lumma | 491d7b93c49438ac2b97e8ad343b99abbcc3536d9d32de6972ff64a7ec32f858

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 05:00

Target

tmp.exe
Size

478KB
MD5

b3487e31f2f1fe5c761d63cc3bac5000
SHA1

1d60084d6713d0574244d291fee586f663079e41
SHA256

491d7b93c49438ac2b97e8ad343b99abbcc3536d9d32de6972ff64a7ec32f858
SHA512

587ad89b74e83d657d13a280b713330686be6e82c74f42b0f318d38b4abe833689d7b542ba577f6be0242b7d63f8b4bdf4e79ac7edbcbc329f618365e1b3751c
SSDEEP

12288:Sk8jfo4Q3OV75FkRIp35B/j5XfZzJqMnjP:mDUqFzjlfWMjP

Score

10^/10

lumma stealer

Family

lumma

https://alcojoldwograpciw.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 556 set thread context of 4052 556 tmp.exe RegAsm.exe

description	pid	process	target process
PID 556 set thread context of 4052	556	tmp.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 556 wrote to memory of 4052	556	tmp.exe	RegAsm.exe
PID 556 wrote to memory of 4052	556	tmp.exe	RegAsm.exe
PID 556 wrote to memory of 4052	556	tmp.exe	RegAsm.exe
PID 556 wrote to memory of 4052	556	tmp.exe	RegAsm.exe
PID 556 wrote to memory of 4052	556	tmp.exe	RegAsm.exe
PID 556 wrote to memory of 4052	556	tmp.exe	RegAsm.exe
PID 556 wrote to memory of 4052	556	tmp.exe	RegAsm.exe
PID 556 wrote to memory of 4052	556	tmp.exe	RegAsm.exe
PID 556 wrote to memory of 4052	556	tmp.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4052

memory/556-0-0x0000000000B80000-0x0000000000BFC000-memory.dmp

Filesize
496KB

Download
memory/556-3-0x0000000000B80000-0x0000000000BFC000-memory.dmp

Filesize
496KB

Download
memory/4052-1-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4052-6-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4052-5-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4052-7-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download