lumma | f6118906089648011f680ab947be7a90dc3103abf253999f43c89d7b1e8bbad3

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 09:27

Target

f6118906089648011f680ab947be7a90dc3103abf253999f43c89d7b1e8bbad3.exe
Size

372KB
MD5

dc29fef0bb3af2761613d048e61e2ecb
SHA1

862e7bfc73a10069fdea344083d85ebe5617b64e
SHA256

f6118906089648011f680ab947be7a90dc3103abf253999f43c89d7b1e8bbad3
SHA512

b4b2958ae8bb9d79b481c411fd97da6ff677d001997e7d0331a73544303b7f7362fe6d610e90d436630feffd2ca48ab2775f8040e6ef817c3279d69ccef7a5b5
SSDEEP

6144:jRWiZauQXW7ViqBvUgdazWHmXADqSw9MEoTkkyT:jRbZauOenFUgk6HmXuqxbiC

Score

10^/10

lumma stealer

Family

lumma

https://strollheavengwu.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3980 5012 WerFault.exe f6118906089648011f680ab947be7a90dc3103abf253999f43c89d7b1e8bbad3.exe

pid	pid_target	process	target process
3980	5012	WerFault.exe	f6118906089648011f680ab947be7a90dc3103abf253999f43c89d7b1e8bbad3.exe

C:\Users\Admin\AppData\Local\Temp\f6118906089648011f680ab947be7a90dc3103abf253999f43c89d7b1e8bbad3.exe
"C:\Users\Admin\AppData\Local\Temp\f6118906089648011f680ab947be7a90dc3103abf253999f43c89d7b1e8bbad3.exe"
1⤵
PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 1076
  2⤵
  - Program crash
  PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5012 -ip 5012
1⤵
PID:4056

memory/5012-1-0x0000000004210000-0x0000000004310000-memory.dmp

Filesize
1024KB

Download
memory/5012-2-0x0000000005CB0000-0x0000000005CFB000-memory.dmp

Filesize
300KB

Download
memory/5012-3-0x0000000000400000-0x000000000404D000-memory.dmp

Filesize
60.3MB

Download
memory/5012-4-0x0000000005CB0000-0x0000000005CFB000-memory.dmp

Filesize
300KB

Download