lumma | 78377f8e54e07c9b857cc65046843eff9614c9101e4aad1ee2fbf242b7a28ee6

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 23:37

Target
78377f8e54e07c9b857cc65046843eff9614c9101e4aad1ee2fbf242b7a28ee6.dll
Size 440KB
Sample240610-3mbyvsvfqa
SHA256 78377f8e54e07c9b857cc65046843eff9614c9101e4aad1ee2fbf242b7a28ee6
MD5 28fa4a1f7d1566f178dd80f7dbb37918
SHA1 49de41b457611c6c20b5b17164eb07f91d3cb29c
SHA512 e7d1e7e18d8af03a840b023dd8c8aae359e1025e18c34348dd4c71dd87d21f80c6e86a24757124c0b0fbfc607367aa824fbeefa45c5779969ec9503d0368f3ea
SSDEEP 6144:IiDoDyuF+Ry/Dfs7W42G6CtxHkT7dEWjC8BkEzvJR6bs2rnnkqwy3sUP5gq6j:MOuEy/MATui+YKIiay3sK5gz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealer

Family

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3416 set thread context of 2076	3416	rundll32.exe	82

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3416	2372	rundll32.exe	81
PID 2372 wrote to memory of 3416	2372	rundll32.exe	81
PID 2372 wrote to memory of 3416	2372	rundll32.exe	81
PID 3416 wrote to memory of 2076	3416	rundll32.exe	82
PID 3416 wrote to memory of 2076	3416	rundll32.exe	82
PID 3416 wrote to memory of 2076	3416	rundll32.exe	82
PID 3416 wrote to memory of 2076	3416	rundll32.exe	82
PID 3416 wrote to memory of 2076	3416	rundll32.exe	82
PID 3416 wrote to memory of 2076	3416	rundll32.exe	82
PID 3416 wrote to memory of 2076	3416	rundll32.exe	82
PID 3416 wrote to memory of 2076	3416	rundll32.exe	82
PID 3416 wrote to memory of 2076	3416	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78377f8e54e07c9b857cc65046843eff9614c9101e4aad1ee2fbf242b7a28ee6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78377f8e54e07c9b857cc65046843eff9614c9101e4aad1ee2fbf242b7a28ee6.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
    3⤵
    PID:2076

memory/2076-1-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/2076-3-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/2076-5-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/3416-4-0x0000000077161000-0x0000000077281000-memory.dmp

Download