lumma | 0c0795955730ac1988aa527cd4dc21d9c8ac7ae9d4837b5e63f50e870171ec87

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 01:26

Target

software2_17_6_23/loader.exe
Size

460KB
MD5

8a1801714426d29d63eb25aa92f402a9
SHA1

a6861884cbde9e99d23a4ce6bb221a6dddb4ed54
SHA256

1345bdc232ecd7cfb835fe479ad5c172a59c18477bdc130ff0d492be56ce445f
SHA512

0dee009f6074db73d3f5b3edda5b9305ed9134abc867f41f6217b3cb250c8511f9fc03b552adb0f80e8845cb02b829fc87ed6d571fb21abd008535e0bf4df9a4
SSDEEP

6144:QpxFEXF3kSfQJ0SlD9tH/xR0h3uFEmLAuIHbXInETPmDF69pVYx/RKlDa+3VgmwA:gxFi00sr/63uFTkcns93kRMu+qpm

Score

10^/10

lumma stealer

Family

lumma

https://mazefearcontainujsy.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

loader.exe

description pid process target process

PID 1944 set thread context of 4848 1944 loader.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3856 1944 WerFault.exe loader.exe

description	pid	process	target process
PID 1944 set thread context of 4848	1944	loader.exe	RegAsm.exe

pid	pid_target	process	target process
3856	1944	WerFault.exe	loader.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

loader.exe

description	pid	process	target process
PID 1944 wrote to memory of 4848	1944	loader.exe	RegAsm.exe
PID 1944 wrote to memory of 4848	1944	loader.exe	RegAsm.exe
PID 1944 wrote to memory of 4848	1944	loader.exe	RegAsm.exe
PID 1944 wrote to memory of 4848	1944	loader.exe	RegAsm.exe
PID 1944 wrote to memory of 4848	1944	loader.exe	RegAsm.exe
PID 1944 wrote to memory of 4848	1944	loader.exe	RegAsm.exe
PID 1944 wrote to memory of 4848	1944	loader.exe	RegAsm.exe
PID 1944 wrote to memory of 4848	1944	loader.exe	RegAsm.exe
PID 1944 wrote to memory of 4848	1944	loader.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\software2_17_6_23\loader.exe
"C:\Users\Admin\AppData\Local\Temp\software2_17_6_23\loader.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 368
  2⤵
  - Program crash
  PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1944 -ip 1944
1⤵
PID:2444

memory/1944-0-0x0000000000D30000-0x0000000000DA4000-memory.dmp

Filesize
464KB

Download
memory/1944-5-0x0000000000D30000-0x0000000000DA4000-memory.dmp

Filesize
464KB

Download
memory/4848-1-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4848-3-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4848-4-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4848-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download