826e787cd4449d9814fa273d34c701390baa7deff4d472c9e6487170e8567d1e

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lummastealer/Data/Media/R-lang.pdf
Size

505KB
MD5

22fdca1c53fac4533531a436db6d729d
SHA1

87a6086a6bac5d9ef8b4821d847309ae87277104
SHA256

f6f7bd9bf814b1bfcc77f68cd50324b33fea0f83f81e9eaf3abfc8c1d6c6cdf6
SHA512

d3cad3b76668a71edafeb2ee4f187a4b522f8ed7a60b48c67b477d433f37513341389740405925dc616a3c69dace490c6dd012f82b5074193fa75882344efc1c
SSDEEP

6144:9xz4b36Bs8cz0NgGFHlge16mHrO9TyqVveVRkmX9Wllqv0N47utumruF4rS:9xiq0ske1nLO9PqYllJ47uCF4+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1916	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1916	AcroRd32.exe
1916	AcroRd32.exe
1916	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lummastealer\Data\Media\R-lang.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d3deba2273d9182248b26d8a6f9b0541

SHA1
909a63914fe7165c2060a4efa50f383f8a6bdb7c

SHA256
4f534a74534e94b0beb8b7545250f10d1a8395e6df99092eec73acfba318d9b0

SHA512
29172115a6dcbed5c6c8cfe1f89e765ff321f5ebb0c5b035538775d4d1369e0cba775c4ce9546b9a4b12a2ce50bfb36a6e1d4e81c561af2a25f7e352903b6a6a

Download Submit