lumma | e22a5cadeacc1a9d95354d85bdc17f6ab2dc5d23efe7df6d3d4683fb7b881a52

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:26

Target

6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe
Size

1.2MB
MD5

49653516356b84287648a3fbb3681ef3
SHA1

18d25bf8c3f6c8557d87966f8ea39c8f05f9f875
SHA256

6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8
SHA512

87d1127a9caa03f72f3c4b7f6215651e618cd2bad0c46100a5a5c921170d8fd5ba8dae53918efd18de3a8a305c95280b3558ac9d32081f33146e973104cdfc5a
SSDEEP

24576:UfBNveElInZKRPgiGiJvvTd1Y/ikf9PvXkfICSTxnO36c:UJ5InZKRPgiGi5YFBPGIjOh

Score

10^/10

lumma stealer

Family

lumma

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe

description	pid	process	target process
PID 4248 set thread context of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1388 4248 WerFault.exe 6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe

pid	pid_target	process	target process
1388	4248	WerFault.exe	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe

description	pid	process	target process
PID 4248 wrote to memory of 444	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 444	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 444	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe
PID 4248 wrote to memory of 1804	4248	6ade339142b77016063402bfde9702b7b9bb644452bae38929035daf779beae8.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 356
2⤵
- Program crash
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4248 -ip 4248
1⤵
PID:756

memory/1804-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1804-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1804-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1804-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4248-0-0x0000000001086000-0x0000000001087000-memory.dmp

Filesize
4KB

Download