lumma | 3c323dacc7a0b9e69acfcd23a9b2266e3803600de184f5684541223f2f0ac85b

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpih0pnina.exe
Size 522KB
Sample260601-wkfqpsct21
SHA256 3c323dacc7a0b9e69acfcd23a9b2266e3803600de184f5684541223f2f0ac85b
MD5 35ac830ad12275b6f728bf488be64177
SHA1 2daca325be8ea80906cba98badac0c59c65f231a
SHA512 3980d78808ee7c2b354b21f25de18e2bb7023055f36bc7fbe7a92b2bf5f8672f7a1edff53cf3662c6bf28eb37c252c1d6f5c3214f88bd0153a3b35dd9d6060ff
SSDEEP 12288:PqpVS4VidmlvARnu96usbq2Lwzeupc1+aaB6e386Lx+Xvcjk:Pq+SidvubnJzeupc1
TLSH
T17BB4D09D715072EFC86BD472DEA82DA8FA502477831F5613A42306EDAA4D897CF184F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma stealer

Malware Config

Extracted

Family

lumma

https://p3ar11fter.sbs/api
https://3xp3cts1aim.sbs/api
https://owner-vacat10n.sbs/api
https://peepburry828.sbs/api
https://p10tgrace.sbs/api
https://befall-sm0ker.sbs/api
https://librari-night.sbs/api
https://processhol.sbs/api
https://qualifiresui.cyou/api

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
3664	tmpih0pnina.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3664 set thread context of 3148	3664	tmpih0pnina.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4356	3664	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpih0pnina.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90
PID 3664 wrote to memory of 3148	3664	tmpih0pnina.exe	90

C:\Users\Admin\AppData\Local\Temp\tmpih0pnina.exe
"C:\Users\Admin\AppData\Local\Temp\tmpih0pnina.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 1036
  2⤵
  - Program crash
  PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3664 -ip 3664
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7AD406287E052ECAB43951C39E0CDBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7AD406287E052ECAB43951C39E0CDBF1
Size 1KB
SHA256 c1ad7778796d20bca65c889a2655021156528bb62ff5fa43e1b8e5a83e3d2eaa
MD5 9070fa51e00d8cf8ce1baefdd016487e
SHA1 626d44e704d1ceabe3bf0d53397464ac8080142c
SHA512 4b12cf7daf4a8a9b68e74d4691cee32fc93803ace42e5f380f81ae9dbd4820db82ab6ad43aa50f59ff077f3781cb324b31bc8177a83cea8ec340b77cf1ae7593
TLSH
T15D2195D5CE502D019E1A9E6532C8617B9BB122887318C8E38597C86247513E266F46FF
MD5 SHA1 SHA512 TLSH

Submit Download

7AD406287E052ECAB43951C39E0CDBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7AD406287E052ECAB43951C39E0CDBF1
Size 268B
SHA256 05cdec261a219f2f8c11e7e27c61130ed4c2abc33dc76884f197373b7edc2659
MD5 efc7c2ef5176f7e01715819d6cd0d4d7
SHA1 d44901615a2c7448197172ec9101bf27371fee50
SHA512 352995f4b8857479068bf54b1931356708c392f7b88e2dcb35173ebb785c489979dd25a6a4b491b053884dc4631f1c0eae5c51cf492a15f9168b3dd718bbcf6a
TLSH
T13FD0801877D54716F293D03D967152426D11F3D05041CF0C05E4504D5531F519D71D1D
MD5 SHA1 SHA512 TLSH

Submit Download

gdi32.dll

Path C:\Users\Admin\AppData\Roaming\gdi32.dll
Size 439KB
SHA256 9c20eecf353ca35abde0882d03ab2b3c4cb430f8ff4f9f3f81f89d4b723c8c07
MD5 1a9aa97a056a5ad38c7e456706ecce75
SHA1 aab8dbeba5e9bc7f5048a551fb3f2837aa3b7ca6
SHA512 d299d5738bcb4bb78d864224dde4a599fbd1236fa07fa7f5e03978c46cf3cd84c9d6f7eeb7ff3552d8230876af0576968c596f7f17a8eaf1b6110a380222b9e2
SSDEEP 12288:254XXWMZKOK8B6AU7SD2PqHd95zoVVJu00YZG6:r55K8BBU7SE0d952uq
TLSH
T147A4BFD96C688752F7B820BA70C3425198C99E31DE63297FEF5722081AF72E35C8275D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3148-10-0x0000000000FD0000-0x0000000001039000-memory.dmp

Download

memory/3148-15-0x0000000000FD0000-0x0000000001039000-memory.dmp

Download

memory/3148-19-0x0000000000FD0000-0x0000000001039000-memory.dmp

Download

memory/3664-0-0x0000000000DC0000-0x0000000000E4C000-memory.dmp

Download

memory/3664-1-0x0000000007C00000-0x0000000007C06000-memory.dmp

Download

memory/3664-2-0x0000000005870000-0x0000000005880000-memory.dmp

Download

memory/3664-3-0x000000000B3E0000-0x000000000B90C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads