lumma | e1a876852a42d221b5bb7a2d934e50c31d2006f9df258dab589b0078cc6c63f3

Analysis

max time kernel
33s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 19:58

Target

GamePingBooster/Setup.exe
Size

493KB
MD5

979119c0ff7fe623c1115a1a965507d2
SHA1

26bda6aa1aef1243aae1da88e986af6c8e990fd1
SHA256

84b587ec425746bfa985048f3c189fd96f485759e5cc78d90c8287764b08ae17
SHA512

d716badbfd48216a51b0bc0a1b49ce7011d047c8609a2f0cdd25273e4c72222704cdd6071bce1fdc9ba46b042206525dd0fba0e76306ac44c996c4874986da3d
SSDEEP

12288:Wx36Rr9pdHMJtOmz448EY3lfEX9ZNNp4bZu32pteE:WR67HHMbrE4BYWqZ06A

Score

10^/10

lumma stealer

Family

lumma

https://bordersoarmanusjuw.shop/api

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 5072 set thread context of 944 5072 Setup.exe RegAsm.exe

description	pid	process	target process
PID 5072 set thread context of 944	5072	Setup.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 5072 wrote to memory of 3628	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 3628	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 3628	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 944	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 944	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 944	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 944	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 944	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 944	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 944	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 944	5072	Setup.exe	RegAsm.exe
PID 5072 wrote to memory of 944	5072	Setup.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:944

memory/944-1-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/944-4-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/944-5-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/944-6-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/5072-0-0x0000000000420000-0x000000000049E000-memory.dmp

Filesize
504KB

Download
memory/5072-3-0x0000000000420000-0x000000000049E000-memory.dmp

Filesize
504KB

Download