826e787cd4449d9814fa273d34c701390baa7deff4d472c9e6487170e8567d1e

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lummastealer/Data/Media/population.pdf
Size

285KB
MD5

ff01321dd785764e66f0f5fdf822933f
SHA1

f1814fb3eddfa0c446e6f8441116b2a21800001e
SHA256

bf40dc915a41dcb0d87c43134e9eef8756c72b59e4183d3dc19227b536bc1a7d
SHA512

31bf1e85d9a7cc8cf071e0744f506d1539edebeb4f6928ea4b33612a6d3d3f2fe253a52284039550e7acbcb91b1dbae84228cebfb8091a238bff0648aaa7174c
SSDEEP

6144:3fXZgmpaBVWVfPHYRsQN0HRm64F8ANTfGE1oOV:3fXSmpkoVXY3SHRcl71oOV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2404	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2404	AcroRd32.exe
2404	AcroRd32.exe
2404	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lummastealer\Data\Media\population.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7b982e2a5752b726920cf45338625836

SHA1
249b72b18559fe8ead8b6690f0e9dd29055c8447

SHA256
d7d6f88f0e0ed33680ee6db20a5cb08f0596625104aa74afd526944829be90b4

SHA512
e3b3c7ef43debd202f4384146443054f663fe84d15bbb7eba05b93444bc0e403d2b41ef7bfefca1b5091b7cded93e6816c36c7de3fd357abeeed3e31a6ef0309

Download Submit