lumma | 8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478

Analysis

max time kernel
189s
max time network
302s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 22:52

Target

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe
Size

308KB
MD5

818b475b766c54df6d845cb10b6eedcf
SHA1

69ba418b84f5eb0930ba483c8fb1d8416b0b8749
SHA256

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478
SHA512

93371ece9326b2e88425c01d4f6f7dcc19ae5ee252295d8ddf283bc21ae4f5a72761b0f3ae1204dc85fcd1a11096ccd6c3af4b9e6a85ad9833e8cb06b85c5ca4
SSDEEP

6144:YsFFiBD/2f50sJknDeebx5pAsqL3N8MYk7ZA9k+AEGYeBTNEV:0ghHunDeebx5U2MYkZDEGYeBTiV

Score

10^/10

lumma stealer

Family

lumma

https://economicscreateojsu.shop/api

https://entitlementappwo.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://bordersoarmanusjuw.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe

description	pid	process	target process
PID 372 set thread context of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe

description	pid	process	target process
PID 372 wrote to memory of 4376	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 4376	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 4376	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe
PID 372 wrote to memory of 3696	372	8ceca5e241d721a22aa11fa5fc0700c394c9c809fc2565458dedf5c45e99c478.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3696

memory/372-0-0x0000000000630000-0x0000000000684000-memory.dmp

Filesize
336KB

Download
memory/372-3-0x00000000737D0000-0x0000000073EBE000-memory.dmp

Filesize
6.9MB

Download
memory/372-8-0x0000000002880000-0x0000000004880000-memory.dmp

Filesize
32.0MB

Download
memory/372-11-0x00000000737D0000-0x0000000073EBE000-memory.dmp

Filesize
6.9MB

Download
memory/3696-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3696-7-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3696-9-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3696-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download