826e787cd4449d9814fa273d34c701390baa7deff4d472c9e6487170e8567d1e

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lummastealer/Data/Media/Sweave.pdf
Size

165KB
MD5

03cb3c2977e0177583a9974d89810819
SHA1

1380f9d3ea38933526876228a59ab24c95d4867f
SHA256

f73ea9db458a1646cc5c45bef267aa7b293bb54f3aa8a78d6f0929129ebeb4d6
SHA512

7c6e6263ffd2a5f79cf4cb086ee3436074e0e3ad9cc43ef33ce1d11ca1f8f85b1fd367b2f0947ff27dbb91bc8318214b012fd50ee8d647341e00bfbe57998217
SSDEEP

3072:G7HIfctgjS2/f3vhljwCB3i5XBjF/vcnQfIvc5izgJ2AavOVYNXCJHnUYsrK8nus:GHIfcAx3fT7B3i5Rp5Wc5ip5vOVQXQL0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2316	AcroRd32.exe
2316	AcroRd32.exe
2316	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lummastealer\Data\Media\Sweave.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7f1c8409285e5fe8a360cd52aa119af8

SHA1
7a568c678da8bf43b60845d7a13e0a874af8f537

SHA256
16ae39cfb19dcc34f8bf4f3036fa4ca76ad60ba2664f6a3833cea6d6dd4bfd12

SHA512
5a7b94426bba8698aac4be445de6b557debbc26c1983c4568e53cf2090cd15ba4f2fcdef93295399e4bd9ca6b46ca6e765d23805c2feb1a9161b8e40dd37858b

Download Submit