lumma | cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d

Analysis

max time kernel
195s
max time network
256s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 05:08

Target

cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe
Size

507KB
MD5

0f9b8c6500c040df8aee110cac74225a
SHA1

51892cdff9f9afa873c096e372053f669792bb70
SHA256

cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d
SHA512

651a7e9580880ba8ece3d345555f0765ed3ded259d88dd40501ccde326bebc01128c1d3653cda721c7fec3f7091781feb43c7be29ac54d1c1070caae4bd71fa9
SSDEEP

12288:KLo2tQgRiP9bu1ircdlgkXfzYJvNrXWoaVS4SZn:ikOiRzQdRuNLWoaVS4S

Score

10^/10

Family

lumma

https://bitchsafettyudjwu.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe

description pid process target process

PID 404 set thread context of 1904 404 cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1888 404 WerFault.exe cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe

description	pid	process	target process
PID 404 set thread context of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe

pid	pid_target	process	target process
1888	404	WerFault.exe	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe

description	pid	process	target process
PID 404 wrote to memory of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe
PID 404 wrote to memory of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe
PID 404 wrote to memory of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe
PID 404 wrote to memory of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe
PID 404 wrote to memory of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe
PID 404 wrote to memory of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe
PID 404 wrote to memory of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe
PID 404 wrote to memory of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe
PID 404 wrote to memory of 1904	404	cf2ef8eaab958f358b6f1adaaa60c1e94f3817e8a57cccd8b988af007fa8a57d.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 320
2⤵
- Program crash
PID:1888

memory/404-0-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/404-5-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/1904-1-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1904-3-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1904-4-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download