lumma | b4fba8a4ffa218678ca7cf1f75af4bcb2b6d2ee1880bd9a03e4c51c9030f2e49

Analysis

max time kernel
11s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 04:25

Target

LauncherModMenu v1.12.exe
Size

489KB
MD5

f42bf6d96690525c1736bb2d82e239ce
SHA1

ef66dcc2595d03b717fd664d8dda8a8352142fca
SHA256

b4fba8a4ffa218678ca7cf1f75af4bcb2b6d2ee1880bd9a03e4c51c9030f2e49
SHA512

146961a4d0e319a7606c121fc208722cd9f532b6db9a54443ecb65f46d7c42430f628450d6a0c3b2510308c9b0c8e9d7ed430b0d36a7fe5be24a8690b2b768e7
SSDEEP

12288:SU/qlWEJNgZ3Kcj0PP8oQkbdGy17kDGixc6hsWF76kpjoCe:nqlXJNYacgn/lbdGy0DuqYecR

Score

10^/10

lumma stealer

Family

lumma

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

LauncherModMenu v1.12.exe

description pid process target process

PID 3776 set thread context of 3428 3776 LauncherModMenu v1.12.exe RegAsm.exe

description	pid	process	target process
PID 3776 set thread context of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

LauncherModMenu v1.12.exe

description	pid	process	target process
PID 3776 wrote to memory of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe
PID 3776 wrote to memory of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe
PID 3776 wrote to memory of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe
PID 3776 wrote to memory of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe
PID 3776 wrote to memory of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe
PID 3776 wrote to memory of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe
PID 3776 wrote to memory of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe
PID 3776 wrote to memory of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe
PID 3776 wrote to memory of 3428	3776	LauncherModMenu v1.12.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\LauncherModMenu v1.12.exe
"C:\Users\Admin\AppData\Local\Temp\LauncherModMenu v1.12.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3428

memory/3428-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3428-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3428-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3428-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3776-1-0x0000000000C40000-0x0000000000CBE000-memory.dmp

Filesize
504KB

Download
memory/3776-4-0x0000000000C40000-0x0000000000CBE000-memory.dmp

Filesize
504KB

Download