lumma | a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 01:35

Target

a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe
Size

891KB
MD5

78bb5e1866bdf1f6d1040ef751766671
SHA1

5a08b1faeb0dcd0722710e9e6a04aeca234fc140
SHA256

a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb
SHA512

b801c460a8658a8d92d6d52d27a3e06a5a5936f6b4282aaaec6da894cd48a6e29b521608ad55ff18721a018b9afaf7be6641e59061560867b72ddbd2773641c7
SSDEEP

12288:D8OdZr0bzuKlW5nkTzukTUSez2fOSRfd2CXCpL+Db5Eak4TOAeBMe:D8W0bzNlkSez2f7fd2mCVm5EajTOHX

Score

10^/10

lumma stealer

Family

lumma

https://smallelementyjdui.shop/api

https://sofaprivateawarderysj.shop/api

https://lineagelasserytailsd.shop/api

https://tendencyportionjsuk.shop/api

https://headraisepresidensu.shop/api

https://appetitesallooonsj.shop/api

https://minorittyeffeoos.shop/api

https://prideconstituiiosjk.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4264 set thread context of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82
PID 4264 wrote to memory of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82
PID 4264 wrote to memory of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82
PID 4264 wrote to memory of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82
PID 4264 wrote to memory of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82
PID 4264 wrote to memory of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82
PID 4264 wrote to memory of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82
PID 4264 wrote to memory of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82
PID 4264 wrote to memory of 2620	4264	a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe	82

C:\Users\Admin\AppData\Local\Temp\a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe
"C:\Users\Admin\AppData\Local\Temp\a1fafe317ab68bf834269176a32aef67f45ea1f33750df0a278d586317c852cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2620

memory/2620-2-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2620-5-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2620-6-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2620-7-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4264-0-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/4264-1-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/4264-3-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download