lumma | a642f6ba732059d9f41bafad77f24359de23206991e975feb225e90283a74cea

Analysis

max time kernel
134s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 14:54

Target

SapphireX/SapphireX.exe
Size

97.4MB
MD5

2fd6ab9ede29579295b396a7d9c8e935
SHA1

9a8207071c65e19c360f2d574c7205aa710582be
SHA256

0fef0b66199dc27ed7691e63852b9c19b9f2a1a19d16811e08a834013b038576
SHA512

e64b442f021a17d4b9cda50c99cec33594d42e496f4afd6ce48d91c3d1d664fa5082598f04cf9f1186a2d03d3d2361666e4c0f12500cdbefecaebbc48255146d
SSDEEP

393216:TMgE1A1/9F6DncvuyJAlgoy7AacE7+fa:TXE1AB9MncvuzEMS

Score

10^/10

Family

lumma

https://citizencenturygoodwk.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

SapphireX.exe

description pid process target process

PID 388 set thread context of 3648 388 SapphireX.exe BitLockerToGo.exe

description	pid	process	target process
PID 388 set thread context of 3648	388	SapphireX.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

SapphireX.exe

description	pid	process	target process
PID 388 wrote to memory of 3648	388	SapphireX.exe	BitLockerToGo.exe
PID 388 wrote to memory of 3648	388	SapphireX.exe	BitLockerToGo.exe
PID 388 wrote to memory of 3648	388	SapphireX.exe	BitLockerToGo.exe
PID 388 wrote to memory of 3648	388	SapphireX.exe	BitLockerToGo.exe
PID 388 wrote to memory of 3648	388	SapphireX.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:3648

memory/388-2-0x00007FF72F320000-0x00007FF73193C000-memory.dmp

Filesize
38.1MB

Download
memory/388-6-0x00007FF72F320000-0x00007FF73193C000-memory.dmp

Filesize
38.1MB

Download
memory/388-9-0x00007FF72F320000-0x00007FF73193C000-memory.dmp

Filesize
38.1MB

Download
memory/3648-5-0x0000000000B10000-0x0000000000B69000-memory.dmp

Filesize
356KB

Download
memory/3648-8-0x0000000000B10000-0x0000000000B69000-memory.dmp

Filesize
356KB

Download
memory/3648-10-0x0000000000B10000-0x0000000000B69000-memory.dmp

Filesize
356KB

Download