lumma | 3ac252519b834b39fc3c97eb7810889df601dc72d702ff8eadf294943184eee2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 20:11

Target

Gtool.exe
Size

526KB
MD5

25d66863ae6b40666fe4ea3031c00957
SHA1

07408d2073032c8fa07a1e3f1613274039183ef9
SHA256

ffeabd18beabd0c0090ca6ff166e7f724ee80c120c602e46a4ce2e427887b762
SHA512

03644f6de2da25939ec5b460f90d052718fce40f84d2d75788836a02d20f3352e967b6df80ddfd8b858f11af9ff9c08be419373f903063ee1aeb9a58385892a8
SSDEEP

12288:PnUB23lHRG/X5maWsBZUXHgBEDwAW8WrlrpQy7lQ:PUE1H2JmaWs0CeFmZ

Score

10^/10

Family

lumma

https://piedsiggnycliquieaw.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Gtool.exe

description pid process target process

PID 1604 set thread context of 1112 1604 Gtool.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2736 1604 WerFault.exe Gtool.exe

description	pid	process	target process
PID 1604 set thread context of 1112	1604	Gtool.exe	RegAsm.exe

pid	pid_target	process	target process
2736	1604	WerFault.exe	Gtool.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Gtool.exe

description	pid	process	target process
PID 1604 wrote to memory of 1736	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1736	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1736	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 3876	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 3876	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 3876	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1112	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1112	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1112	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1112	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1112	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1112	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1112	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1112	1604	Gtool.exe	RegAsm.exe
PID 1604 wrote to memory of 1112	1604	Gtool.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 328
2⤵
- Program crash
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1604 -ip 1604
1⤵
PID:2616

memory/1112-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1112-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1112-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1112-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1604-1-0x0000000001380000-0x0000000001381000-memory.dmp

Filesize
4KB

Download