lumma | cf5d644ea3e2c6a2c3e3199558943595fdbf85fde2ea2c25e72238b1a13434b0

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 01:28

Target

d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b.exe
Size

8.6MB
MD5

7e37f8c945d005226870e60aa2baea93
SHA1

d8a457a032ead8cc0d692efd497914e8cc69e8a4
SHA256

d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b
SHA512

d6dfcbd1f7bca1e712bdb184a27c5a06eb1073f03529fd6be9ed2cd231e4906edf9c7bb6fd89453a7e062cc317e4655b19825fdbf7a32d0f2c3ac3ef4bc2f8d6
SSDEEP

98304:MF3gRcZz6mXSsz06DoWy0hSEVBhG/Y6Pv:IdN6mXSsFo7i/VB9w

Score

10^/10

lumma stealer

Family

lumma

https://shatterbreathepsw.shop/api

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 528 set thread context of 3616	528	d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b.exe	98

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 3616	528	d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b.exe	98
PID 528 wrote to memory of 3616	528	d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b.exe	98
PID 528 wrote to memory of 3616	528	d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b.exe	98
PID 528 wrote to memory of 3616	528	d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b.exe	98
PID 528 wrote to memory of 3616	528	d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b.exe	98

C:\Users\Admin\AppData\Local\Temp\d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b.exe
"C:\Users\Admin\AppData\Local\Temp\d130f492c40697a34e2d1e7b1e9a5e3ba37c7f6b4271271fba6b5c1e9048af8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:3616

memory/528-2-0x00007FF701520000-0x00007FF701E5E000-memory.dmp

Filesize
9.2MB

Download
memory/528-8-0x00007FF701520000-0x00007FF701E5E000-memory.dmp

Filesize
9.2MB

Download
memory/3616-5-0x0000000000590000-0x00000000005EB000-memory.dmp

Filesize
364KB

Download
memory/3616-7-0x0000000000590000-0x00000000005EB000-memory.dmp

Filesize
364KB

Download
memory/3616-9-0x0000000000590000-0x00000000005EB000-memory.dmp

Filesize
364KB

Download