lumma | 9d0547070e294e4158e6c446fa2295f5ae170f31cc64d677c5261d14caf38ab8

Resubmissions

01-07-2024 19:00

01-07-2024 18:54

01-07-2024 18:53

01-07-2024 18:44

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 18:53

Target

JudgeLZT.exe
Size

951KB
MD5

18f16ea3096e479cc7923df5269b25d8
SHA1

c0169fdb70ca980a8ca0baebb2fc3a118fd290c6
SHA256

1c84f3a2fd0a00690b2a2e385d952ec3f7a7c94223fd0e3a80aff510d329d13c
SHA512

5a38cf66a137a51776335f520f8b6a39db025a426b0669088f813979fabfe279c38c19504db233153865c6d0f2f759c61af751465245454498ef006a85a04d36
SSDEEP

24576:vuZIdQCtwQpFZWRmqU573CYz6VJyH+np1Vu1OxkCTK:HwQpFZWRh/A6VJyH+zVueTK

Score

10^/10

Family

lumma

https://groundsmooors.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

JudgeLZT.exe

description pid process target process

PID 4108 set thread context of 1456 4108 JudgeLZT.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2840 4108 WerFault.exe JudgeLZT.exe

description	pid	process	target process
PID 4108 set thread context of 1456	4108	JudgeLZT.exe	RegAsm.exe

pid	pid_target	process	target process
2840	4108	WerFault.exe	JudgeLZT.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

JudgeLZT.exe

description	pid	process	target process
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	RegAsm.exe
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	RegAsm.exe
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	RegAsm.exe
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	RegAsm.exe
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	RegAsm.exe
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	RegAsm.exe
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	RegAsm.exe
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	RegAsm.exe
PID 4108 wrote to memory of 1456	4108	JudgeLZT.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 280
2⤵
- Program crash
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4108 -ip 4108
1⤵
PID:2912

memory/1456-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1456-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1456-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1456-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4108-1-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download