lumma | 02c22cb54244b9a05b47ce93046dbdbdee3724ae33e63799163975eaad85c698

Analysis

max time kernel
104s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2025, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.9MB
Sample250904-epe7ashn21
SHA256 02c22cb54244b9a05b47ce93046dbdbdee3724ae33e63799163975eaad85c698
MD5 483208958a2041f4cfe497027eef415b
SHA1 51fb181d083dcfcbadeaa142a50a213dc598beca
SHA512 d07c41fae1b34ccf4d81adbe0ff66412bcfadb67a60a1e6a2abb41996fc317c15f2c6c0fae2f28b8a7d8614f2e7174834b760d5c83a5f4bcc82d0ddda1ef7ef2
SSDEEP 49152:2btE4jdDSqB8cXJcVDS8GUBewy7WLlQ2zHAg9oGTX6EMbXkH:23dDSqXXJ+Jxe17ON8ATX2j8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery lumma ransomware stealer

Malware Config

Extracted

Family

lumma

https://t.me/quincyplayer6
https://starexs.bet/tskx
https://mastwin.in/qsaz
https://noggs.ru/yopd
https://georgej.ru/plnb
https://oneflof.ru/tids
https://epitherd.ru/zadw
https://backab.ru/lkdo
https://eigwos.ru/wqex
https://kimmenkiz.ru/zldw

Attributes

build_id
e33745354a1aa38258cc7946e555237d

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000\Control Panel\International\Geo\Nation	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 320	1896	file.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\.apx	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\.apx\ = "AutoProx.File"	file.exe
Key created	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\AutoProx.File\shell\open\command	file.exe
Key created	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\AutoProx.File\shell\open	file.exe
Key created	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\Local Settings	file.exe
Key created	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\AutoProx.File	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\AutoProx.File\ = "AutoProx File"	file.exe
Key created	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\AutoProx.File\DefaultIcon	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\AutoProx.File\DefaultIcon\ = "%SystemRoot%\\System32\\shell32.dll,154"	file.exe
Key created	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\AutoProx.File\shell	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2012121138-1878458325-808874697-1000_Classes\AutoProx.File\shell\open\command\ = "notepad.exe \"%1\""	file.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4644	notepad.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 320	1896	file.exe	84
PID 1896 wrote to memory of 320	1896	file.exe	84
PID 1896 wrote to memory of 320	1896	file.exe	84
PID 1896 wrote to memory of 320	1896	file.exe	84
PID 1896 wrote to memory of 320	1896	file.exe	84
PID 1896 wrote to memory of 320	1896	file.exe	84
PID 1896 wrote to memory of 320	1896	file.exe	84
PID 1896 wrote to memory of 320	1896	file.exe	84
PID 1896 wrote to memory of 320	1896	file.exe	84
PID 1896 wrote to memory of 4644	1896	file.exe	88
PID 1896 wrote to memory of 4644	1896	file.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:320
- C:\Windows\system32\notepad.exe
  "notepad.exe" "C:\Users\Admin\Desktop\sample.apx"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sample.apx

Path C:\Users\Admin\Documents\AutoProx\sample.apx
Size 170B
SHA256 4a4692a6274166cf7ab19631fbb291c2acc894c4a82a01e8d4f5fd29bd919225
MD5 7228b9f60d7580e138a8992b21b0f102
SHA1 33c479677dc47434f2bda24b5f7adeb176830a6a
SHA512 3676e9d665dcf46390fb6c5cd7c33401fe2c229f28843b1330d51575a7427ca72e77953b7023df4ee174cd659768a2fd009d12b946a97a46077bff32a37dd61a
MD5 SHA1 SHA512

Submit Download

memory/320-0-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/320-3-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/320-4-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/320-15-0x0000000000400000-0x0000000000463000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads