826e787cd4449d9814fa273d34c701390baa7deff4d472c9e6487170e8567d1e

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lummastealer/Data/Media/NEWS.pdf
Size

475KB
MD5

951af7e5c9f8649aba87836b7e0a5bc6
SHA1

461a9f335c280bde86169123a7a6a52e78f29772
SHA256

37c0c814257d592cdc9fa4f65981a5de73011e1394d193b23968ca0f75f3121f
SHA512

26beb3339e2f72ad5433d7ff4f138fad494ae6225999089f6c4510d46d291d1bb53573e6f798d9a20fdffa6936e4a6fa95b6ec0a4fa1a51cc379d25f0a91bd0e
SSDEEP

12288:puZbEcShGrMZS3lglOSZ/ApESaKT/fRSkgdwW:s1ohCFglOSZ/WESaQRSk0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lummastealer\Data\Media\NEWS.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0870f9a5941179899a902e2981e6c947

SHA1
650f408666eed83e009cb70b052c2b25dfdc8fb9

SHA256
fbbfa312890ca6f161dcdef4b8ebd836d7e116e1092dfa7b27db510426f88035

SHA512
df27ac2ed4ea6aa3b281662d4f66ec19ecc3bffe45c7a52836a16b6f5273c553d3c378bfa87c9e9c5e57b27ccb570b9bf9b774488a48ac7c48cb9c388651f53f

Download Submit