lumma | 387bac293a9a682a1bb6058e4468d8f1daeecdca56f99d2f8b1096c4a9073103

Analysis

max time kernel
133s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
28-06-2024 16:57

Target

github.software.1.2.4.exe
Size

512KB
MD5

40e2eec44440b05252d597d1f3a7c322
SHA1

9a5ee75fdba536d3e954e70c58597e96a6921658
SHA256

cb8b98537cfd5101d1ff182c696cb16fc6478822f6c7deced4efc08b6b02114a
SHA512

325c54743904c7f183d46b7fd16686f0594bd41f85954b8237fcd455542b981804accc65decc4535b0b4122d6be8c41d2470b9f0bc991bf8a4beda14800506d3
SSDEEP

12288:YBzlsxxxMCQMQA1cR0HB7Ndtjpw2zw1ybLnOMA:Y5iDxWIciHB7jxzw1ybLn

Score

10^/10

Family

lumma

https://bitchsafettyudjwu.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

github.software.1.2.4.exe

description pid process target process

PID 1636 set thread context of 3548 1636 github.software.1.2.4.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1440 1636 WerFault.exe github.software.1.2.4.exe

description	pid	process	target process
PID 1636 set thread context of 3548	1636	github.software.1.2.4.exe	RegAsm.exe

pid	pid_target	process	target process
1440	1636	WerFault.exe	github.software.1.2.4.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

github.software.1.2.4.exe

description	pid	process	target process
PID 1636 wrote to memory of 4540	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 4540	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 4540	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 3548	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 3548	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 3548	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 3548	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 3548	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 3548	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 3548	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 3548	1636	github.software.1.2.4.exe	RegAsm.exe
PID 1636 wrote to memory of 3548	1636	github.software.1.2.4.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 324
2⤵
- Program crash
PID:1440

memory/1636-0-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1636-5-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3548-1-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3548-4-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3548-3-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download