lumma | e1a876852a42d221b5bb7a2d934e50c31d2006f9df258dab589b0078cc6c63f3

Analysis

max time kernel
40s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 19:55

Target

GamePingBooster/Setup.exe
Size

493KB
MD5

979119c0ff7fe623c1115a1a965507d2
SHA1

26bda6aa1aef1243aae1da88e986af6c8e990fd1
SHA256

84b587ec425746bfa985048f3c189fd96f485759e5cc78d90c8287764b08ae17
SHA512

d716badbfd48216a51b0bc0a1b49ce7011d047c8609a2f0cdd25273e4c72222704cdd6071bce1fdc9ba46b042206525dd0fba0e76306ac44c996c4874986da3d
SSDEEP

12288:Wx36Rr9pdHMJtOmz448EY3lfEX9ZNNp4bZu32pteE:WR67HHMbrE4BYWqZ06A

Score

10^/10

lumma stealer

Family

lumma

https://bordersoarmanusjuw.shop/api

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Drops file in System32 directory 11 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 2936 set thread context of 3616 2936 Setup.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

mspaint.exe

pid process

228 mspaint.exe
228 mspaint.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

mspaint.exe

pid process

228 mspaint.exe

description	pid	process	target process
PID 2936 set thread context of 3616	2936	Setup.exe	RegAsm.exe

pid	process
228	mspaint.exe
228	mspaint.exe

pid	process
228	mspaint.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 2936 wrote to memory of 724	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 724	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 724	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 3616	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 3616	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 3616	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 3616	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 3616	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 3616	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 3616	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 3616	2936	Setup.exe	RegAsm.exe
PID 2936 wrote to memory of 3616	2936	Setup.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\GamePingBooster\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\GamePingBooster\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:2228

memory/2228-20-0x0000021D3C970000-0x0000021D3C971000-memory.dmp

Filesize
4KB

Download
memory/2228-7-0x0000021D33D60000-0x0000021D33D70000-memory.dmp

Filesize
64KB

Download
memory/2228-11-0x0000021D33DA0000-0x0000021D33DB0000-memory.dmp

Filesize
64KB

Download
memory/2228-18-0x0000021D3C8F0000-0x0000021D3C8F1000-memory.dmp

Filesize
4KB

Download
memory/2228-22-0x0000021D3C970000-0x0000021D3C971000-memory.dmp

Filesize
4KB

Download
memory/2228-23-0x0000021D3CA10000-0x0000021D3CA11000-memory.dmp

Filesize
4KB

Download
memory/2228-24-0x0000021D3CA10000-0x0000021D3CA11000-memory.dmp

Filesize
4KB

Download
memory/2936-2-0x0000000000DC0000-0x0000000000E3E000-memory.dmp

Filesize
504KB

Download
memory/2936-0-0x0000000000DC0000-0x0000000000E3E000-memory.dmp

Filesize
504KB

Download
memory/3616-1-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3616-4-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3616-5-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3616-6-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download