lumma | 3c323dacc7a0b9e69acfcd23a9b2266e3803600de184f5684541223f2f0ac85b

Analysis

max time kernel
149s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/06/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpih0pnina.exe
Size 522KB
Sample260601-wkfqpsct21
SHA256 3c323dacc7a0b9e69acfcd23a9b2266e3803600de184f5684541223f2f0ac85b
MD5 35ac830ad12275b6f728bf488be64177
SHA1 2daca325be8ea80906cba98badac0c59c65f231a
SHA512 3980d78808ee7c2b354b21f25de18e2bb7023055f36bc7fbe7a92b2bf5f8672f7a1edff53cf3662c6bf28eb37c252c1d6f5c3214f88bd0153a3b35dd9d6060ff
SSDEEP 12288:PqpVS4VidmlvARnu96usbq2Lwzeupc1+aaB6e386Lx+Xvcjk:Pq+SidvubnJzeupc1
TLSH
T17BB4D09D715072EFC86BD472DEA82DA8FA502477831F5613A42306EDAA4D897CF184F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma stealer

Malware Config

Extracted

Family

lumma

https://p3ar11fter.sbs/api
https://3xp3cts1aim.sbs/api
https://owner-vacat10n.sbs/api
https://peepburry828.sbs/api
https://p10tgrace.sbs/api
https://befall-sm0ker.sbs/api
https://librari-night.sbs/api
https://processhol.sbs/api
https://qualifiresui.cyou/api

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
4244	tmpih0pnina.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4244 set thread context of 3124	4244	tmpih0pnina.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	4244	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpih0pnina.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84
PID 4244 wrote to memory of 3124	4244	tmpih0pnina.exe	84

C:\Users\Admin\AppData\Local\Temp\tmpih0pnina.exe
"C:\Users\Admin\AppData\Local\Temp\tmpih0pnina.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1076
  2⤵
  - Program crash
  PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4244 -ip 4244
1⤵
PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7AD406287E052ECAB43951C39E0CDBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7AD406287E052ECAB43951C39E0CDBF1
Size 1KB
SHA256 c1ad7778796d20bca65c889a2655021156528bb62ff5fa43e1b8e5a83e3d2eaa
MD5 9070fa51e00d8cf8ce1baefdd016487e
SHA1 626d44e704d1ceabe3bf0d53397464ac8080142c
SHA512 4b12cf7daf4a8a9b68e74d4691cee32fc93803ace42e5f380f81ae9dbd4820db82ab6ad43aa50f59ff077f3781cb324b31bc8177a83cea8ec340b77cf1ae7593
TLSH
T15D2195D5CE502D019E1A9E6532C8617B9BB122887318C8E38597C86247513E266F46FF
MD5 SHA1 SHA512 TLSH

Submit Download

7AD406287E052ECAB43951C39E0CDBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7AD406287E052ECAB43951C39E0CDBF1
Size 268B
SHA256 bf42b347168b7e83a0022cffd72fe2410570968a989e986a6632c4984fe942e6
MD5 7be788557a1096438056e9349ee7a054
SHA1 efa20982458c1deeed3da875570f2c39744850de
SHA512 3471325fb4c74c5682629d739fd6bf6c498fa640de8d393593cb2a86aafc7f797375d25d83dd431f2f196826f4b8a6b8d20bf6e820212743175a4a580cd1a794
TLSH
T1F8D0801477D54717F2D3943DC63252426D51F3909041CF0C05E5504D1531F42DC71D1D
MD5 SHA1 SHA512 TLSH

Submit Download

gdi32.dll

Path C:\Users\Admin\AppData\Roaming\gdi32.dll
Size 439KB
SHA256 9c20eecf353ca35abde0882d03ab2b3c4cb430f8ff4f9f3f81f89d4b723c8c07
MD5 1a9aa97a056a5ad38c7e456706ecce75
SHA1 aab8dbeba5e9bc7f5048a551fb3f2837aa3b7ca6
SHA512 d299d5738bcb4bb78d864224dde4a599fbd1236fa07fa7f5e03978c46cf3cd84c9d6f7eeb7ff3552d8230876af0576968c596f7f17a8eaf1b6110a380222b9e2
SSDEEP 12288:254XXWMZKOK8B6AU7SD2PqHd95zoVVJu00YZG6:r55K8BBU7SE0d952uq
TLSH
T147A4BFD96C688752F7B820BA70C3425198C99E31DE63297FEF5722081AF72E35C8275D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3124-10-0x00000000009F0000-0x0000000000A58000-memory.dmp

Download

memory/3124-19-0x00000000009F0000-0x0000000000A58000-memory.dmp

Download

memory/3124-15-0x00000000009F0000-0x0000000000A58000-memory.dmp

Download

memory/4244-0-0x00000000007E0000-0x000000000086C000-memory.dmp

Download

memory/4244-1-0x0000000005140000-0x0000000005146000-memory.dmp

Download

memory/4244-2-0x0000000005160000-0x0000000005170000-memory.dmp

Download

memory/4244-3-0x0000000009C20000-0x000000000A14C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads