lumma | 5fbd74b727784725db522b21fb0b291ceaa9f99082f238c8b27977e2ab34d785

Analysis

max time kernel
61s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 21:56

Target

github.software.1.1.8.exe
Size

526KB
MD5

87f9b840bb41a3488601bbb3e4e1fbd7
SHA1

843df85b4df246a97bb93124f2d3bc8a35845792
SHA256

5fbd74b727784725db522b21fb0b291ceaa9f99082f238c8b27977e2ab34d785
SHA512

185180b8dfad633114e21c8ae00d164175634b797f9e4e9ff7a961fce4cf2cfee1edd335a97105aa49f40618eb403b5721ae264552d40245de8aa9a4010adb0a
SSDEEP

12288:dV8l+nZJDPijrLnL999fn6nVwt9suceSUvnpuY9:dmoZJji3LnL999fn6nVwvsuceSsp

Score

10^/10

Family

lumma

https://harmfullyelobardek.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

github.software.1.1.8.exe

description pid process target process

PID 4324 set thread context of 2404 4324 github.software.1.1.8.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3628 4324 WerFault.exe github.software.1.1.8.exe

description	pid	process	target process
PID 4324 set thread context of 2404	4324	github.software.1.1.8.exe	RegAsm.exe

pid	pid_target	process	target process
3628	4324	WerFault.exe	github.software.1.1.8.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

github.software.1.1.8.exe

description	pid	process	target process
PID 4324 wrote to memory of 1636	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 1636	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 1636	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 2404	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 2404	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 2404	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 2404	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 2404	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 2404	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 2404	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 2404	4324	github.software.1.1.8.exe	RegAsm.exe
PID 4324 wrote to memory of 2404	4324	github.software.1.1.8.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 300
2⤵
- Program crash
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4324 -ip 4324
1⤵
PID:1476

memory/2404-1-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2404-3-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2404-4-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2404-5-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4324-0-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download