lumma | 91e268e53754fcaaab91a3ad32ca4f67fbfc4903e75733a7174d28e1b85dd190

Analysis

max time kernel
140s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 11:29

Target

setup-win-x86-x64.exe
Size

73.4MB
MD5

1a3657ef519e3d20930f400dd781dbb2
SHA1

14391c5fcc47ce885680ae6dc191181119c593b1
SHA256

3669c3c9c47a5e5c59f508976a2732aa1feabfa7c90d1912032e3426c30edde5
SHA512

227e9986168c5dfe37661a010fe41abcffa794855bdde768699cdb4a3d3e3c97890da1f797de45f31f9b6498493e57377c29ac4e9eba63877c65f6f5897c0ea2
SSDEEP

786432:AWIFb9WoY4hZZEZoFFm3ruVfp1uVS+w1UEXoqm:TGWEZZEZoeIBUwu7

Score

10^/10

lumma stealer

Family

lumma

https://alcojoldwograpciw.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

setup-win-x86-x64.exe

description pid process target process

PID 3652 set thread context of 4920 3652 setup-win-x86-x64.exe BitLockerToGo.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

setup-win-x86-x64.exe

description pid process

Token: SeDebugPrivilege 3652 setup-win-x86-x64.exe

description	pid	process	target process
PID 3652 set thread context of 4920	3652	setup-win-x86-x64.exe	BitLockerToGo.exe

description	pid	process
Token: SeDebugPrivilege	3652	setup-win-x86-x64.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

setup-win-x86-x64.exe

description	pid	process	target process
PID 3652 wrote to memory of 4920	3652	setup-win-x86-x64.exe	BitLockerToGo.exe
PID 3652 wrote to memory of 4920	3652	setup-win-x86-x64.exe	BitLockerToGo.exe
PID 3652 wrote to memory of 4920	3652	setup-win-x86-x64.exe	BitLockerToGo.exe
PID 3652 wrote to memory of 4920	3652	setup-win-x86-x64.exe	BitLockerToGo.exe
PID 3652 wrote to memory of 4920	3652	setup-win-x86-x64.exe	BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\setup-win-x86-x64.exe
"C:\Users\Admin\AppData\Local\Temp\setup-win-x86-x64.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:4920

memory/3652-4-0x00007FF658530000-0x00007FF65CFA8000-memory.dmp

Filesize
74.5MB

Download
memory/3652-8-0x00007FF658530000-0x00007FF65CFA8000-memory.dmp

Filesize
74.5MB

Download
memory/4920-5-0x0000000000DA0000-0x0000000000DEE000-memory.dmp

Filesize
312KB

Download
memory/4920-7-0x0000000000DA0000-0x0000000000DEE000-memory.dmp

Filesize
312KB

Download
memory/4920-9-0x0000000000DA0000-0x0000000000DEE000-memory.dmp

Filesize
312KB

Download