9A0000-0x00007FF63E329000-memory.dmp

Filesize
9.5MB

Download
memory/4572-5-0x00000000009F0000-0x0000000000A3F000-memory.dmp

Filesize
316KB

Download
memory/4572-8-0x00000000009F0000-0x0000000000A3F000-memory.dmp

Filesize
316KB

Download
memory/4572-9-0x00000000009F0000-0x0000000000A3F000-memory.dmp

Filesize
316KB

Download