Overview

overview

10

Static

static

1

setup.exe

windows10-2004-x64

10

setup.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    41s
  • max time network
    42s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/06/2025, 23:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 8.0MB
  • Sample250627-3jkftssms9
  • SHA256 5738fef8f30ca45683d3526e8ded8bb144383523e2259f1c3fc68e4d7480d891
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lummadiscoveryspywarestealer

Malware Config

Extracted

Family

  • lumma

C2

  • https://insye.xyz/tieq

  • https://gewgb.xyz/axgh

  • https://skjgx.xyz/riuw

  • https://ropyi.xyz/zadf

  • https://spjeo.xyz/axka

  • https://baviip.xyz/twiw

  • https://shaeb.xyz/ikxz

  • https://firddy.xyz/yhbc

  • https://trqqe.xyz/xudu

Attributes
  • build_id

    70ed222567a3aba3ee554e5ca27fd268f1ba8b

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c copy Annually.wbk Annually.wbk.bat & Annually.wbk.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3708
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5436
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "opssvc wrsa"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3380
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4532
      • C:\Windows\SysWOW64\findstr.exe
        findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2192
      • C:\Windows\SysWOW64\extrac32.exe
        extrac32 /Y Launched.wbk *.*
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1360
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V "ASSOCIATED" Physician
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5964
      • C:\Users\Admin\AppData\Local\Temp\607499\Tale.com
        Tale.com i
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1924
      • C:\Windows\SysWOW64\choice.exe
        choice /d n /t 5
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Tale.com
        • Path C:\Users\Admin\AppData\Local\Temp\607499\Tale.com
        • Size 925KB
        • SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        i
        • Path C:\Users\Admin\AppData\Local\Temp\607499\i
        • Size 454KB
        • SHA256 1cf82e4c66cac2ef250af5c02bde64344734657f86b39cd0cadbe8e28be514b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Annually.wbk
        • Path C:\Users\Admin\AppData\Local\Temp\Annually.wbk
        • Size 20KB
        • SHA256 abe86d64e7f843bf9807b6ca91a977538c4cf03414d05d3a9b39b2926a2b612a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Ap
        • Path C:\Users\Admin\AppData\Local\Temp\Ap
        • Size 69KB
        • SHA256 b85a8dbac4505618e6f35054321c73a1f24436e8a3578152ed85c4d7cad07ec8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Bondage
        • Path C:\Users\Admin\AppData\Local\Temp\Bondage
        • Size 125KB
        • SHA256 e0bb528f261ce87ac5e0fc467abf864ddb6c9165b51d1476f6ac16cd07dce112
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Decorating
        • Path C:\Users\Admin\AppData\Local\Temp\Decorating
        • Size 93KB
        • SHA256 76233ee2c5910d6fe816bec81561fee58ace9c442ac203f8183b342e85cee755
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Enlargement
        • Path C:\Users\Admin\AppData\Local\Temp\Enlargement
        • Size 60KB
        • SHA256 391d22edb252906f805e66b13a8c4acf55e0d4aee7108ba251453be2cf021231
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Erp.wbk
        • Path C:\Users\Admin\AppData\Local\Temp\Erp.wbk
        • Size 61KB
        • SHA256 9190b2a0460b74bdcaeb84a9fa97deae4639e26a40e2079072a4e0aee4253937
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Final
        • Path C:\Users\Admin\AppData\Local\Temp\Final
        • Size 107KB
        • SHA256 552264d69890618b8266fba12edf9e7417fa3c9bae0ef6597e76d9c38b8b55d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Founded.wbk
        • Path C:\Users\Admin\AppData\Local\Temp\Founded.wbk
        • Size 34KB
        • SHA256 7110cc78768fd63b2e09c9602e6129e00d675e11bfac46bee1caf0d7ad7cd6ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Gm.wbk
        • Path C:\Users\Admin\AppData\Local\Temp\Gm.wbk
        • Size 89KB
        • SHA256 5130cb09a890f038cb675711a8cb997c3a66b2265b4e18d147638f427c5408d6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Launched.wbk
        • Path C:\Users\Admin\AppData\Local\Temp\Launched.wbk
        • Size 476KB
        • SHA256 b46be58beca75779878516087a986b5c9c1bfae000519b9c6e419353993cf73e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Maritime
        • Path C:\Users\Admin\AppData\Local\Temp\Maritime
        • Size 102KB
        • SHA256 d53e3ac71f191b113f147b3813cd209db08c853c2c66e5d5c1a617bdfcfdb67a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Merge
        • Path C:\Users\Admin\AppData\Local\Temp\Merge
        • Size 72KB
        • SHA256 3b0566685e0f717eb0dcfc7e779550a847783521f04d1fa5981677984d0bfaaf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Oman
        • Path C:\Users\Admin\AppData\Local\Temp\Oman
        • Size 113KB
        • SHA256 bc1f7a1f6876b5abe6365c5cf70476176963e880a9116f73ce7c1aaa190a8e80
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Physician
        • Path C:\Users\Admin\AppData\Local\Temp\Physician
        • Size 2KB
        • SHA256 5f9c2183cdcf800a30ea749fb82db90d0b089bef1fe2c5a9fd3049b484f25400
        • MD5 SHA1 SHA512
        Submit Download

        Ralph
        • Path C:\Users\Admin\AppData\Local\Temp\Ralph
        • Size 73KB
        • SHA256 2e68c66c4d9b2af6150a315b46133f2499e44708df0564ce719d90698767aec1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Rs.wbk
        • Path C:\Users\Admin\AppData\Local\Temp\Rs.wbk
        • Size 83KB
        • SHA256 9a6c9af4b0e0bd330401cc4edccf3de82d56b5a0edb90d09054b9694df30881d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Shift.wbk
        • Path C:\Users\Admin\AppData\Local\Temp\Shift.wbk
        • Size 81KB
        • SHA256 342e83217da8a8223ca5be7ccbf4c531de0e60915f25df6c75382fb1953d6ab5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Sophisticated
        • Path C:\Users\Admin\AppData\Local\Temp\Sophisticated
        • Size 53KB
        • SHA256 42d952dea0f20c3ebe9fb1d033f38795885359fc109d95b824a37ba759054df0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Subdivision.wbk
        • Path C:\Users\Admin\AppData\Local\Temp\Subdivision.wbk
        • Size 55KB
        • SHA256 8ec0a6577c7205b6d36e5fcb9317c12703766c4dd98040eb44fe2f92cf86fc44
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Surveillance.wbk
        • Path C:\Users\Admin\AppData\Local\Temp\Surveillance.wbk
        • Size 51KB
        • SHA256 341a5ce2b2b17ce4fdd13174f9b1d8dbce8be443690fe10a6c74f80fcb3d259d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Trees
        • Path C:\Users\Admin\AppData\Local\Temp\Trees
        • Size 55KB
        • SHA256 d31559c9951fca6fe84cd325da53bd1b2169cb79256b46c13a7eee94d0389eef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1924-532-0x0000000004640000-0x000000000469F000-memory.dmp
        Download

        memory/1924-533-0x0000000004640000-0x000000000469F000-memory.dmp
        Download

        memory/1924-536-0x0000000004640000-0x000000000469F000-memory.dmp
        Download

        memory/1924-535-0x0000000004640000-0x000000000469F000-memory.dmp
        Download

        memory/1924-534-0x0000000004640000-0x000000000469F000-memory.dmp
        Download