lumma | 795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c

Analysis

max time kernel
194s
max time network
254s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 22:47

Target

795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe
Size

308KB
MD5

3eec3effb3244d5e201139d7955a9632
SHA1

a07c184b128c3158a3e3a07bb240acc7c7663f95
SHA256

795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c
SHA512

9db6f758e882df7e9ab0b34ece52a7848011ef162af6c4d66b605bf06608f0e0aa37c8a23fe0fe0ea8f7a97a11da587d354d59d9f49568fc96a2af946ac86dba
SSDEEP

6144:7RmuVoTCpYiODBz2p3hd7PoeetrTuRHGg4mt6nIFLt7:7vMCihQ3bDoee9MmgNt6IFL9

Score

10^/10

lumma stealer

Family

lumma

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://bordersoarmanusjuw.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe

description	pid	process	target process
PID 4472 set thread context of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe

description	pid	process	target process
PID 4472 wrote to memory of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 4472 wrote to memory of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 4472 wrote to memory of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 4472 wrote to memory of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 4472 wrote to memory of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 4472 wrote to memory of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 4472 wrote to memory of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 4472 wrote to memory of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe
PID 4472 wrote to memory of 752	4472	795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe
"C:\Users\Admin\AppData\Local\Temp\795e895ae1bf82dd4533237ea30c469d3af97b8ebe1eb039adf029241622545c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:752

memory/752-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/752-7-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/752-11-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4472-0-0x0000000000DC0000-0x0000000000E14000-memory.dmp

Filesize
336KB

Download
memory/4472-2-0x0000000073750000-0x0000000073E3E000-memory.dmp

Filesize
6.9MB

Download
memory/4472-9-0x00000000031F0000-0x00000000051F0000-memory.dmp

Filesize
32.0MB

Download
memory/4472-10-0x0000000073750000-0x0000000073E3E000-memory.dmp

Filesize
6.9MB

Download
memory/4472-12-0x00000000031F0000-0x00000000051F0000-memory.dmp

Filesize
32.0MB

Download