lumma | 578b8982422bdc9eafccf8477c8d1f18be7a2bfd0e9d007236544eda444cdb13

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmplfhzjfp7.exe
Size 2.6MB
Sample260601-xe74fadv5w
SHA256 578b8982422bdc9eafccf8477c8d1f18be7a2bfd0e9d007236544eda444cdb13
MD5 0b923eedaf438ed4de405c4df7a29de9
SHA1 0cccda35061d71f9a0e5f725d53cd54967a73743
SHA512 850deb876345edce7a3621b612116c10dc27852470165849522fa681b808b08590f9676dbe28fbb4139fcb040464554bf08ce206794c4cc8d2dde40a3cfbe566
SSDEEP 49152:hYz2geFELCzVZ1Ppse8gHZ+sRAdyn3fHTbM1X4ZE:uzyELCRRTZ5tRCyfXMxV
TLSH
T19CC5124AA2D01539D1B543FAB9FF133B0662BDA167125E4F12687C273F73A851E36B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma persistence stealer

Malware Config

Extracted

Family

lumma

https://ossifvg.click
https://egyptnf.click/xxx
https://familbg.club/help
https://genusne.click/caccc
https://mobbyyt.club/info
https://lumpeem.quest/main
https://thundut.biz/create
https://workltt.quest/owner
https://watchhr.biz/manifest

Attributes

build_id
75f6cc7d8f16bada7678ec4c2afea96076cde7

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Deletes itself 1 IoCs

pid	Process
4364	Pen.exe

Executes dropped EXE 2 IoCs

pid	Process
4364	Pen.exe
2508	Pen.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmplfhzjfp7.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1780	tasklist.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pen.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2816	cmd.exe
3556	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3556	PING.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	tasklist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe
4364	Pen.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2776	3976	tmplfhzjfp7.exe	86
PID 3976 wrote to memory of 2816	3976	tmplfhzjfp7.exe	88
PID 2816 wrote to memory of 4452	2816	cmd.exe	90
PID 2816 wrote to memory of 2660	2816	cmd.exe	91
PID 2660 wrote to memory of 1780	2660	cmd.exe	96
PID 2660 wrote to memory of 456	2660	cmd.exe	97
PID 2660 wrote to memory of 3648	2660	cmd.exe	99
PID 2660 wrote to memory of 4608	2660	cmd.exe	100
PID 4608 wrote to memory of 4572	4608	cmd.exe	101
PID 2660 wrote to memory of 3008	2660	cmd.exe	102
PID 2660 wrote to memory of 4008	2660	cmd.exe	105
PID 2660 wrote to memory of 4364	2660	cmd.exe	106
PID 2660 wrote to memory of 2508	2660	cmd.exe	107
PID 2816 wrote to memory of 3556	2816	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\tmplfhzjfp7.exe
"C:\Users\Admin\AppData\Local\Temp\tmplfhzjfp7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SYSTEM32\at.exe
  at.exe djhfjshdf937826457862398347
  2⤵
  PID:2776
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c dZtCEQ & type German.dotx | %comspec% & ping -n 7 localhost
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type German.dotx "
    3⤵
    PID:4452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1780
  - - C:\Windows\system32\findstr.exe
      findstr /I "msmpeng"
      4⤵
      PID:456
  - - C:\Windows\system32\cmd.exe
      cmd /c set /p ="MZ"
      4⤵
      PID:3648
  - - C:\Windows\system32\cmd.exe
      cmd /c findstr /V "Parade" Newbie
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Windows\system32\findstr.exe
        
        findstr /V "Parade" Newbie
        5⤵
        
        PID:4572
  - - C:\Windows\system32\cmd.exe
      cmd /c copy /b /y 832902\Pen.exe + Minds + Tranny + Greenhouse 832902\Pen.exe
      4⤵
      PID:3008
  - - C:\Windows\system32\cmd.exe
      cmd /c copy /b /y ..\Scheduled.dotx C
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\832902\Pen.exe
      Pen.exe C
      4⤵
      Deletes itself
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\832902\Pen.exe
      Pen.exe /AutoIt3ExecuteLine "Sleep(10860)"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2508
- - C:\Windows\system32\PING.EXE
    ping -n 7 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pen.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\832902\Pen.exe
Size 493B
SHA256 6c6bf572d898c22aa2315af839256176f06b912fe3d323b7359488483a0960dd
MD5 2fd2d2d6daff6f834227d0fd2e2cdc3f
SHA1 27e263e013f5b376215ce0fab0927ab4e2e65d66
SHA512 41a7b21fea706e210b41753c553988d8860b53ba7fe16f4c119820dabf3295ad45b068629ff8683a37ff90eb51dfbd9dadda83e1bdec7af70dbcf98df37a4348
TLSH
T145F0263372E54CF4F94C1076913E84E0A26D4A7AA796D7C61ED7613A79CB1AC8089C45
MD5 SHA1 SHA512 TLSH

Submit Download

Pen.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\832902\Pen.exe
Size 957KB
SHA256 02862289fbed08ab4a6e0cbf5bff34579827738aa8b01b388af3877184813b65
MD5 ebc8e59a17bbfc7b73365e3a6b4dac48
SHA1 b864a62b6fa7a2cd17207668469565da890177ce
SHA512 55d4466e3adeb6ef9fbccf766f421a390829265c96e2b84508bdbf939187002214424c1816e3824a8ab558de32944a8d9e4bfbb88eca23b53ff8dc0542b646aa
SSDEEP 24576:OpLy2+H1AvYVJjWrA4A73log5w3aHGrMB:OM2+H1A4jWq71j2rM
TLSH
T1A9259E0373D18022FF93AA721D5FE7265ABC6D2A0323956F13D81DB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

German.dotx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\German.dotx
Size 11KB
SHA256 5d975e2aea728672a122b6388691b781fb6b0a2a0c127b71e17c9491610ddbc7
MD5 e1bb3363ebf16c68781eb5558414b3f2
SHA1 e70b2d29c1c0aed78879245528637af3bee0090a
SHA512 9bbe5997fa308bb70b86ac500523073acd9eb4f2c436dd3a74c343dce86183eb6f93c20975174783cdbc834471297033a0814b248efdcc346a318430f88c1d09
SSDEEP 192:ucKWLrYHcSCXp4APZLi/GD5licLJFCqruS5jXuobJhMcjCyaFEcp:u9KGoXp4+5D5ldL7rvuER8E6
TLSH
T15932FAB57B9D04E3247AF7AA98F05003E5B1D392386064BEDD5B8695D3D4C3C1278B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenhouse

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Greenhouse
Size 171KB
SHA256 a21e9a47817798cf9df209b4d1a99abf7f50cb94de7214263d373fc9c171155b
MD5 0de3d8d9c0444d4da080237fa0ad952c
SHA1 1387b3860d0abe1b4b6a32beaf735a43e63ce38d
SHA512 baf7955efb0fb0b332b4daf42872b5bde386797b98cb49780c324cf31169606d3a18af01d12d726cff592a46e4815c0b03af72f3d8a048df3d6f96a4346dae40
SSDEEP 3072:2aB6OJRkrJrRj4nHDWy4ZNorgK4+vQR3iJp6vS0eQ:2aB6WGrRcHaBZ2r1T63Q6J
TLSH
T1E104B54376F84107E5737A7939AFE32F4AE97C5F8B21A53E225C2F8EA4207904954732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Minds

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Minds
Size 383KB
SHA256 c3805f894c230804c13f7eec2439d61c7c568ae657d9cda29b8babb1113236ab
MD5 781614e999d22be1e2502840861cf4bc
SHA1 74d36aa2cd2be6a7e5d89f75efdcb05a218d56bd
SHA512 ca64ba10d8f244433c0dc96323199225d66e183e49555f57dd90e96292b9d1309d06b4cf067156eaecf28f45d01a9d48ad80a9dd5d0fc0cee1d3ea1d8120a651
SSDEEP 6144:CmcLvyhtkv9axZHTx4pQf3WYSDoP8M/AOghDP2uAV5GPsRYajR:CpL6h29iZHTxQQftAHP2uAVqsRfjR
TLSH
T15584AE12A4C1C171C8930C705C6BEBA2AE7C9C350734ADCB77C91D76DE609D29B2BE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newbie

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Newbie
Size 499B
SHA256 7e99644dbdcee1c0477fcbbe0a9307c1baba8aa7f2ef1414d506942ec0d79c24
MD5 b99725baaa5fb0ff4e363ef1c3b3c66b
SHA1 67e8f3180d11582b065372a37987ad938e7c809e
SHA512 4f9b668d6cb1a9c48454a77d7b0bd1977ff438004a2014bca8cd49374eaf04a88e3dfe332fe630e66d6d91e3036767f6fdf559a329220b2d6cc8cdbe12535ee0
TLSH
T14EF0C03372D54CF0F44C0032813E84E1A25D46359746C3C21EC7203E35C709C8089C00
MD5 SHA1 SHA512 TLSH

Submit Download

Scheduled.dotx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Scheduled.dotx
Size 1.1MB
SHA256 47ec427aab41df56c344c451b7a4abafc6718ac74a91be1f96a9807dd0be9144
MD5 549475a3c7692e5095374badc4f3bc58
SHA1 1360053507c68c3a417b3c18ccaf95120971f4a6
SHA512 38abe3acc80c08c052f3f658c896922d08380a4df1c0e0d02018167f5b37301075c12bf5d1896f9d12e91fa0506a77e1046b2b18a084982498ef0ff2e074092d
SSDEEP 24576:TUHv3BbwUnbgc7EMeIZpzvox2XieIqYRtHZ+BDbwtk5AVKywr6:TgvPEc7z5ZRvsCjY7HZ+H5AIyc6
TLSH
T1E435339F2002B95CF79F55CE141932310B8265F27C2F7D96EF345848898FE6A4B5AF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tranny

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tranny
Size 402KB
SHA256 547e64e47098fe6bb2241ec89db76f6eae06bdad0f7e4d081d1c9c14d4f90c8f
MD5 5f608a909f924d7c22c988d060cd9d1b
SHA1 b1899f135a113a7e09ecdb73edc0cacebdd9ccc4
SHA512 bc8127baa5959bc0f442302beab5b0e586a3f94bb59fba5eaa5cde0a30fed262bbb42cc6a84c202f21215ac82c8897e4cdaf0e4f390cb0574f0502a5bf3f92f6
SSDEEP 6144:bMZ/TAAf9JSnPN/FYJMb73dAKVOJLwfKkoyISRddLAOz04pXdO1A:o/TASDSnPN/FYmb739cpkLogdLe4FdwA
TLSH
T110946B0377924077FFD3D2B34B49EA12A7B95A5E0013C63F12A829B5FAB1171566E0B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4364-29-0x0000000004EE0000-0x0000000004F3B000-memory.dmp

Download

memory/4364-31-0x0000000004EE0000-0x0000000004F3B000-memory.dmp

Download

memory/4364-30-0x0000000004EE0000-0x0000000004F3B000-memory.dmp

Download

memory/4364-32-0x0000000004EE0000-0x0000000004F3B000-memory.dmp

Download

memory/4364-33-0x0000000004EE0000-0x0000000004F3B000-memory.dmp

Download