Overview

overview

10

Static

static

3

setup.exe

windows10-2004-x64

10

setup.exe

windows10-ltsc_2021-x64

10

setup.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    147s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250610-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250610-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    15/07/2025, 12:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 1.0MB
  • Sample250715-py935sdr41
  • SHA256 9717a2f7f85ffa49ae0ca0b8f9b72ecf2fc54a79a74771ea3c16c1acd21846ea
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lummadiscoveryspywarestealer

Malware Config

Extracted

Family

  • lumma

C2

  • https://t.me/ghifty86

  • https://siyju.pics/anbz

  • https://prvqhm.shop/zaus

  • https://sorrij.top/adjh

  • https://bardj.xyz/tieq

  • https://annwt.xyz/xkan

  • https://ungryo.shop/gnbw

  • https://greqjfu.xyz/uhbf

  • https://vervzv.xyz/xmgr

  • https://dryzc.xyz/apxe

Attributes
  • build_id

    290521f706a01cc046591462627455b9da1ac2

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /k move Beneficial.mpg Beneficial.mpg.cmd & Beneficial.mpg.cmd & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1392
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "opssvc wrsa"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1284
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3160
      • C:\Windows\SysWOW64\findstr.exe
        findstr "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set qXzn=AutoIt3.exe & Set SgLryVEkU=.a3x & Set mnPqkcXbO=300
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1820
      • C:\Windows\SysWOW64\extrac32.exe
        extrac32 /Y Vegetables.mpg *.*
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1648
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V "relevance" Cheese
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2844
      • C:\Users\Admin\AppData\Local\Temp\811642\Alleged.com
        Alleged.com F
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3468
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 5
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4748

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Alleged.com
        • Path C:\Users\Admin\AppData\Local\Temp\811642\Alleged.com
        • Size 925KB
        • SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        F
        • Path C:\Users\Admin\AppData\Local\Temp\811642\F
        • Size 455KB
        • SHA256 bf13d7a9e0f9c3eec4591802d210e1e9ab21c74cd63a7a1a79a6b7eb03ba97f4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Beneficial.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\Beneficial.mpg
        • Size 21KB
        • SHA256 6be414f2c07ba33606441a32a8498d6489eb6cf5fe1ba9de8a74fc23478df560
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Carl
        • Path C:\Users\Admin\AppData\Local\Temp\Carl
        • Size 105KB
        • SHA256 74440ed2165f72adc08dcc8e6f0f0b3c3f066e35ec6f5084246ab75f73d115a4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Census.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\Census.mpg
        • Size 94KB
        • SHA256 4e12f90b428e3eea595271a4fd32f8801083466b831e9e79a55df330ea67a1d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cheese
        • Path C:\Users\Admin\AppData\Local\Temp\Cheese
        • Size 1KB
        • SHA256 cd95c9f1ea27f3aec81cb44a34e80133f422609258d078f0bfb35c34047b1fff
        • MD5 SHA1 SHA512
        Submit Download

        Classroom.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\Classroom.mpg
        • Size 85KB
        • SHA256 8403a59c6ae535f29bc72c0c13e5202125bc1392481871ea0ae910e93543ef87
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Congressional.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\Congressional.mpg
        • Size 50KB
        • SHA256 39128b642d7bc0477b6a9727a090ab5d09714d34af9efde7e07b4901b0e00d68
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Continuity
        • Path C:\Users\Admin\AppData\Local\Temp\Continuity
        • Size 149KB
        • SHA256 d02cb09a542e3e2a0aabd88da684004bd84625442d4f9306b984431992284899
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Grown.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\Grown.mpg
        • Size 89KB
        • SHA256 74c180f081062a6ebc555d472e5f09b3520388bc9f080d04c7e14a566375f9f2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Look
        • Path C:\Users\Admin\AppData\Local\Temp\Look
        • Size 74KB
        • SHA256 2d3f1182e40fa340a4da5889d5f7c587a0e14c3f2f31d696750af9f36ad01aef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Numeric
        • Path C:\Users\Admin\AppData\Local\Temp\Numeric
        • Size 62KB
        • SHA256 17f3d04bc17d3d6f361a5554a599e8706c2e9448c7e34f33145a7bf1407778cf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Piece
        • Path C:\Users\Admin\AppData\Local\Temp\Piece
        • Size 90KB
        • SHA256 ece4c656c1c8e3bfa595e533f70624559b4a4d54ddba931b7b5a8ab142bbc831
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Rest
        • Path C:\Users\Admin\AppData\Local\Temp\Rest
        • Size 50KB
        • SHA256 ab6e52494e05ed25dc46a4a92ab7c6426cada31009ce0400aa2078dca446e3f1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Russia
        • Path C:\Users\Admin\AppData\Local\Temp\Russia
        • Size 86KB
        • SHA256 ecf23be239a40c5f7aae1ff2ad4d692630dbc3b552b6395bad3af624d82ce041
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Score
        • Path C:\Users\Admin\AppData\Local\Temp\Score
        • Size 91KB
        • SHA256 4c2c14f5cb9ea7aa86c9e0230e9e8448bb59cc0998e1d1f9e6f02ba356987498
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Seasons
        • Path C:\Users\Admin\AppData\Local\Temp\Seasons
        • Size 69KB
        • SHA256 56782ef1195963b85f65cd8a83ab3f7478af1498d6c3d06c51a20277aed2bac5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Seating.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\Seating.mpg
        • Size 56KB
        • SHA256 b6a6e9cf58d64c012db76c4145b5820fe07a2f15a4a7d6a6c0788fe70a2c130b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Secret
        • Path C:\Users\Admin\AppData\Local\Temp\Secret
        • Size 7KB
        • SHA256 61fe0238284fcb29ec193a8354f93df81fb4f6fb9016797dead84e977bec5324
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Ts
        • Path C:\Users\Admin\AppData\Local\Temp\Ts
        • Size 140KB
        • SHA256 cfda7ddda8dc498bfe11770a2581ee7519a992e54ccc9c90e72a967859823bf8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Ul.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\Ul.mpg
        • Size 81KB
        • SHA256 c5527b1f95d943a47a53dc130c4f49a2be2718226cb3094b67176a94947c5a8a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Vegetables.mpg
        • Path C:\Users\Admin\AppData\Local\Temp\Vegetables.mpg
        • Size 476KB
        • SHA256 1ad86b859841c9d9ae47a5a1b759d8454cee0cee8a0ea9e146528274efbcdee6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\nsExec.dll
        • Size 6KB
        • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3468-79-0x0000000005100000-0x000000000515F000-memory.dmp
        Download

        memory/3468-81-0x0000000005100000-0x000000000515F000-memory.dmp
        Download

        memory/3468-80-0x0000000005100000-0x000000000515F000-memory.dmp
        Download

        memory/3468-82-0x0000000005100000-0x000000000515F000-memory.dmp
        Download

        memory/3468-83-0x0000000005100000-0x000000000515F000-memory.dmp
        Download