lumma | 3c323dacc7a0b9e69acfcd23a9b2266e3803600de184f5684541223f2f0ac85b

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpih0pnina.exe
Size 522KB
Sample260601-wkfqpsct21
SHA256 3c323dacc7a0b9e69acfcd23a9b2266e3803600de184f5684541223f2f0ac85b
MD5 35ac830ad12275b6f728bf488be64177
SHA1 2daca325be8ea80906cba98badac0c59c65f231a
SHA512 3980d78808ee7c2b354b21f25de18e2bb7023055f36bc7fbe7a92b2bf5f8672f7a1edff53cf3662c6bf28eb37c252c1d6f5c3214f88bd0153a3b35dd9d6060ff
SSDEEP 12288:PqpVS4VidmlvARnu96usbq2Lwzeupc1+aaB6e386Lx+Xvcjk:Pq+SidvubnJzeupc1
TLSH
T17BB4D09D715072EFC86BD472DEA82DA8FA502477831F5613A42306EDAA4D897CF184F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma stealer

Malware Config

Extracted

Family

lumma

https://p3ar11fter.sbs/api
https://3xp3cts1aim.sbs/api
https://owner-vacat10n.sbs/api
https://peepburry828.sbs/api
https://p10tgrace.sbs/api
https://befall-sm0ker.sbs/api
https://librari-night.sbs/api
https://processhol.sbs/api
https://qualifiresui.cyou/api

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Loads dropped DLL 1 IoCs

pid	Process
1112	tmpih0pnina.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1112 set thread context of 3304	1112	tmpih0pnina.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	1112	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpih0pnina.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82
PID 1112 wrote to memory of 3304	1112	tmpih0pnina.exe	82

C:\Users\Admin\AppData\Local\Temp\tmpih0pnina.exe
"C:\Users\Admin\AppData\Local\Temp\tmpih0pnina.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 1084
  2⤵
  - Program crash
  PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1112 -ip 1112
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7AD406287E052ECAB43951C39E0CDBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7AD406287E052ECAB43951C39E0CDBF1
Size 1KB
SHA256 c1ad7778796d20bca65c889a2655021156528bb62ff5fa43e1b8e5a83e3d2eaa
MD5 9070fa51e00d8cf8ce1baefdd016487e
SHA1 626d44e704d1ceabe3bf0d53397464ac8080142c
SHA512 4b12cf7daf4a8a9b68e74d4691cee32fc93803ace42e5f380f81ae9dbd4820db82ab6ad43aa50f59ff077f3781cb324b31bc8177a83cea8ec340b77cf1ae7593
TLSH
T15D2195D5CE502D019E1A9E6532C8617B9BB122887318C8E38597C86247513E266F46FF
MD5 SHA1 SHA512 TLSH

Submit Download

7AD406287E052ECAB43951C39E0CDBF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7AD406287E052ECAB43951C39E0CDBF1
Size 268B
SHA256 64d1636f48bbef89818089637c4b1a9686db26fed5702217bf7b144ab4088eca
MD5 6178256783a73ba1336f9ac71b250f6e
SHA1 27acc0c0b611c76f715c724b4b9872a72e3e0a5b
SHA512 55da38e87b8d132f8b144e61075e1d61030bacd2bacd34e0e9dae2077d6d4a18f4101d796296d9ebdd7f3e2324074b6214f1ea014fce48f2ada0cbc10507e549
TLSH
T1C5D08014B7D94717F293903D863162426D11F3945041CF0C04F4944D1432F41DC71D1E
MD5 SHA1 SHA512 TLSH

Submit Download

gdi32.dll

Path C:\Users\Admin\AppData\Roaming\gdi32.dll
Size 439KB
SHA256 9c20eecf353ca35abde0882d03ab2b3c4cb430f8ff4f9f3f81f89d4b723c8c07
MD5 1a9aa97a056a5ad38c7e456706ecce75
SHA1 aab8dbeba5e9bc7f5048a551fb3f2837aa3b7ca6
SHA512 d299d5738bcb4bb78d864224dde4a599fbd1236fa07fa7f5e03978c46cf3cd84c9d6f7eeb7ff3552d8230876af0576968c596f7f17a8eaf1b6110a380222b9e2
SSDEEP 12288:254XXWMZKOK8B6AU7SD2PqHd95zoVVJu00YZG6:r55K8BBU7SE0d952uq
TLSH
T147A4BFD96C688752F7B820BA70C3425198C99E31DE63297FEF5722081AF72E35C8275D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-0-0x0000000000440000-0x00000000004CC000-memory.dmp

Download

memory/1112-1-0x0000000002880000-0x0000000002886000-memory.dmp

Download

memory/1112-2-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/1112-3-0x0000000009AF0000-0x000000000A01C000-memory.dmp

Download

memory/3304-12-0x0000000000750000-0x00000000007A9000-memory.dmp

Download

memory/3304-15-0x0000000000750000-0x00000000007A9000-memory.dmp

Download

memory/3304-19-0x0000000000750000-0x00000000007A9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads