Overview

overview

10

Static

static

3

🔁⊎�...��.exe

windows10-2004-x64

10

🔁⊎�...��.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    101s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/07/2025, 16:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    🔁⊎𝕤𝕖𝕥𝕦𝕡.exe
  • Size 1.1MB
  • Sample250725-tpvdjssves
  • SHA256 e7b70294a3acb6b76bac1cc1c3a7f01bbf5bb873c7bec447b1d516c5b2f16370
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lummadiscoveryspywarestealer

Malware Config

Extracted

Family

  • lumma

C2

  • https://sponfht.com/xrie

  • https://molefkx.com/xalo

  • https://runuxs.org/zpla

  • https://follcp.org/atnr

  • https://remotuw.org/xiza

  • https://boltex.net/xpao

  • https://detrewb.net/aqyw

  • https://berijng.net/otir

Attributes
  • build_id

    a74c060b8215d446337c49807355700694e9

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\🔁⊎𝕤𝕖𝕥𝕦𝕡.exe
    "C:\Users\Admin\AppData\Local\Temp\🔁⊎𝕤𝕖𝕥𝕦𝕡.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /k move Ratio.wp5 Ratio.wp5.cmd & Ratio.wp5.cmd & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1236
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2756
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "opssvc wrsa"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1928
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3912
      • C:\Windows\SysWOW64\findstr.exe
        findstr "SophosHealth nsWscSvc ekrn bdservicehost AvastUI AVGUI & if not errorlevel 1 Set NLQGtLLvbZcLdVvsXBFUfnXazRVjJUI=AutoIt3.exe & Set cHHYdinDmVUUhLdxROXB=.a3x & Set MDTYQTdcx=300
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4496
      • C:\Windows\SysWOW64\extrac32.exe
        extrac32 /Y Airports.wp5 *.*
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5028
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V "ellen" Wholesale
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1428
      • C:\Users\Admin\AppData\Local\Temp\11689\Four.com
        Four.com r
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1592
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 5
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3032

