lumma | cb8b98537cfd5101d1ff182c696cb16fc6478822f6c7deced4efc08b6b02114a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 16:59

Target

github.software.1.2.4.exe
Size

512KB
MD5

40e2eec44440b05252d597d1f3a7c322
SHA1

9a5ee75fdba536d3e954e70c58597e96a6921658
SHA256

cb8b98537cfd5101d1ff182c696cb16fc6478822f6c7deced4efc08b6b02114a
SHA512

325c54743904c7f183d46b7fd16686f0594bd41f85954b8237fcd455542b981804accc65decc4535b0b4122d6be8c41d2470b9f0bc991bf8a4beda14800506d3
SSDEEP

12288:YBzlsxxxMCQMQA1cR0HB7Ndtjpw2zw1ybLnOMA:Y5iDxWIciHB7jxzw1ybLn

Score

10^/10

lumma stealer

Family

lumma

https://bitchsafettyudjwu.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 1896	1632	github.software.1.2.4.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	1632	WerFault.exe	83

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	85
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	85
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	85
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	85
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	85
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	85
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	85
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	85
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	85

C:\Users\Admin\AppData\Local\Temp\github.software.1.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\github.software.1.2.4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 312
  2⤵
  - Program crash
  PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1632 -ip 1632
1⤵
PID:976

memory/1632-0-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1896-1-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1896-3-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1896-4-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download