lumma | 9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 01:43

Target

9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe
Size

9.9MB
MD5

2627387eb5495186ee3850fdc0b2ebde
SHA1

8c062c24ad34332f8033a8cac193e4519d3d7534
SHA256

9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e
SHA512

0c86e0b5de1b149913b7039fcc3fb8dcc17112617a5af731c3c90d6c822dbb7f2f5660e5790d0c134437383d5b6a71176839c0125c6c391f4ea26ffce0480b25
SSDEEP

49152:jJlStcFBY6j7b7zh0+6XM8i35UPSjVhw4LQOhXbjotS+BYsRKzOmXkcENi5Iq2rY:7SmFWivt8dYw406Lcg+BnY5REuB4Y

Score

10^/10

lumma stealer

Family

lumma

https://palmeventeryjusk.shop/api

https://entitlementappwo.shop/api

https://economicscreateojsu.shop/api

https://pushjellysingeywus.shop/api

https://absentconvicsjawun.shop/api

https://suitcaseacanehalk.shop/api

https://bordersoarmanusjuw.shop/api

https://mealplayerpreceodsju.shop/api

https://wifeplasterbakewis.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe

description	pid	process	target process
PID 4012 set thread context of 3240	4012	9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe

description	pid	process	target process
PID 4012 wrote to memory of 3240	4012	9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe	BitLockerToGo.exe
PID 4012 wrote to memory of 3240	4012	9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe	BitLockerToGo.exe
PID 4012 wrote to memory of 3240	4012	9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe	BitLockerToGo.exe
PID 4012 wrote to memory of 3240	4012	9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe	BitLockerToGo.exe
PID 4012 wrote to memory of 3240	4012	9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe	BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe
"C:\Users\Admin\AppData\Local\Temp\9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:3240

memory/3240-5-0x0000000000940000-0x000000000098F000-memory.dmp

Filesize
316KB

Download
memory/3240-8-0x0000000000940000-0x000000000098F000-memory.dmp

Filesize
316KB

Download
memory/3240-9-0x0000000000940000-0x000000000098F000-memory.dmp

Filesize
316KB

Download
memory/3240-10-0x0000000000940000-0x000000000098F000-memory.dmp

Filesize
316KB

Download
memory/4012-4-0x00007FF7E7920000-0x00007FF7E8366000-memory.dmp

Filesize
10.3MB

Download
memory/4012-6-0x00007FF7E7920000-0x00007FF7E8366000-memory.dmp

Filesize
10.3MB

Download