lumma | 87f86c46da065ae7b74da61ceedd47e8cc80a5847dbfbb1b8cc9c113c82ba00f

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 21:20

Target

87f86c46da065ae7b74da61ceedd47e8cc80a5847dbfbb1b8cc9c113c82ba00f.exe
Size

398KB
MD5

43564bc9b7d3525a8b7b39bf99990146
SHA1

0ae67b0b98a915f933bebb4d5c143fca7b1e39d0
SHA256

87f86c46da065ae7b74da61ceedd47e8cc80a5847dbfbb1b8cc9c113c82ba00f
SHA512

5764e1338efc55d371fe81c65e236c0a96df3521702aae49471e483496133b2aac0135cc628c8bae1761f9e1107a1de26b1f6b1eefe0cecf497df5a4cbc94e21
SSDEEP

6144:ZjDyU/DQxr5T8Zu5RWr0fGlSM/Ubp6UJT3Dv:9DyU2lTCuY0+wM/UnJTTv

Score

10^/10

lumma stealer

Family

lumma

https://strollheavengwu.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2340	948	WerFault.exe	87f86c46da065ae7b74da61ceedd47e8cc80a5847dbfbb1b8cc9c113c82ba00f.exe
4856	948	WerFault.exe	87f86c46da065ae7b74da61ceedd47e8cc80a5847dbfbb1b8cc9c113c82ba00f.exe

C:\Users\Admin\AppData\Local\Temp\87f86c46da065ae7b74da61ceedd47e8cc80a5847dbfbb1b8cc9c113c82ba00f.exe
"C:\Users\Admin\AppData\Local\Temp\87f86c46da065ae7b74da61ceedd47e8cc80a5847dbfbb1b8cc9c113c82ba00f.exe"
1⤵
PID:948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 1144
  2⤵
  - Program crash
  PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 1208
  2⤵
  - Program crash
  PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 948 -ip 948
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 948 -ip 948
1⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:2512

memory/948-1-0x0000000001A40000-0x0000000001B40000-memory.dmp

Filesize
1024KB

Download
memory/948-2-0x0000000003770000-0x00000000037BE000-memory.dmp

Filesize
312KB

Download
memory/948-3-0x0000000000400000-0x0000000001A2E000-memory.dmp

Filesize
22.2MB

Download
memory/948-4-0x0000000000400000-0x0000000001A2E000-memory.dmp

Filesize
22.2MB

Download
memory/948-6-0x0000000001A40000-0x0000000001B40000-memory.dmp

Filesize
1024KB

Download
memory/948-7-0x0000000000400000-0x0000000001A2E000-memory.dmp

Filesize
22.2MB

Download
memory/948-8-0x0000000003770000-0x00000000037BE000-memory.dmp

Filesize
312KB

Download