lumma | ef214f5a5b04210d047ce43b89531f73dfa663f17b2d8ba88227ef327efa6c7d

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 20:01

Target

2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe
Size

1011KB
MD5

4fc009d6370a89428053f21bdfe1d633
SHA1

6b0b21fc188093a601ee913ff059061afcc2e1bd
SHA256

ef214f5a5b04210d047ce43b89531f73dfa663f17b2d8ba88227ef327efa6c7d
SHA512

f2e0e78b8714f10637c6fb3dcfcd7a17941e5b8a7aeea25e8c3deac33fc6b07fe02c6870b0daec28461c7bba950d8e8e1a7d75b632fe16bac2c1a3b5dff4a40b
SSDEEP

24576:wutIdQCtwQpFZWRmqU573CYz6VJQqJEINEQkP7Y1LG:gwQpFZWRh/A6VJqrTY1LG

Score

10^/10

Family

lumma

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe

description pid process target process

PID 5116 set thread context of 3908 5116 2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2240 5116 WerFault.exe 2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe

description	pid	process	target process
PID 5116 set thread context of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe

pid	pid_target	process	target process
2240	5116	WerFault.exe	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe

description	pid	process	target process
PID 5116 wrote to memory of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe
PID 5116 wrote to memory of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe
PID 5116 wrote to memory of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe
PID 5116 wrote to memory of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe
PID 5116 wrote to memory of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe
PID 5116 wrote to memory of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe
PID 5116 wrote to memory of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe
PID 5116 wrote to memory of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe
PID 5116 wrote to memory of 3908	5116	2024-07-03_4fc009d6370a89428053f21bdfe1d633_magniber.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 280
2⤵
- Program crash
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5116 -ip 5116
1⤵
PID:4896

memory/3908-1-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3908-3-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3908-4-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/5116-0-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download