1d95a1b070d3a22eeb4ddbc8a955e66fea8b8cbe746806b898e01de744b4b2f3

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lumma.exe
Size 323KB
Sample240912-meszeasall
SHA256 1d95a1b070d3a22eeb4ddbc8a955e66fea8b8cbe746806b898e01de744b4b2f3
MD5 0aff0c95dcc533728c4db36323234bc7
SHA1 7934bc0c7c0d3aef95a3ce02dae7ba18db09d49a
SHA512 2455b8c683caeae381f865f8ca69cec7334dbf60e3b9e071557ad64e5dbd4e9f000e21209201b5a6b7145cd6127229b0f9362bf7e8245d12c355715df40fe305
SSDEEP 6144:Xs4mIjh5dosTbi6H2SDwyMXOUjDDL9HBI4w0EPbWYT9o4WnPjQOSpppbddo3beLN:9jh5GiFSX9k4w0absnApppbdRdpupun3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
812	3988	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lumma.exe

C:\Users\Admin\AppData\Local\Temp\lumma.exe
"C:\Users\Admin\AppData\Local\Temp\lumma.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 216
  2⤵
  - Program crash
  PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3988 -ip 3988
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads