Overview

overview

10

Static

static

3

Temp-Spoofer-main.zip

windows11-21h2-x64

10

Temp-Spoof...er.exe

windows11-21h2-x64

10

Temp-Spoof...ui.cpp

windows11-21h2-x64

3

Temp-Spoof...mgui.h

windows11-21h2-x64

3

Temp-Spoof...mo.cpp

windows11-21h2-x64

3

Temp-Spoof...aw.cpp

windows11-21h2-x64

3

Temp-Spoof...11.cpp

windows11-21h2-x64

3

Temp-Spoof...dx11.h

windows11-21h2-x64

3

Temp-Spoof...32.cpp

windows11-21h2-x64

3

Temp-Spoof...in32.h

windows11-21h2-x64

3

Temp-Spoof...rnal.h

windows11-21h2-x64

3

Temp-Spoof...es.cpp

windows11-21h2-x64

3

Temp-Spoof...ts.vbs

windows11-21h2-x64

1

Temp-Spoof...pack.h

windows11-21h2-x64

3

Temp-Spoof...edit.h

windows11-21h2-x64

3

Temp-Spoof...type.h

windows11-21h2-x64

3

Temp-Spoof...ne.lib

windows11-21h2-x64

3

Temp-Spoof...ok.def

windows11-21h2-x64

3

Temp-Spoof...Hook.h

windows11-21h2-x64

3

Temp-Spoof...AR.rar

windows11-21h2-x64

1

Temp-Spoof...ffer.c

windows11-21h2-x64

3

Temp-Spoof...ffer.h

windows11-21h2-x64

3

Temp-Spoof...de32.c

windows11-21h2-x64

3

Temp-Spoof...de32.h

windows11-21h2-x64

3

Temp-Spoof...de64.c

windows11-21h2-x64

3

Temp-Spoof...de64.h

windows11-21h2-x64

3

Temp-Spoof...dint.h

windows11-21h2-x64

3

Temp-Spoof...le32.h

windows11-21h2-x64

3

Temp-Spoof...le64.h

windows11-21h2-x64

3

Temp-Spoof...hook.c

windows11-21h2-x64

3

Temp-Spoof...line.c

windows11-21h2-x64

3

Temp-Spoof...line.h

windows11-21h2-x64

3

Analysis

  • max time kernel
    90s
  • max time network
    98s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08-01-2025 00:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Temp-Spoofer-main.zip

  • Size

    1.4MB

  • MD5

    1e413e83af456d76749d0996bd9c69a7

  • SHA1

    4a914947bfd3384ef7209dd68f27b80625d25faa

  • SHA256

    0d1f8012e230a264ca5001a6273912c9e143a06fa045022a35bfe258fca9b77f

  • SHA512

    a0f9b6e4a044d2b52b78db772395d8a86b15f29ddc75a302c5e34472d9f7bbdfff155a407fb2c4e3bdaa6422181706ac9ea1ce4a559f7c7a09df44bb5bb90127

  • SSDEEP

    24576:BbUGpuVhxFetCJgDvdGZ8+rrEStGxqXfl+yR9epE2I0gxiO521UcgazBGqZP:BbvuPx4tCJgDvEZ8grIxOfQjB22LvZP

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Executes dropped EXE 52 IoCs
  • Suspicious use of SetThreadContext 22 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Temp-Spoofer-main.zip"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Users\Admin\AppData\Local\Temp\7zO003558F7\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO003558F7\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2224
      • C:\Users\Admin\AppData\Local\Temp\7zO003558F7\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003558F7\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:752
    • C:\Users\Admin\AppData\Local\Temp\7zO003D9DD7\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO003D9DD7\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Users\Admin\AppData\Local\Temp\7zO003D9DD7\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003D9DD7\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2416
    • C:\Users\Admin\AppData\Local\Temp\7zO003A8828\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO003A8828\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Users\Admin\AppData\Local\Temp\7zO003A8828\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003A8828\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2264
    • C:\Users\Admin\AppData\Local\Temp\7zO003CDD28\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO003CDD28\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Users\Admin\AppData\Local\Temp\7zO003CDD28\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003CDD28\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        PID:1200
      • C:\Users\Admin\AppData\Local\Temp\7zO003CDD28\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003CDD28\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3028
    • C:\Users\Admin\AppData\Local\Temp\7zO00335328\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO00335328\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Users\Admin\AppData\Local\Temp\7zO00335328\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO00335328\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4508
    • C:\Users\Admin\AppData\Local\Temp\7zO003C6028\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO003C6028\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:1104
      • C:\Users\Admin\AppData\Local\Temp\7zO003C6028\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003C6028\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4904
    • C:\Users\Admin\AppData\Local\Temp\7zO0034D128\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO0034D128\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:4540
      • C:\Users\Admin\AppData\Local\Temp\7zO0034D128\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO0034D128\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        PID:4080
      • C:\Users\Admin\AppData\Local\Temp\7zO0034D128\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO0034D128\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2968
    • C:\Users\Admin\AppData\Local\Temp\7zO003C8628\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO003C8628\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:1288
      • C:\Users\Admin\AppData\Local\Temp\7zO003C8628\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003C8628\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1168
    • C:\Users\Admin\AppData\Local\Temp\7zO00346428\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO00346428\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:2772
      • C:\Users\Admin\AppData\Local\Temp\7zO00346428\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO00346428\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        PID:1420
      • C:\Users\Admin\AppData\Local\Temp\7zO00346428\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO00346428\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4812
    • C:\Users\Admin\AppData\Local\Temp\7zO003BC528\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO003BC528\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:4616
      • C:\Users\Admin\AppData\Local\Temp\7zO003BC528\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003BC528\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:252
    • C:\Users\Admin\AppData\Local\Temp\7zO00349A38\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO00349A38\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:4940
      • C:\Users\Admin\AppData\Local\Temp\7zO00349A38\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO00349A38\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        PID:2592
      • C:\Users\Admin\AppData\Local\Temp\7zO00349A38\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO00349A38\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4092
    • C:\Users\Admin\AppData\Local\Temp\7zO0035E738\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO0035E738\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:4528
      • C:\Users\Admin\AppData\Local\Temp\7zO0035E738\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO0035E738\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4676
    • C:\Users\Admin\AppData\Local\Temp\7zO003C7978\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO003C7978\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:5044
      • C:\Users\Admin\AppData\Local\Temp\7zO003C7978\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003C7978\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2836
    • C:\Users\Admin\AppData\Local\Temp\7zO00359C78\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO00359C78\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:3452
      • C:\Users\Admin\AppData\Local\Temp\7zO00359C78\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO00359C78\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1312
    • C:\Users\Admin\AppData\Local\Temp\7zO003BD278\TempSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO003BD278\TempSpoofer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:1824
      • C:\Users\Admin\AppData\Local\Temp\7zO003BD278\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003BD278\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        PID:4016
      • C:\Users\Admin\AppData\Local\Temp\7zO003BD278\TempSpoofer.exe
        "C:\Users\Admin\AppData\Local\Temp\7zO003BD278\TempSpoofer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3728
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3120
    • C:\Users\Admin\Desktop\TempSpoofer.exe
      "C:\Users\Admin\Desktop\TempSpoofer.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      PID:2400
      • C:\Users\Admin\Desktop\TempSpoofer.exe
        "C:\Users\Admin\Desktop\TempSpoofer.exe"
        2⤵
        • Executes dropped EXE
        PID:4800
      • C:\Users\Admin\Desktop\TempSpoofer.exe
        "C:\Users\Admin\Desktop\TempSpoofer.exe"
        2⤵
        • Executes dropped EXE
        PID:4820
      • C:\Users\Admin\Desktop\TempSpoofer.exe
        "C:\Users\Admin\Desktop\TempSpoofer.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4524
    • C:\Users\Admin\Desktop\TempSpoofer.exe
      "C:\Users\Admin\Desktop\TempSpoofer.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:3768
      • C:\Users\Admin\Desktop\TempSpoofer.exe
        "C:\Users\Admin\Desktop\TempSpoofer.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2740
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 1400
          3⤵
          • Program crash
          PID:2324
    • C:\Users\Admin\Desktop\TempSpoofer.exe
      "C:\Users\Admin\Desktop\TempSpoofer.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:4784
      • C:\Users\Admin\Desktop\TempSpoofer.exe
        "C:\Users\Admin\Desktop\TempSpoofer.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:720
    • C:\Users\Admin\Desktop\TempSpoofer.exe
      "C:\Users\Admin\Desktop\TempSpoofer.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2332
      • C:\Users\Admin\Desktop\TempSpoofer.exe
        "C:\Users\Admin\Desktop\TempSpoofer.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:252
    • C:\Users\Admin\Desktop\TempSpoofer.exe
      "C:\Users\Admin\Desktop\TempSpoofer.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:2228
      • C:\Users\Admin\Desktop\TempSpoofer.exe
        "C:\Users\Admin\Desktop\TempSpoofer.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:708
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2740 -ip 2740
      1⤵
        PID:1596
      • C:\Users\Admin\Desktop\TempSpoofer.exe
        "C:\Users\Admin\Desktop\TempSpoofer.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:660
        • C:\Users\Admin\Desktop\TempSpoofer.exe
          "C:\Users\Admin\Desktop\TempSpoofer.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1456
      • C:\Users\Admin\Desktop\TempSpoofer.exe
        "C:\Users\Admin\Desktop\TempSpoofer.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:1364
        • C:\Users\Admin\Desktop\TempSpoofer.exe
          "C:\Users\Admin\Desktop\TempSpoofer.exe"
          2⤵
          • Executes dropped EXE
          PID:392
        • C:\Users\Admin\Desktop\TempSpoofer.exe
          "C:\Users\Admin\Desktop\TempSpoofer.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1092

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\7zO003558F7\TempSpoofer.exe
        Filesize

        393KB

        MD5

        3c4161be295e9e9d019ce68dae82d60a

        SHA1

        36447fc6418e209dff1bb8a5e576f4d46e3b3296

        SHA256

        0f6481dabf7871823f259eb95f3b85c37d1de8a7d1884ac77a97d887cf96f75d

        SHA512

        cfa2d491a5d28beb8eb908d5af61254ac4c4c88e74c53d5d00ae15ef0731df1654304199996545d1074814c0ea8a032957b28d70774f05347616428e667f70e6

        Download Submit

      • memory/752-10-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/752-13-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/752-14-0x0000000000070000-0x00000000000D8000-memory.dmp

        Filesize

        416KB

        Download

      • memory/1868-24-0x0000000000C2A000-0x0000000000C2B000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2224-9-0x000000000008A000-0x000000000008B000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2416-29-0x0000000000C10000-0x0000000000C78000-memory.dmp

        Filesize

        416KB

        Download