lumma | ebd9a15280a9fbd641ead11a6ab911fd72dcd48a6226e2e161005aebc9f70813

Analysis

max time kernel
129s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 07:51

Target

6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe
Size

525KB
MD5

5d3cf134c87846baec812f1285493017
SHA1

84e3921ddf6abdf41966f9c7f0795a263d620737
SHA256

6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3
SHA512

91b843db873c59d9d39097fe3b7c9b5d940c3eb22290e0db8b754fd2e602507947886af7c1772fc8c1de3bf1d32c6814df044cd34966b7cb5ca96ed3afd49cd3
SSDEEP

12288:Ax4kdIQ5K11WygPoG9R9w5EMxMPJqG460Xp:Ax4o5KPaDMxO4z

Score

10^/10

lumma stealer

Family

lumma

https://acceptabledcooeprs.shop/api

https://obsceneclassyjuwks.shop/api

https://zippyfinickysofwps.shop/api

https://miniaturefinerninewjs.shop/api

https://plaintediousidowsko.shop/api

https://sweetsquarediaslw.shop/api

https://holicisticscrarws.shop/api

https://boredimperissvieos.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

Processes:

6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe

description	pid	process	target process
PID 1872 set thread context of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe

description	pid	process	target process
PID 1872 wrote to memory of 4652	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 4652	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 4652	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe
PID 1872 wrote to memory of 1016	1872	6e5f213eb7c9732447aca25e2b88e3df1b35f7370f5a1df9692b1294fdcb04e3.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1016

memory/1016-1-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1016-6-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1016-5-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1016-7-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1872-0-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/1872-3-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download