lumma | fc57397a75803becfc4bbef7ed49fa476a97f9be46014e2617602d27fcf5b3e8

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 20:23

Target

Injector_v1.07.exe
Size

10.2MB
MD5

5a65fe3fa53e974779ccfe40dfecc98a
SHA1

0caceef5d030306f57842e8e05149f84078c5fdf
SHA256

0e2c6139f6ba0dd8e5d2da5b4af2633087ef292736d1c0d76119bfab820363bd
SHA512

70e8943617f98aa20eae73bcd661e0dea8a36763f7324a1333ab31adc88a2f3f1a01cda88ce8bf4c757509491888be5e9dbaa367231d2b8d1a71b03ac92e82c9
SSDEEP

196608:oQWAbjWZXrVcupUXIYtjvkuN1pxNm4eRoEGrSAU:XW+jWNVcupU4ivjvU4eRJGrS

Score

10^/10

lumma stealer

Family

lumma

https://libertyliebindywv.shop/api

https://horsedwollfedrwos.shop/api

https://patternapplauderw.shop/api

https://understanndtytonyguw.shop/api

https://considerrycurrentyws.shop/api

https://messtimetabledkolvk.shop/api

https://detailbaconroollyws.shop/api

https://deprivedrinkyfaiir.shop/api

https://relaxtionflouwerwi.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Loads dropped DLL 1 IoCs

Processes:

Injector_v1.07.exe

pid process

1684 Injector_v1.07.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Injector_v1.07.exe

description pid process target process

PID 1684 set thread context of 2632 1684 Injector_v1.07.exe MsBuild.exe

pid	process
1684	Injector_v1.07.exe

description	pid	process	target process
PID 1684 set thread context of 2632	1684	Injector_v1.07.exe	MsBuild.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Injector_v1.07.exe

description	pid	process	target process
PID 1684 wrote to memory of 3092	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 3092	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 3092	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 2632	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 2632	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 2632	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 2632	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 2632	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 2632	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 2632	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 2632	1684	Injector_v1.07.exe	MsBuild.exe
PID 1684 wrote to memory of 2632	1684	Injector_v1.07.exe	MsBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
2⤵
PID:3092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
2⤵
PID:2632

C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/1684-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/1684-1-0x00000000008C0000-0x0000000001302000-memory.dmp

Filesize
10.3MB

Download
memory/1684-2-0x0000000005C20000-0x0000000005CBC000-memory.dmp

Filesize
624KB

Download
memory/1684-3-0x0000000005EB0000-0x0000000006042000-memory.dmp

Filesize
1.6MB

Download
memory/1684-9-0x0000000003680000-0x0000000003690000-memory.dmp

Filesize
64KB

Download
memory/1684-14-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/1684-16-0x00000000747A0000-0x0000000074F50000-memory.dmp

Filesize
7.7MB

Download
memory/1684-15-0x0000000005EAC000-0x0000000005EAF000-memory.dmp

Filesize
12KB

Download
memory/2632-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2632-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2632-17-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download