lumma | d716067dbc280962523615988e83b1013bafd4c3a2352d57d67231809bef0e72

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 02:34

Target

e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe
Size

597KB
MD5

1a2a26995d43c4ad2f2c9e9e9373d5c8
SHA1

bc9592e1846b06b6e770d443c3802a887fb92987
SHA256

e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c
SHA512

b7138aaef1d2e98c898983fdc5e2255f965e6c1a03fd8b01fe22197f23f61c8e237ce15b582f50d28e64e312a6f565c0d8a13efeeb83a898bd2f2b75165d9743
SSDEEP

12288:y58K1Ff7F68gwFVUHWtOhYQ6YtQRkl904F2VHCU8MAwWoTVLiPgsFEO:y51bCYUHR/j0kzUVHCBwhTkt

Score

10^/10

Family

lumma

https://composepayyersellew.shop/api

https://publicitycharetew.shop/api

https://computerexcudesp.shop/api

https://leafcalfconflcitw.shop/api

https://injurypiggyoewirog.shop/api

https://bargainnygroandjwk.shop/api

https://disappointcredisotw.shop/api

https://doughtdrillyksow.shop/api

https://facilitycoursedw.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe

description pid process target process

PID 3412 set thread context of 3164 3412 e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe RegAsm.exe

description	pid	process	target process
PID 3412 set thread context of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe

description	pid	process	target process
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe
PID 3412 wrote to memory of 3164	3412	e5fd7cc5b7c23ab6d037e40cd141d49cffe8fdec8c9ce691b6689dfe6222982c.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3164

memory/3164-1-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3164-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3164-4-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3164-5-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3412-0-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download