lumma | f6a395732f5dfe45c1b53e1a544f31826d5f310499de2170e9064ac9605a913e

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:21

Target

9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe
Size

1.2MB
MD5

2147c11ffa13334a34f408d09dcf41c0
SHA1

a8d54ee44c76e334ed711da869eabbb138edc075
SHA256

9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374
SHA512

491312f8f9c40fc85b5ec96b1c35515e401c61c42c126ec4d9ea44a01cb2e555b4c653fa5f4add5303ae28f1d11a02d301f850af8125e0803fc8c6abbe1223d3
SSDEEP

24576:aFbBVjq4OlBp29oNIn8iagVCU8ubYEobt2j:ax8lBp29oNMYuwtc

Score

10^/10

lumma stealer

Family

lumma

https://productivelookewr.shop/api

https://tolerateilusidjukl.shop/api

https://shatterbreathepsw.shop/api

https://shortsvelventysjo.shop/api

https://incredibleextedwj.shop/api

https://alcojoldwograpciw.shop/api

https://liabilitynighstjsko.shop/api

https://demonstationfukewko.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe

description	pid	process	target process
PID 2428 set thread context of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3620 2428 WerFault.exe 9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe

pid	pid_target	process	target process
3620	2428	WerFault.exe	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe

description	pid	process	target process
PID 2428 wrote to memory of 3000	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3000	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3000	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe
PID 2428 wrote to memory of 3352	2428	9c51d813e0b6dfff0694c63e6d13665bb46ddf09cedb2159d701913f09142374.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 332
2⤵
- Program crash
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2428 -ip 2428
1⤵
PID:5972

memory/2428-0-0x0000000000629000-0x000000000062B000-memory.dmp

Filesize
8KB

Download
memory/3352-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3352-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3352-4-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3352-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download