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Four.com
        • Path C:\Users\Admin\AppData\Local\Temp\11689\Four.com
        • Size 957KB
        • SHA256 3ec9740bedc683021cc3e94e4a33b3a9d3d6f9b9e96b1f04cc6534f551dd58c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        r
        • Path C:\Users\Admin\AppData\Local\Temp\11689\r
        • Size 482KB
        • SHA256 71d5f7a1aebd32f13d5acd6009052b26d7b43bb76b67a4f314a06860221cbdc6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Airports.wp5
        • Path C:\Users\Admin\AppData\Local\Temp\Airports.wp5
        • Size 494KB
        • SHA256 97712555d0a8531d234780441e01aec37c18fc72e445d5a33330c9264a074e12
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        As.wp5
        • Path C:\Users\Admin\AppData\Local\Temp\As.wp5
        • Size 64KB
        • SHA256 c588bd59d2e86031a97203f625b2775c971ebb8da31c5a19febb604d8d2d7569
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Beginners
        • Path C:\Users\Admin\AppData\Local\Temp\Beginners
        • Size 50KB
        • SHA256 e9a7eef8ae3a856fbe4c3669e0a3071755e3463731dd201ca25988fdf9f1c104
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cooperative
        • Path C:\Users\Admin\AppData\Local\Temp\Cooperative
        • Size 100KB
        • SHA256 a80e1ad9d6c4a180a5edb14cd40911199ffe2ed605baff8b8ca20e7c5828b5f3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Defects
        • Path C:\Users\Admin\AppData\Local\Temp\Defects
        • Size 116KB
        • SHA256 c487a6c4dcf9685c2794e2f6fecee3989fc3905b4716096a4e5a18d198fe2c2a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Directed.wp5
        • Path C:\Users\Admin\AppData\Local\Temp\Directed.wp5
        • Size 56KB
        • SHA256 ccb62515263b763789ee72b4789b1f0d0ff74cf50e3d329475f298bab12039e1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Exhibitions.wp5
        • Path C:\Users\Admin\AppData\Local\Temp\Exhibitions.wp5
        • Size 97KB
        • SHA256 ee5497b6f0986566696503be5f0b265b9936c2687a528ccbdf5e118b9962a26e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Gossip
        • Path C:\Users\Admin\AppData\Local\Temp\Gossip
        • Size 114KB
        • SHA256 701bba2c29338d58fe52d728cad08f5dd5d0930a4301d8b1266e5ea5ce1d8731
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Matched
        • Path C:\Users\Admin\AppData\Local\Temp\Matched
        • Size 75KB
        • SHA256 dce694173c91aa361319920931ce3a3b95ff0c7b8b9a5f9547c894ee8f468d84
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Numerous
        • Path C:\Users\Admin\AppData\Local\Temp\Numerous
        • Size 119KB
        • SHA256 7c48c856f7b9863b4d11603d7cd1527c5a77f4acc44218a134f23658b06849c5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Photos.wp5
        • Path C:\Users\Admin\AppData\Local\Temp\Photos.wp5
        • Size 53KB
        • SHA256 a7d92cea1cf73fd8e35412da168803aa36e5ce388c0946bb79ddc77866af16a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Player.wp5
        • Path C:\Users\Admin\AppData\Local\Temp\Player.wp5
        • Size 89KB
        • SHA256 9b78aff3dcb710ceba126667850c83ad924af1f299162f4fb7996138bf13bb70
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Ratio.wp5
        • Path C:\Users\Admin\AppData\Local\Temp\Ratio.wp5
        • Size 31KB
        • SHA256 57d282dba80478664e54975db3b079de8796fd597f852a4c240f10d6289c5794
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Sagem.wp5
        • Path C:\Users\Admin\AppData\Local\Temp\Sagem.wp5
        • Size 57KB
        • SHA256 cc8b223ae5952ee6d2303afd41cdd2b326b9aa39cc935af4baca14ca2cd93b9f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Sale
        • Path C:\Users\Admin\AppData\Local\Temp\Sale
        • Size 137KB
        • SHA256 08ea898869fbf0449531e6a451fba99c61e5116f5c2e0877407fa8aab671b861
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Strip
        • Path C:\Users\Admin\AppData\Local\Temp\Strip
        • Size 46KB
        • SHA256 cf9d09fa3bec7230d78cc136e7d0aecc941c34739feed9ca984228a268503744
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Swing
        • Path C:\Users\Admin\AppData\Local\Temp\Swing
        • Size 73KB
        • SHA256 ae97bd4baa637dcd07758bfd9f1aabf2283c55eb8f6ac70aa9c0f948f8625378
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Teenage.wp5
        • Path C:\Users\Admin\AppData\Local\Temp\Teenage.wp5
        • Size 66KB
        • SHA256 47f7d3ab4bc7f023c52d230971943c35d1c67fa0eb76c451984aec0a740ea571
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Therefore
        • Path C:\Users\Admin\AppData\Local\Temp\Therefore
        • Size 75KB
        • SHA256 68b84582d86520dcc9c6e90afb53f2c0b0846daf66753e9d51a784ddf34b303d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Tubes
        • Path C:\Users\Admin\AppData\Local\Temp\Tubes
        • Size 50KB
        • SHA256 2623767430ea4ff47720716a5702264cc1a081b8e6b2ad23518302e43380759c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Wholesale
        • Path C:\Users\Admin\AppData\Local\Temp\Wholesale
        • Size 2KB
        • SHA256 3e736c82327204ef068c468ffbe9478656baaf8730d1df896353b6a8f07d360e
        • MD5 SHA1 SHA512
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nso6A64.tmp\nsExec.dll
        • Size 6KB
        • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1592-79-0x0000000004ED0000-0x0000000004F2F000-memory.dmp
        Download

        memory/1592-80-0x0000000004ED0000-0x0000000004F2F000-memory.dmp
        Download

        memory/1592-81-0x0000000004ED0000-0x0000000004F2F000-memory.dmp
        Download

        memory/1592-82-0x0000000004ED0000-0x0000000004F2F000-memory.dmp
        Download

        memory/1592-83-0x0000000004ED0000-0x0000000004F2F000-memory.dmp
        Download