lumma | 3a4440ce511cc7583d97e3cc2583bc456107d4c2fa562f11ecfb4ee89cb221c2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/02/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
StatedPanasonic.exe
Size 1.8MB
Sample260211-acn68act4b
SHA256 3a4440ce511cc7583d97e3cc2583bc456107d4c2fa562f11ecfb4ee89cb221c2
MD5 dc91c99b0510aa1199bf9bdde4e77318
SHA1 2ccc23b18ff542bae1b1c3d70392d3b414058816
SHA512 0455cd7b1f1918cc3e2f2c08c6020ace6e766c0b6a8de00d65e1155c3004cf370caa36ac58ec297a320a36cde2dbcbcdc96218a7e5d3d9d4f3ee66dddadf4430
SSDEEP 49152:H8hdkpCoi8hdkpCoJldX9Xs0Tqeui+/Se0HjDBuOCxsDRm:H8hdkpCoi8hdkpCoJldBluP0HjDBuOsB
TLSH
T119950183FE9C62A5CC3C5976D4B344420732AD2E879A1B5B50DCF23664931A35B3E63E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma persistence stealer

Malware Config

Extracted

Family

lumma

https://oculusr.cyou/api
https://whitepepper.su/asds
https://hammernew.su/asdase
https://heavylussy.su/ccvfd
https://broguenko.su/asfase
https://homuncloud.su/ascasef
https://familyriwo.su/fssdaw
https://izzardtow.su/cascasc
https://basilicros.su/asdasq

Attributes

build_id
6dc73dbee34a7495aaf3a4da15dc80c0d7aea4

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 1 IoCs

pid	Process
1560	Lbs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	StatedPanasonic.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lbs.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1560	Lbs.exe
1560	Lbs.exe
1560	Lbs.exe
1560	Lbs.exe
1560	Lbs.exe
1560	Lbs.exe
1560	Lbs.exe
1560	Lbs.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1560	Lbs.exe
1560	Lbs.exe
1560	Lbs.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1560	Lbs.exe
1560	Lbs.exe
1560	Lbs.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1000	4844	StatedPanasonic.exe	88
PID 4844 wrote to memory of 2900	4844	StatedPanasonic.exe	90
PID 2900 wrote to memory of 4312	2900	cmd.exe	92
PID 2900 wrote to memory of 3532	2900	cmd.exe	93
PID 3532 wrote to memory of 3148	3532	cmd.exe	95
PID 3532 wrote to memory of 1560	3532	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\StatedPanasonic.exe
"C:\Users\Admin\AppData\Local\Temp\StatedPanasonic.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SYSTEM32\reg.exe
  reg.exe /dfghskhjdf987347589374a
  2⤵
  PID:1000
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c nuyksDa & type Pull.xls | %comspec%
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type Pull.xls "
    3⤵
    PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\system32\findstr.exe
      findstr /V "RAY" Peeing
      4⤵
      PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\732931\Lbs.exe
      Lbs.exe C
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lbs.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\732931\Lbs.exe
Size 957KB
SHA256 02862289fbed08ab4a6e0cbf5bff34579827738aa8b01b388af3877184813b65
MD5 ebc8e59a17bbfc7b73365e3a6b4dac48
SHA1 b864a62b6fa7a2cd17207668469565da890177ce
SHA512 55d4466e3adeb6ef9fbccf766f421a390829265c96e2b84508bdbf939187002214424c1816e3824a8ab558de32944a8d9e4bfbb88eca23b53ff8dc0542b646aa
SSDEEP 24576:OpLy2+H1AvYVJjWrA4A73log5w3aHGrMB:OM2+H1A4jWq71j2rM
TLSH
T1A9259E0373D18022FF93AA721D5FE7265ABC6D2A0323956F13D81DB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Equity.xls

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Equity.xls
Size 760KB
SHA256 a65209d999e8c971ca6a040cb184b373857ef519dcad21e6c44037b988cf60b0
MD5 26b07439cc6acb15e6d217fbb022d98e
SHA1 37e6bf1cdf5feb707f54dd958355c535a9349296
SHA512 48ec31f73e2aaa690a0c70c96ec7774c936bc672422ca26d786db9d40fd3e0469bda5e62a2fc5752843a2082e0788a29152563eabb080371975a7e4e4993ea69
SSDEEP 12288:OfARudc6Z3CmVxkm5/oHEmbhecXA8XTAbCPQC7i6/YfANEv+UIJAjGK/pd28H5Hl:mEIcxY6mwHbhechTSIQC7i6wfEEv+USe
TLSH
T1C4F4237AC4327223E8AF437F1D388845CEB6077917E8B5A4E24DD99881ED51AF6F21C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Indonesia

