lumma | b411fa289b897c774560292abcf7c298e29e1b9b8243357b1cc7d25a28622739

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 04:59

Target

launcher.exe
Size

25.4MB
MD5

913b4744fbcd88cbc9ba44808a835a91
SHA1

d5cb6cbe5d4ad8b20a351080a6bc8e85fa72a64e
SHA256

b411fa289b897c774560292abcf7c298e29e1b9b8243357b1cc7d25a28622739
SHA512

ab0c1ec3840947262d4825bbc1cb1f0f056fceda99d7886ce7f83c432faf91a89e17f81e21132a9f997a895c0dd3cdb3d987b47608020cb1260657d782847863
SSDEEP

12288:5R5ouJIVQhcEWuDG6X/ob2qlTIiw/TmQxFZpC:dnJIG2EFlf09GTmYvC

Score

10^/10

lumma stealer

Family

lumma

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

launcher.exe

description pid process target process

PID 3288 set thread context of 2128 3288 launcher.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3456 3288 WerFault.exe launcher.exe

description	pid	process	target process
PID 3288 set thread context of 2128	3288	launcher.exe	RegAsm.exe

pid	pid_target	process	target process
3456	3288	WerFault.exe	launcher.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

launcher.exe

description	pid	process	target process
PID 3288 wrote to memory of 2128	3288	launcher.exe	RegAsm.exe
PID 3288 wrote to memory of 2128	3288	launcher.exe	RegAsm.exe
PID 3288 wrote to memory of 2128	3288	launcher.exe	RegAsm.exe
PID 3288 wrote to memory of 2128	3288	launcher.exe	RegAsm.exe
PID 3288 wrote to memory of 2128	3288	launcher.exe	RegAsm.exe
PID 3288 wrote to memory of 2128	3288	launcher.exe	RegAsm.exe
PID 3288 wrote to memory of 2128	3288	launcher.exe	RegAsm.exe
PID 3288 wrote to memory of 2128	3288	launcher.exe	RegAsm.exe
PID 3288 wrote to memory of 2128	3288	launcher.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\launcher.exe
"C:\Users\Admin\AppData\Local\Temp\launcher.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 568
  2⤵
  - Program crash
  PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3288 -ip 3288
1⤵
PID:2312

memory/2128-0-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2128-3-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2128-4-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/2128-6-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/3288-1-0x0000000000070000-0x00000000000E4000-memory.dmp

Filesize
464KB

Download
memory/3288-5-0x0000000000070000-0x00000000000E4000-memory.dmp

Filesize
464KB

Download