lumma | 024392527ceed45f4c6f552ee92a35339f4c21be1710dc233f66dce245420787

Analysis

max time kernel
6s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 19:55

Target

github.software.1.2.5.exe
Size

521KB
MD5

3395544e3a6d54c372f0f0121f7f47db
SHA1

1d7c3f910abd7f7e0f0c2f8826f36d6ab90bf6d3
SHA256

c52a78552d29308b8fedb868e09be677aaacf9a6395349b30e3150f817d6d190
SHA512

0157c319875b7f9ca4ca8ca0c0f5474f1aead7d0ba06c333ba628064a8559c9feecd3531d52db6f82c6422a50bd4cd43959ec10d8d647ae0049f6942f36d3127
SSDEEP

12288:s3gVK31bhVXlO1sORicGc2spnLtu0pGQ7G:sw0lbDla/Rb2shLtuYGE

Score

10^/10

Family

lumma

https://piedsiggnycliquieaw.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

github.software.1.2.5.exe

description pid process target process

PID 3448 set thread context of 2180 3448 github.software.1.2.5.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4128 3448 WerFault.exe github.software.1.2.5.exe

description	pid	process	target process
PID 3448 set thread context of 2180	3448	github.software.1.2.5.exe	RegAsm.exe

pid	pid_target	process	target process
4128	3448	WerFault.exe	github.software.1.2.5.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

github.software.1.2.5.exe

description	pid	process	target process
PID 3448 wrote to memory of 2180	3448	github.software.1.2.5.exe	RegAsm.exe
PID 3448 wrote to memory of 2180	3448	github.software.1.2.5.exe	RegAsm.exe
PID 3448 wrote to memory of 2180	3448	github.software.1.2.5.exe	RegAsm.exe
PID 3448 wrote to memory of 2180	3448	github.software.1.2.5.exe	RegAsm.exe
PID 3448 wrote to memory of 2180	3448	github.software.1.2.5.exe	RegAsm.exe
PID 3448 wrote to memory of 2180	3448	github.software.1.2.5.exe	RegAsm.exe
PID 3448 wrote to memory of 2180	3448	github.software.1.2.5.exe	RegAsm.exe
PID 3448 wrote to memory of 2180	3448	github.software.1.2.5.exe	RegAsm.exe
PID 3448 wrote to memory of 2180	3448	github.software.1.2.5.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 320
2⤵
- Program crash
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3448 -ip 3448
1⤵
PID:3532

memory/2180-1-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2180-3-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2180-4-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3448-0-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download