Extracted

Extracted

• • Target

    Installer.exe

  • Size

    335KB

  • MD5

    00ad917810ac5587372f799548090448

  • SHA1

    6c5cb55f3896e980d16701476c58e5a75484da84

  • SHA256

    d72dba6461efc57ff3613943906a69754b204e6375f77b54210f9c7bad560efc

  • SHA512

    82102a402bff4cf752fcc23cea02b2624c608ba6cb105c0865d99cf9f030eff6d7b3fc3b1361a1189aea4d43dfb30912bcaef3bf5c43b8c3196f60ed45bedee7

  • SSDEEP

    6144:QTWuojXgzW3V6Eih2ZUMP81w15SG6zhZIHFVyCpQO7k//HWXswu9O+:WWlTJ8UZvhPSG6zhyFDpH7k32XAO+

  Score

  10^/10

  lummadiscoverystealerpersistenceprivilege_escalation

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Lumma family

    lumma

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2