lumma | 6867e6620458e628fb77a72d15bf51d50136a49fe3103d818737faf8d3870f3e

Analysis

max time kernel
131s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27-06-2024 16:33

Target

Setup.exe
Size

50.0MB
MD5

176ca85e355951d13c5fcf56265adf1b
SHA1

0c4462f639b99404b7b8572b0081699f48852039
SHA256

6867e6620458e628fb77a72d15bf51d50136a49fe3103d818737faf8d3870f3e
SHA512

97b776b784821670f07b5faa4497158b8f7b6b35f86039926e2a472dfcf39d21ca80f8b7fb0f77a4e441b65ef8d51145be7010868190f2fff50cb56d3fe40931
SSDEEP

393216:PkfR0eh8xI7rPx5I5D8qB1JsbD3rn2Uk:cfR0eh/7rPx5I5D8qqP7

Score

10^/10

Family

lumma

https://harmfullyelobardek.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 4076 set thread context of 3156 4076 Setup.exe BitLockerToGo.exe

description	pid	process	target process
PID 4076 set thread context of 3156	4076	Setup.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 4076 wrote to memory of 3156	4076	Setup.exe	BitLockerToGo.exe
PID 4076 wrote to memory of 3156	4076	Setup.exe	BitLockerToGo.exe
PID 4076 wrote to memory of 3156	4076	Setup.exe	BitLockerToGo.exe
PID 4076 wrote to memory of 3156	4076	Setup.exe	BitLockerToGo.exe
PID 4076 wrote to memory of 3156	4076	Setup.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:3156

memory/3156-5-0x0000000003050000-0x00000000030A8000-memory.dmp

Filesize
352KB

Download
memory/3156-7-0x0000000003050000-0x00000000030A8000-memory.dmp

Filesize
352KB

Download
memory/3156-8-0x0000000003050000-0x00000000030A8000-memory.dmp

Filesize
352KB

Download
memory/4076-2-0x00007FF715F20000-0x00007FF719224000-memory.dmp

Filesize
51.0MB

Download
memory/4076-9-0x00007FF715F20000-0x00007FF719224000-memory.dmp

Filesize
51.0MB

Download