lumma | e1a876852a42d221b5bb7a2d934e50c31d2006f9df258dab589b0078cc6c63f3

Analysis

max time kernel
15s
max time network
24s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-04-2024 19:58

Target

GamePingBooster/Setup.exe
Size

493KB
MD5

979119c0ff7fe623c1115a1a965507d2
SHA1

26bda6aa1aef1243aae1da88e986af6c8e990fd1
SHA256

84b587ec425746bfa985048f3c189fd96f485759e5cc78d90c8287764b08ae17
SHA512

d716badbfd48216a51b0bc0a1b49ce7011d047c8609a2f0cdd25273e4c72222704cdd6071bce1fdc9ba46b042206525dd0fba0e76306ac44c996c4874986da3d
SSDEEP

12288:Wx36Rr9pdHMJtOmz448EY3lfEX9ZNNp4bZu32pteE:WR67HHMbrE4BYWqZ06A

Score

10^/10

lumma stealer

Family

lumma

https://bordersoarmanusjuw.shop/api

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 2424 set thread context of 4048 2424 Setup.exe RegAsm.exe

description	pid	process	target process
PID 2424 set thread context of 4048	2424	Setup.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 2424 wrote to memory of 4048	2424	Setup.exe	RegAsm.exe
PID 2424 wrote to memory of 4048	2424	Setup.exe	RegAsm.exe
PID 2424 wrote to memory of 4048	2424	Setup.exe	RegAsm.exe
PID 2424 wrote to memory of 4048	2424	Setup.exe	RegAsm.exe
PID 2424 wrote to memory of 4048	2424	Setup.exe	RegAsm.exe
PID 2424 wrote to memory of 4048	2424	Setup.exe	RegAsm.exe
PID 2424 wrote to memory of 4048	2424	Setup.exe	RegAsm.exe
PID 2424 wrote to memory of 4048	2424	Setup.exe	RegAsm.exe
PID 2424 wrote to memory of 4048	2424	Setup.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\GamePingBooster\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\GamePingBooster\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4048

memory/2424-1-0x0000000000FF0000-0x000000000106E000-memory.dmp

Filesize
504KB

Download
memory/2424-2-0x0000000000FF0000-0x000000000106E000-memory.dmp

Filesize
504KB

Download
memory/4048-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4048-4-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4048-5-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download