lumma | 85befba77a3bb1b50c1192d10fddd913ad927adbce5f404ea43e2be617a68543

Analysis

max time kernel
52s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 19:50

Target

Executor.exe
Size

284KB
MD5

246558ed006f01b60498078cfa630990
SHA1

e8b28476ca22c13c7854d4977ae9a4fc0c6c0aaa
SHA256

85befba77a3bb1b50c1192d10fddd913ad927adbce5f404ea43e2be617a68543
SHA512

2d74dbb8f1e146ed0d77c87b711a7c452f483bfbde702956abff832cd5b96ba5984eeb3b2786e51e365f655ecfac146dba610cd9a898355d5bdf0f611311edcd
SSDEEP

6144:IvGq/DOrjFEjeW9G+9EEj+3zEf7/jEDcHxTA8dCk:g//DO3ejs+9EpYDIqUq

Score

10^/10

lumma stealer

Family

lumma

https://directorryversionyju.shop/api

https://birdpenallitysydw.shop/api

https://cinemaclinicttanwk.shop/api

https://disagreemenywyws.shop/api

https://speedparticipatewo.shop/api

https://fixturewordbakewos.shop/api

https://colorprioritytubbew.shop/api

https://abuselinenaidwjuew.shop/api

https://methodgreenglassdatw.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Executor.exe

description pid process target process

PID 2464 set thread context of 3224 2464 Executor.exe RegAsm.exe

description	pid	process	target process
PID 2464 set thread context of 3224	2464	Executor.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Executor.exe

description	pid	process	target process
PID 2464 wrote to memory of 3224	2464	Executor.exe	RegAsm.exe
PID 2464 wrote to memory of 3224	2464	Executor.exe	RegAsm.exe
PID 2464 wrote to memory of 3224	2464	Executor.exe	RegAsm.exe
PID 2464 wrote to memory of 3224	2464	Executor.exe	RegAsm.exe
PID 2464 wrote to memory of 3224	2464	Executor.exe	RegAsm.exe
PID 2464 wrote to memory of 3224	2464	Executor.exe	RegAsm.exe
PID 2464 wrote to memory of 3224	2464	Executor.exe	RegAsm.exe
PID 2464 wrote to memory of 3224	2464	Executor.exe	RegAsm.exe
PID 2464 wrote to memory of 3224	2464	Executor.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:232

memory/2464-0-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/2464-1-0x0000000000DA0000-0x0000000000DEE000-memory.dmp

Filesize
312KB

Download
memory/2464-7-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/2464-8-0x00000000031D0000-0x00000000051D0000-memory.dmp

Filesize
32.0MB

Download
memory/2464-13-0x00000000031D0000-0x00000000051D0000-memory.dmp

Filesize
32.0MB

Download
memory/3224-4-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3224-10-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3224-11-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3224-12-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download