lumma | c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b

Analysis

max time kernel
194s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 05:08

Target

c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe
Size

17.9MB
MD5

5f43d8f10c84f166a69eeea31229a4ae
SHA1

3876d8bfb443b9bbbff5b3f34e0fc57357930efa
SHA256

c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b
SHA512

af9b64ef2a20a5af075ce23fb5a3ae13592fccab4189eaed532fde46d43cf0230095b2d0d78cf7d0f7f9f29dd241c2b729e17f09bec2daa4d2ca4fb56a2c890b
SSDEEP

98304:Q/PL8Lelkmo3OhN0eMWNOgLN1wGkxXUtzlwEM8FNJlliOliuXdj:Q1im2OhNuoYUVMKtliuh

Score

10^/10

Family

lumma

https://invisibledovereats.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe

description pid process target process

PID 4740 set thread context of 4232 4740 c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe BitLockerToGo.exe

description	pid	process	target process
PID 4740 set thread context of 4232	4740	c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe

description	pid	process	target process
PID 4740 wrote to memory of 4232	4740	c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe	BitLockerToGo.exe
PID 4740 wrote to memory of 4232	4740	c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe	BitLockerToGo.exe
PID 4740 wrote to memory of 4232	4740	c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe	BitLockerToGo.exe
PID 4740 wrote to memory of 4232	4740	c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe	BitLockerToGo.exe
PID 4740 wrote to memory of 4232	4740	c234cdee62048c2529005241c0dd2a9413e0c6201cebd793985e3511f5cafe6b.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:4232

memory/4232-5-0x0000000003000000-0x000000000305A000-memory.dmp

Filesize
360KB

Download
memory/4232-8-0x0000000003000000-0x000000000305A000-memory.dmp

Filesize
360KB

Download
memory/4232-9-0x0000000003000000-0x000000000305A000-memory.dmp

Filesize
360KB

Download
memory/4232-10-0x0000000003000000-0x000000000305A000-memory.dmp

Filesize
360KB

Download
memory/4740-2-0x00007FF691900000-0x00007FF692B92000-memory.dmp

Filesize
18.6MB

Download
memory/4740-6-0x00007FF691900000-0x00007FF692B92000-memory.dmp

Filesize
18.6MB

Download