lumma | 0fef0b66199dc27ed7691e63852b9c19b9f2a1a19d16811e08a834013b038576

Analysis

max time kernel
123s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 16:29

Target

SapphireX.exe
Size

97.4MB
MD5

2fd6ab9ede29579295b396a7d9c8e935
SHA1

9a8207071c65e19c360f2d574c7205aa710582be
SHA256

0fef0b66199dc27ed7691e63852b9c19b9f2a1a19d16811e08a834013b038576
SHA512

e64b442f021a17d4b9cda50c99cec33594d42e496f4afd6ce48d91c3d1d664fa5082598f04cf9f1186a2d03d3d2361666e4c0f12500cdbefecaebbc48255146d
SSDEEP

393216:TMgE1A1/9F6DncvuyJAlgoy7AacE7+fa:TXE1AB9MncvuzEMS

Score

10^/10

Family

lumma

https://citizencenturygoodwk.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

SapphireX.exe

description pid process target process

PID 3316 set thread context of 4564 3316 SapphireX.exe BitLockerToGo.exe

description	pid	process	target process
PID 3316 set thread context of 4564	3316	SapphireX.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

SapphireX.exe

description	pid	process	target process
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	BitLockerToGo.exe
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	BitLockerToGo.exe
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	BitLockerToGo.exe
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	BitLockerToGo.exe
PID 3316 wrote to memory of 4564	3316	SapphireX.exe	BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
2⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3924,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
1⤵
PID:3620

memory/3316-2-0x00007FF7EF860000-0x00007FF7F1E7C000-memory.dmp

Filesize
38.1MB

Download
memory/3316-6-0x00007FF7EF860000-0x00007FF7F1E7C000-memory.dmp

Filesize
38.1MB

Download
memory/4564-5-0x0000000000900000-0x0000000000959000-memory.dmp

Filesize
356KB

Download
memory/4564-8-0x0000000000900000-0x0000000000959000-memory.dmp

Filesize
356KB

Download
memory/4564-9-0x0000000000900000-0x0000000000959000-memory.dmp

Filesize
356KB

Download