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Indonesia
Size 481KB
SHA256 5066f20a11d8a92acb68bc66d49030c92c9bb53b4afe3294f6d37f1b8c0b9219
MD5 32a297607ebfeaa08e7dad6f9fc12233
SHA1 0d619f2ba2c1b79d6387c293681bd19412cb9a1e
SHA512 4219ebceba7f2a9c47fa0c30f078ede53d0bb9a41e52f3fa79a5d61f72332b840135bc388ce411cf2032cc40a6b96ce9ebde867122f42826abd3e9bc6e0341c8
SSDEEP 12288:bfjW/TASDSnPN/FYmb739cpkLogdLe4Fdw3aHGrh:7jWrA4A73log5w3aHGrh
TLSH
T1F9A47D0373E24066FFE3E2B34F5AE61697F96A1A4013C63F129819B9FA71271461E173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Paste

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Paste
Size 116KB
SHA256 81bf1dab836f0f2f20837a264ad5814c1e99577d0be78223333293c1399711ab
MD5 bdba99b9d827c39e6d818154c5c46c65
SHA1 69049bb3e12e1edd107a2ea6809a53e905ce1392
SHA512 6a1824a7691e17a81e4ae5af4733ff011124ddfb62bab709994df559dd54f36a00b13dd3ad695d0c4370fb46a3e32e1aed3c3bd6463ab30ce72033b6c6f01157
SSDEEP 1536:/3onH3EYrDWyu0uZo2+9Br/oKz0+vvohTlFj3W5JnpG3fvS0uLQ:/4nHDWy4ZNorgK4+vQR3iJp6vS0eQ
TLSH
T165C3A0535AA90157E0A37A38756FF73F0A68BD9F9B34B23A031C3F8E98156409895733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Peeing

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Peeing
Size 433B
SHA256 11e0df1342f8363c68604c2229389eab1ee1712fe99628df23019359a7287a83
MD5 eb1ae06b8671f55d714857d72937524e
SHA1 b25f1c1a4641ea05caaddaa00a7832779cb95bd0
SHA512 810ed6715fa268cf17f77eaadc2c56d44e0c36b78971ef71468a0734fc034d171d647f25c00ead159b354c4d09530e022d4316f1e89b55da0f2bc92226eb1487
TLSH
T17AE07D3372E54CF0F10C0036813E84E0A26D4639A796C3C629C7613B75CB0AC40C9C44
MD5 SHA1 SHA512 TLSH

Submit Download

Pull.xls

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Pull.xls
Size 3KB
SHA256 450fee196bf3945e9d55a41289a26617063f8f8db946263663567d47227571fb
MD5 4076fb0c0a052ed748eccb25380a9762
SHA1 82e9ef683db8fd74be7244c67b0a10ac0d4aae53
SHA512 9815abeb774c415599b3a43f63273fd18e0402def2b795249551c01a6ca4e7dd846559e5ff98fef50899fb204e95eac8ac752ecace4bd0133c97cb42b2ac4486
TLSH
T1B18109F8F14E0DA5388F7721ABF4880A4972C3523C07116D9FDB5DA4767851882BAE36
MD5 SHA1 SHA512 TLSH

Submit Download

Rate

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rate
Size 359KB
SHA256 400cfb7d7089ea830506ff4995c57e0c03b83f30656be4a625e3445c54a34995
MD5 a96ec6c0b21d653f18e40fdf928301a9
SHA1 c389450c71555682c26d68c4c963af8163e9ade5
SHA512 a1a44869db9cbd205c768d2a92d95fb220b7f9bf1250a8c9f61eb39eaec219d3d272d0e4cc3054f136faa5a1e282dcded420b5f3c5654676dffff1934b213827
SSDEEP 6144:/mcLvyhtkv9axZHTx4pQf3WYSDoP8M/AOghDP2uAV5GPs9:/pL6h29iZHTxQQftAHP2uAVqs9
TLSH
T1A774AE02A4C1C171C8930C705C6BEBA2AE3C9D350724ADCBB7D91D76DE609D29B27E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1560-27-0x0000000002970000-0x0000000002971000-memory.dmp

Download

memory/1560-28-0x0000000000020000-0x0000000000089000-memory.dmp

Download

memory/1560-30-0x0000000000020000-0x0000000000089000-memory.dmp

Download

memory/1560-29-0x0000000000020000-0x0000000000089000-memory.dmp

Download

memory/1560-31-0x0000000000020000-0x0000000000089000-memory.dmp

Download

memory/1560-32-0x0000000000020000-0x0000000000089000-memory.dmp

Download

memory/1560-33-0x0000000000020000-0x0000000000089000-memory.dmp

Download

memory/1560-36-0x0000000000020000-0x0000000000089000-memory.dmp

Download