lumma | 493b3af10d381dc7aa551c32f634a5a46aa63f7d8b4847566e6470c3c1a7aa01

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpzo9m0y8u.exe
Size 590KB
Sample260524-xt892sht3x
SHA256 493b3af10d381dc7aa551c32f634a5a46aa63f7d8b4847566e6470c3c1a7aa01
MD5 5cdcfd2f7b8dea4be8b16ca00cabaa48
SHA1 1e2c843baca60c0651c78a50fea245a1a85f2a5e
SHA512 76395c643d7fc0079fb72a43151902d57f36553da6cf7ae15aa039b4af020b29b6d78bab82140fa7b13f050bda452ac836de29cf34daf6181e52c8bcbe5083bb
SSDEEP 12288:bRIomkRJWzi7X+UeyZAnLoyNmOo4Lr0pfX4cR+c5JPx:be/kRJWzib+UnALoyNmOo4LgdN+GJPx
TLSH
T140D4C0117190C072D96732B364BBD76B8A29FA200F626ACF97880DBDDF351C19A35727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery lumma spyware stealer trojan

Malware Config

Extracted

Family

lumma

https://pollution-raker.cyou/api
https://hosue-billowy.cyou/api
https://ripe-blade.cyou/api
https://smash-boiling.cyou/api
https://supporse-comment.cyou/api
https://greywe-snotty.cyou/api
https://steppriflej.xyz/api
https://sendypaster.xyz/api
https://bellflamre.click/api

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3052 set thread context of 752	3052	tmpzo9m0y8u.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpzo9m0y8u.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpzo9m0y8u.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	tmpzo9m0y8u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	tmpzo9m0y8u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c0000000100000004000000000800001900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54367e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1556200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c70161090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	tmpzo9m0y8u.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 752	3052	tmpzo9m0y8u.exe	88
PID 3052 wrote to memory of 752	3052	tmpzo9m0y8u.exe	88
PID 3052 wrote to memory of 752	3052	tmpzo9m0y8u.exe	88
PID 3052 wrote to memory of 752	3052	tmpzo9m0y8u.exe	88
PID 3052 wrote to memory of 752	3052	tmpzo9m0y8u.exe	88
PID 3052 wrote to memory of 752	3052	tmpzo9m0y8u.exe	88

C:\Users\Admin\AppData\Local\Temp\tmpzo9m0y8u.exe
"C:\Users\Admin\AppData\Local\Temp\tmpzo9m0y8u.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\tmpzo9m0y8u.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpzo9m0y8u.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7AD406287E052ECAB43951C39E0CDBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7AD406287E052ECAB43951C39E0CDBF1
Size 1KB
SHA256 c1ad7778796d20bca65c889a2655021156528bb62ff5fa43e1b8e5a83e3d2eaa
MD5 9070fa51e00d8cf8ce1baefdd016487e
SHA1 626d44e704d1ceabe3bf0d53397464ac8080142c
SHA512 4b12cf7daf4a8a9b68e74d4691cee32fc93803ace42e5f380f81ae9dbd4820db82ab6ad43aa50f59ff077f3781cb324b31bc8177a83cea8ec340b77cf1ae7593
TLSH
T15D2195D5CE502D019E1A9E6532C8617B9BB122887318C8E38597C86247513E266F46FF
MD5 SHA1 SHA512 TLSH

Submit Download

7AD406287E052ECAB43951C39E0CDBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7AD406287E052ECAB43951C39E0CDBF1
Size 268B
SHA256 5edd01d7defcf6367b61e83797cd7da6166460468ce543d022d0fe4dfa25c1d9
MD5 23e5619f66066eff749a9ecc75c5065a
SHA1 ba0a41ac23ef4fe9fe156c2e8f17d3c900611708
SHA512 29d588bc772240499b76bf9b92b23395331940cc27a9b92c016ae97126cf14a4c62ddd64f9591fed42379327bf5418b9635c8c569833eba9570a2d0999a7f4fd
TLSH
T14DD0801573F54716F293903DC63193426D15F3909041CF0C00F1504D5431F426C61D1D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/752-3-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/752-5-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/752-7-0x00000000000C0000-0x000000000015C000-memory.dmp

Download

memory/3052-0-0x0000000000154000-0x0000000000155000-memory.dmp

Download

memory/3052-1-0x00000000000C0000-0x000000000015C000-memory.dmp

Download

memory/3052-2-0x00000000000C0000-0x000000000015C000-memory.dmp

Download

memory/3052-6-0x00000000000C0000-0x000000000015C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads