lumma | f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734

Analysis

max time kernel
195s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 05:09

Target

f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe
Size

5.7MB
MD5

59c58fdafe6e2a4c7826c987f53aa5dc
SHA1

5c72cdf8e33a4e77aff7145d85b3284dcc1356d6
SHA256

f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734
SHA512

28258b42c6a008e55e37d1ffff4d1ed74f7a9c7268c4928aa9865de710ebe782ddc70215c82dd35f1d8dce8d5c817d499a99e7963d97f32a41e0f62a4c78fe7c
SSDEEP

49152:KN9aR05e5WPlFcixvIgDOS1E50r8uvDVDd2xEeq85jV5EsF2KiOxZ9mICXxzhLzH:YoqlFPLDUuvZxAE2e1/

Score

10^/10

Family

lumma

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe

description pid process target process

PID 204 set thread context of 4824 204 f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe BitLockerToGo.exe

description	pid	process	target process
PID 204 set thread context of 4824	204	f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe

description	pid	process	target process
PID 204 wrote to memory of 4824	204	f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe	BitLockerToGo.exe
PID 204 wrote to memory of 4824	204	f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe	BitLockerToGo.exe
PID 204 wrote to memory of 4824	204	f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe	BitLockerToGo.exe
PID 204 wrote to memory of 4824	204	f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe	BitLockerToGo.exe
PID 204 wrote to memory of 4824	204	f03ed99fec4a15c97e10ecc04e01f402e452e8c162930d6077f4d762690d0734.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:4824

memory/204-4-0x00007FF67E190000-0x00007FF67E7D3000-memory.dmp

Filesize
6.3MB

Download
memory/204-6-0x00007FF67E190000-0x00007FF67E7D3000-memory.dmp

Filesize
6.3MB

Download
memory/4824-5-0x0000000002F10000-0x0000000002F69000-memory.dmp

Filesize
356KB

Download
memory/4824-9-0x0000000002F10000-0x0000000002F69000-memory.dmp

Filesize
356KB

Download
memory/4824-8-0x0000000002F10000-0x0000000002F69000-memory.dmp

Filesize
356KB

Download