lumma | 2e6c8a11802c29c7aaaa8cfbc4d75bc931da02dc7dd48f354fde82aa50b91789

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 09:46

Target

2e6c8a11802c29c7aaaa8cfbc4d75bc931da02dc7dd48f354fde82aa50b91789.exe
Size

363KB
MD5

f77dbc261180b8e50f46e99bd4a6be62
SHA1

65d24521fba6fc64c9271df84271c6cfae1bfd5d
SHA256

2e6c8a11802c29c7aaaa8cfbc4d75bc931da02dc7dd48f354fde82aa50b91789
SHA512

0cd0efa60f71e33033911ef85e85c43e45c1620310d9f074eed2a8249dc4f26b0272245a33a3a9b0cce0f02fc0a307bcd0edd6114bd9dc254e7a81235df4cde6
SSDEEP

6144:6egTJY4jqg5q20BQTKnVSwZIsDORLsXdBxX0G:6hdY+bq27TKnAwZIsDOhEXX0G

Score

10^/10

lumma stealer

Family

lumma

https://strollheavengwu.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4184 3888 WerFault.exe 2e6c8a11802c29c7aaaa8cfbc4d75bc931da02dc7dd48f354fde82aa50b91789.exe

pid	pid_target	process	target process
4184	3888	WerFault.exe	2e6c8a11802c29c7aaaa8cfbc4d75bc931da02dc7dd48f354fde82aa50b91789.exe

C:\Users\Admin\AppData\Local\Temp\2e6c8a11802c29c7aaaa8cfbc4d75bc931da02dc7dd48f354fde82aa50b91789.exe
"C:\Users\Admin\AppData\Local\Temp\2e6c8a11802c29c7aaaa8cfbc4d75bc931da02dc7dd48f354fde82aa50b91789.exe"
1⤵
PID:3888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 1088
  2⤵
  - Program crash
  PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3888 -ip 3888
1⤵
PID:4192

memory/3888-1-0x0000000002E30000-0x0000000002F30000-memory.dmp

Filesize
1024KB

Download
memory/3888-2-0x0000000002DB0000-0x0000000002DFB000-memory.dmp

Filesize
300KB

Download
memory/3888-3-0x0000000000400000-0x0000000002C3E000-memory.dmp

Filesize
40.2MB

Download
memory/3888-4-0x0000000000400000-0x0000000002C3E000-memory.dmp

Filesize
40.2MB

Download
memory/3888-5-0x0000000000400000-0x0000000002C3E000-memory.dmp

Filesize
40.2MB

Download
memory/3888-6-0x0000000002DB0000-0x0000000002DFB000-memory.dmp

Filesize
300KB

Download