lumma | 07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35

Analysis

max time kernel
193s
max time network
298s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 05:00

Target

07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe
Size

516KB
MD5

0309dd0131150796ea99b30a62194fae
SHA1

2df6e334708eae810a74b844fd57e18e9fdc34cd
SHA256

07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35
SHA512

3d4e5a0718d04fee92d8040880b631107d1e23a6b3bce430d58769179af999c28b99e50c5cd45f283339f7bbb24ffacbf601a5447edb12e28da4517fbfa282e8
SSDEEP

12288:YwFARGxNB+mIuUOI+J0X6KALNGK34y1sB2Y+Jg4c:Yj4xb+mrZj1VHSB2Y6d

Score

10^/10

Family

lumma

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe

description pid process target process

PID 4704 set thread context of 4392 4704 07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

824 4704 WerFault.exe 07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe

description	pid	process	target process
PID 4704 set thread context of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe

pid	pid_target	process	target process
824	4704	WerFault.exe	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe

description	pid	process	target process
PID 4704 wrote to memory of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe
PID 4704 wrote to memory of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe
PID 4704 wrote to memory of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe
PID 4704 wrote to memory of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe
PID 4704 wrote to memory of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe
PID 4704 wrote to memory of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe
PID 4704 wrote to memory of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe
PID 4704 wrote to memory of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe
PID 4704 wrote to memory of 4392	4704	07c09ba5a84f619e5b83a54298ffc58d20b00f14399c7a94b7f02b70efc60f35.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 128
2⤵
- Program crash
PID:824

memory/4392-1-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4392-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4392-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4704-0-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/4704-5-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download