lumma | 5f090414e7879bf04a172e08266ae540ce5ce2d5332ae99df604b97b5122d4fd

Analysis

max time kernel
134s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 18:46

Target

GalaxySwapper v2.0.3/Galaxy Swapper v2.0.3.exe
Size

953KB
MD5

3ec47bf3670f6260e1bb7aded9cce989
SHA1

7d90a117705a7d863a6edbb41415fcbb6f75a394
SHA256

5d7e20eb7734242f28f5edb1583bb45db3d490bbc38c05ee55ccf370e02115bc
SHA512

e8e9588ddb273c37a579f7d5d38d294f1280e779ad8fa88ed2f81ffec3345dfb1204f83b6e39dff85cb6d6de04f6fb7e4cff421704b6d43efd8ff9887a3534f5
SSDEEP

24576:aCZIdQCtwqBLRON6NUd73+MrOpR00mmZU0sLQXjt:GwqBLRONuHkOpR00FGRLQ5

Score

10^/10

Family

lumma

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

Galaxy Swapper v2.0.3.exe

description pid process target process

PID 5024 set thread context of 3468 5024 Galaxy Swapper v2.0.3.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2412 5024 WerFault.exe Galaxy Swapper v2.0.3.exe

description	pid	process	target process
PID 5024 set thread context of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe

pid	pid_target	process	target process
2412	5024	WerFault.exe	Galaxy Swapper v2.0.3.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Galaxy Swapper v2.0.3.exe

description	pid	process	target process
PID 5024 wrote to memory of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe
PID 5024 wrote to memory of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe
PID 5024 wrote to memory of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe
PID 5024 wrote to memory of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe
PID 5024 wrote to memory of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe
PID 5024 wrote to memory of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe
PID 5024 wrote to memory of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe
PID 5024 wrote to memory of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe
PID 5024 wrote to memory of 3468	5024	Galaxy Swapper v2.0.3.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 308
2⤵
- Program crash
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5024 -ip 5024
1⤵
PID:1368

memory/3468-1-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3468-3-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3468-4-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5024-0-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download