lumma | 4a064668ef3383a56a03c4609ebdbd5b50b4408dedd5cf4f210554feab61e9f6

Analysis

max time kernel
137s
max time network
311s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 02:29

Target

lnslIaIER-SellUPv4.2-gratisHUB/Setup.exe
Size

24.9MB
MD5

4365c9b87939fa394977adb5afbd8393
SHA1

59261556cb75a83f97f76e74a3844a53a3429557
SHA256

9bd2435ba80abf9ef85e8499742cb7f4987e5f9daac23525cd6e853450920537
SHA512

e202f748af96adcd270d4fb2086fae007fd5aaedf6971154907cd3e27cf0a2fc2f6ed88517fee9983196b79b3f242a42db202654c98677106c1b5b4876327a0e
SSDEEP

98304:bVVzLEUwf2wm0CRLqiezTADEM1kMbSMSwUpU:MX2wm0GLqiezTbM/U

Score

10^/10

Family

lumma

https://leafcalfconflcitw.shop/api

https://publicitycharetew.shop/api

https://computerexcudesp.shop/api

https://injurypiggyoewirog.shop/api

https://bargainnygroandjwk.shop/api

https://disappointcredisotw.shop/api

https://doughtdrillyksow.shop/api

https://facilitycoursedw.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 4648 set thread context of 5008 4648 Setup.exe BitLockerToGo.exe

description	pid	process	target process
PID 4648 set thread context of 5008	4648	Setup.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 4648 wrote to memory of 5008	4648	Setup.exe	BitLockerToGo.exe
PID 4648 wrote to memory of 5008	4648	Setup.exe	BitLockerToGo.exe
PID 4648 wrote to memory of 5008	4648	Setup.exe	BitLockerToGo.exe
PID 4648 wrote to memory of 5008	4648	Setup.exe	BitLockerToGo.exe
PID 4648 wrote to memory of 5008	4648	Setup.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:5008

memory/4648-2-0x00007FF796630000-0x00007FF79727D000-memory.dmp

Filesize
12.3MB

Download
memory/4648-6-0x00007FF796630000-0x00007FF79727D000-memory.dmp

Filesize
12.3MB

Download
memory/5008-5-0x0000000000700000-0x0000000000756000-memory.dmp

Filesize
344KB

Download
memory/5008-8-0x0000000000700000-0x0000000000756000-memory.dmp

Filesize
344KB

Download
memory/5008-9-0x0000000000700000-0x0000000000756000-memory.dmp

Filesize
344KB

Download