lumma | 6c2a40998028849e7f033918065886102be34e9674e17c7d9db6f3877bc85a9c

Analysis

max time kernel
601s
max time network
1593s
platform
windows10-1703_x64
resource
win10-20240404-de
resource tags

arch:x64arch:x86image:win10-20240404-delocale:de-deos:windows10-1703-x64systemwindows
submitted
25-04-2024 15:26

Target

Setup.exe
Size

1.2MB
MD5

0edc62a65d1081dc5d7b85b678ab57a5
SHA1

1e1448bcce4f519920f50e12cbe27b79418036b3
SHA256

3ea65c50a29c3ae43f9bd78041b110785429a768b3e006da768baaf12f327b63
SHA512

4ab96c86203104d741c166f1980b04a5e74c1e294b676c4dccaee9eca5308ea729099d7dbfea605b5037181c57c4f870fe0b3ff5008b4f8b2b60ed0f95cc1db2
SSDEEP

24576:0g16H28pon7yhsS6RUOviFG7IrCJ366q1FP3fkTV:0O0on7yhsS6RUFUDRVskTV

Score

10^/10

lumma stealer

Family

lumma

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 3800 set thread context of 4948 3800 Setup.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3680 3800 WerFault.exe Setup.exe

description	pid	process	target process
PID 3800 set thread context of 4948	3800	Setup.exe	RegAsm.exe

pid	pid_target	process	target process
3680	3800	WerFault.exe	Setup.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 3800 wrote to memory of 3820	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 3820	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 3820	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 4948	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 4948	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 4948	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 4948	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 4948	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 4948	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 4948	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 4948	3800	Setup.exe	RegAsm.exe
PID 3800 wrote to memory of 4948	3800	Setup.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 648
  2⤵
  - Program crash
  PID:3680

memory/3800-1-0x00000000002D0000-0x0000000000403000-memory.dmp

Filesize
1.2MB

Download
memory/3800-5-0x00000000002D0000-0x0000000000403000-memory.dmp

Filesize
1.2MB

Download
memory/4948-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4948-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4948-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download