lumma | 39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 20:37

Target

39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe
Size

940KB
MD5

423db0db0be1538dc13409dc9cdbdc2a
SHA1

2c822354971c430ddad7917043117759d22fabcb
SHA256

39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b
SHA512

550ce9e2773ad855acd772bd1559b2e54cd610ca0601b71dfe881c7e15d251fc688aeba1677839d50b12af357f3283b7f8126e434b35d80cf0bbfd4230b51ea1
SSDEEP

24576:HkK/dQCtwyw2RijMs0r734C5jUZpRlDxqofV:xwyw2RijJLgjUZxbd

Score

10^/10

Family

lumma

https://extorteauhhwigw.shop/api

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Suspicious use of SetThreadContext 1 IoCs

Processes:

39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe

description pid process target process

PID 2628 set thread context of 3576 2628 39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

620 2628 WerFault.exe 39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe

description	pid	process	target process
PID 2628 set thread context of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe

pid	pid_target	process	target process
620	2628	WerFault.exe	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe

description	pid	process	target process
PID 2628 wrote to memory of 1572	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 1572	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 1572	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe
PID 2628 wrote to memory of 3576	2628	39115365dc9527d2c2217f2ce5ad1535e8d70f29858315b68dfa090d1fcabe3b.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:1572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 280
2⤵
- Program crash
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2628 -ip 2628
1⤵
PID:1344

memory/2628-1-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/3576-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3576-3-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3576-4-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download