lumma | cb8b98537cfd5101d1ff182c696cb16fc6478822f6c7deced4efc08b6b02114a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 16:59

Target

github.software.1.2.4.exe
Size

512KB
MD5

40e2eec44440b05252d597d1f3a7c322
SHA1

9a5ee75fdba536d3e954e70c58597e96a6921658
SHA256

cb8b98537cfd5101d1ff182c696cb16fc6478822f6c7deced4efc08b6b02114a
SHA512

325c54743904c7f183d46b7fd16686f0594bd41f85954b8237fcd455542b981804accc65decc4535b0b4122d6be8c41d2470b9f0bc991bf8a4beda14800506d3
SSDEEP

12288:YBzlsxxxMCQMQA1cR0HB7Ndtjpw2zw1ybLnOMA:Y5iDxWIciHB7jxzw1ybLn

Score

10^/10

Family

lumma

https://bitchsafettyudjwu.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

github.software.1.2.4.exe

description pid process target process

PID 1632 set thread context of 1896 1632 github.software.1.2.4.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4284 1632 WerFault.exe github.software.1.2.4.exe

description	pid	process	target process
PID 1632 set thread context of 1896	1632	github.software.1.2.4.exe	RegAsm.exe

pid	pid_target	process	target process
4284	1632	WerFault.exe	github.software.1.2.4.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

github.software.1.2.4.exe

description	pid	process	target process
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	RegAsm.exe
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	RegAsm.exe
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	RegAsm.exe
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	RegAsm.exe
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	RegAsm.exe
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	RegAsm.exe
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	RegAsm.exe
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	RegAsm.exe
PID 1632 wrote to memory of 1896	1632	github.software.1.2.4.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 312
2⤵
- Program crash
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1632 -ip 1632
1⤵
PID:976

memory/1632-0-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1896-1-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1896-3-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1896-4-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download