Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/06/2026, 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpd7hcnems.exe
Resource
win10ltsc2021-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpd7hcnems.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
General
- Target tmpd7hcnems.exe
- Size 574KB
- Sample260601-wh7fmscs8z
- SHA256 111b606d29a00994359b28ab93359a9b35a05c41940ebc94f73ec355584e6d3c
- MD5 eca6d9365cf4f0feb5a072658e676c47
- SHA1 e68c3dfb0c6a24f134f0ab9b2ff07a309e56ed5f
- SHA512 ea2e303641673df594e19c17fddf45be36fcad4abfa27ce6e822a4098639fd3b6747ae2d56dc83c8bfdbb66d366700cef210e32c419af1a01c6c57e1c1af648c
- SSDEEP 12288:90CfIYcdiwrjBe5SuE8DrQMnR22M0t1xomoR4R5YwFP:mjYcHrjBhuE8xnRMw1xVFYwFP
- TLSH T1C8C4D01326E43CE3E1160F354D7AC6A95F1DF9608E1EB796A284BD1F19B82F1C279342
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detect Lumma Stealer payload V4 3 IoCs
resource yara_rule behavioral2/memory/3148-3-0x0000000000400000-0x000000000081D000-memory.dmp family_lumma_v4 behavioral2/memory/3148-4-0x0000000000400000-0x000000000081D000-memory.dmp family_lumma_v4 behavioral2/memory/3148-6-0x0000000000400000-0x000000000081D000-memory.dmp family_lumma_v4 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpd7hcnems.exe