lumma | fc312fc68315542a1d9bac90e8128b216a3cd3603b0aa391309b33dad4517ade

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpitkg76_e.exe
Size 100.0MB
Sample260601-xetaaadv4v
SHA256 fc312fc68315542a1d9bac90e8128b216a3cd3603b0aa391309b33dad4517ade
MD5 ddd88fd0eada2d9ea271eaf80fab7ba2
SHA1 b8684a58f491f6c0f74c384f80086ea078442298
SHA512 29b51436f2b4d8a8476907750adff51eaf62a9dc76ec81459269ed67036856b5d96362a634ca68d5eb5c1138613de080aca76a0fdfefaa7164f22ab880d808ee
SSDEEP 49152:oYz2geFELCzVZ1Ppse8gHZ+sRAdyn3fHTbM1X4Z:NzyELCRRTZ5tRCyfXMx
TLSH
T1A238124AA2D41539C1B543FBB9FF133B0662BDA167125E4F12647C273E73A851E36B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma persistence stealer

Malware Config

Extracted

Family

lumma

https://ossifvg.click
https://egyptnf.click/xxx
https://familbg.club/help
https://genusne.click/caccc
https://mobbyyt.club/info
https://lumpeem.quest/main
https://thundut.biz/create
https://workltt.quest/owner
https://watchhr.biz/manifest

Attributes

build_id
75f6cc7d8f16bada7678ec4c2afea96076cde7

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Deletes itself 1 IoCs

pid	Process
1696	Pen.exe

Executes dropped EXE 2 IoCs

pid	Process
1696	Pen.exe
3744	Pen.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmpitkg76_e.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1724	tasklist.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pen.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1272	cmd.exe
5644	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5644	PING.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	tasklist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe
1696	Pen.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3852	764	tmpitkg76_e.exe	87
PID 764 wrote to memory of 1272	764	tmpitkg76_e.exe	89
PID 1272 wrote to memory of 4812	1272	cmd.exe	91
PID 1272 wrote to memory of 5040	1272	cmd.exe	92
PID 5040 wrote to memory of 1724	5040	cmd.exe	95
PID 5040 wrote to memory of 1252	5040	cmd.exe	96
PID 5040 wrote to memory of 1692	5040	cmd.exe	98
PID 5040 wrote to memory of 5108	5040	cmd.exe	99
PID 5108 wrote to memory of 5548	5108	cmd.exe	100
PID 5040 wrote to memory of 3284	5040	cmd.exe	101
PID 5040 wrote to memory of 3260	5040	cmd.exe	103
PID 5040 wrote to memory of 1696	5040	cmd.exe	104
PID 5040 wrote to memory of 3744	5040	cmd.exe	105
PID 1272 wrote to memory of 5644	1272	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\tmpitkg76_e.exe
"C:\Users\Admin\AppData\Local\Temp\tmpitkg76_e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SYSTEM32\at.exe
  at.exe djhfjshdf937826457862398347
  2⤵
  PID:3852
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c dZtCEQ & type German.dotx | %comspec% & ping -n 7 localhost
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" type German.dotx "
    3⤵
    PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1724
  - - C:\Windows\system32\findstr.exe
      findstr /I "msmpeng"
      4⤵
      PID:1252
  - - C:\Windows\system32\cmd.exe
      cmd /c set /p ="MZ"
      4⤵
      PID:1692
  - - C:\Windows\system32\cmd.exe
      cmd /c findstr /V "Parade" Newbie
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Windows\system32\findstr.exe
        
        findstr /V "Parade" Newbie
        5⤵
        
        PID:5548
  - - C:\Windows\system32\cmd.exe
      cmd /c copy /b /y 832902\Pen.exe + Minds + Tranny + Greenhouse 832902\Pen.exe
      4⤵
      PID:3284
  - - C:\Windows\system32\cmd.exe
      cmd /c copy /b /y ..\Scheduled.dotx C
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\832902\Pen.exe
      Pen.exe C
      4⤵
      Deletes itself
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\832902\Pen.exe
      Pen.exe /AutoIt3ExecuteLine "Sleep(10860)"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3744
- - C:\Windows\system32\PING.EXE
    ping -n 7 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pen.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\832902\Pen.exe
Size 493B
SHA256 6c6bf572d898c22aa2315af839256176f06b912fe3d323b7359488483a0960dd
MD5 2fd2d2d6daff6f834227d0fd2e2cdc3f
SHA1 27e263e013f5b376215ce0fab0927ab4e2e65d66
SHA512 41a7b21fea706e210b41753c553988d8860b53ba7fe16f4c119820dabf3295ad45b068629ff8683a37ff90eb51dfbd9dadda83e1bdec7af70dbcf98df37a4348
TLSH
T145F0263372E54CF4F94C1076913E84E0A26D4A7AA796D7C61ED7613A79CB1AC8089C45
MD5 SHA1 SHA512 TLSH

Submit Download

Pen.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\832902\Pen.exe
Size 957KB
SHA256 02862289fbed08ab4a6e0cbf5bff34579827738aa8b01b388af3877184813b65
MD5 ebc8e59a17bbfc7b73365e3a6b4dac48
SHA1 b864a62b6fa7a2cd17207668469565da890177ce
SHA512 55d4466e3adeb6ef9fbccf766f421a390829265c96e2b84508bdbf939187002214424c1816e3824a8ab558de32944a8d9e4bfbb88eca23b53ff8dc0542b646aa
SSDEEP 24576:OpLy2+H1AvYVJjWrA4A73log5w3aHGrMB:OM2+H1A4jWq71j2rM
TLSH
T1A9259E0373D18022FF93AA721D5FE7265ABC6D2A0323956F13D81DB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

German.dotx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\German.dotx
Size 11KB
SHA256 5d975e2aea728672a122b6388691b781fb6b0a2a0c127b71e17c9491610ddbc7
MD5 e1bb3363ebf16c68781eb5558414b3f2
SHA1 e70b2d29c1c0aed78879245528637af3bee0090a
SHA512 9bbe5997fa308bb70b86ac500523073acd9eb4f2c436dd3a74c343dce86183eb6f93c20975174783cdbc834471297033a0814b248efdcc346a318430f88c1d09
SSDEEP 192:ucKWLrYHcSCXp4APZLi/GD5licLJFCqruS5jXuobJhMcjCyaFEcp:u9KGoXp4+5D5ldL7rvuER8E6
TLSH
T15932FAB57B9D04E3247AF7AA98F05003E5B1D392386064BEDD5B8695D3D4C3C1278B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Greenhouse

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Greenhouse
Size 171KB
SHA256 a21e9a47817798cf9df209b4d1a99abf7f50cb94de7214263d373fc9c171155b
MD5 0de3d8d9c0444d4da080237fa0ad952c
SHA1 1387b3860d0abe1b4b6a32beaf735a43e63ce38d
SHA512 baf7955efb0fb0b332b4daf42872b5bde386797b98cb49780c324cf31169606d3a18af01d12d726cff592a46e4815c0b03af72f3d8a048df3d6f96a4346dae40
SSDEEP 3072:2aB6OJRkrJrRj4nHDWy4ZNorgK4+vQR3iJp6vS0eQ:2aB6WGrRcHaBZ2r1T63Q6J
TLSH
T1E104B54376F84107E5737A7939AFE32F4AE97C5F8B21A53E225C2F8EA4207904954732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Minds

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Minds
Size 383KB
SHA256 c3805f894c230804c13f7eec2439d61c7c568ae657d9cda29b8babb1113236ab
MD5 781614e999d22be1e2502840861cf4bc
SHA1 74d36aa2cd2be6a7e5d89f75efdcb05a218d56bd
SHA512 ca64ba10d8f244433c0dc96323199225d66e183e49555f57dd90e96292b9d1309d06b4cf067156eaecf28f45d01a9d48ad80a9dd5d0fc0cee1d3ea1d8120a651
SSDEEP 6144:CmcLvyhtkv9axZHTx4pQf3WYSDoP8M/AOghDP2uAV5GPsRYajR:CpL6h29iZHTxQQftAHP2uAVqsRfjR
TLSH
T15584AE12A4C1C171C8930C705C6BEBA2AE7C9C350734ADCB77C91D76DE609D29B2BE96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newbie

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Newbie
Size 499B
SHA256 7e99644dbdcee1c0477fcbbe0a9307c1baba8aa7f2ef1414d506942ec0d79c24
MD5 b99725baaa5fb0ff4e363ef1c3b3c66b
SHA1 67e8f3180d11582b065372a37987ad938e7c809e
SHA512 4f9b668d6cb1a9c48454a77d7b0bd1977ff438004a2014bca8cd49374eaf04a88e3dfe332fe630e66d6d91e3036767f6fdf559a329220b2d6cc8cdbe12535ee0
TLSH
T14EF0C03372D54CF0F44C0032813E84E1A25D46359746C3C21EC7203E35C709C8089C00
MD5 SHA1 SHA512 TLSH

Submit Download

Scheduled.dotx

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Scheduled.dotx
Size 1.1MB
SHA256 47ec427aab41df56c344c451b7a4abafc6718ac74a91be1f96a9807dd0be9144
MD5 549475a3c7692e5095374badc4f3bc58
SHA1 1360053507c68c3a417b3c18ccaf95120971f4a6
SHA512 38abe3acc80c08c052f3f658c896922d08380a4df1c0e0d02018167f5b37301075c12bf5d1896f9d12e91fa0506a77e1046b2b18a084982498ef0ff2e074092d
SSDEEP 24576:TUHv3BbwUnbgc7EMeIZpzvox2XieIqYRtHZ+BDbwtk5AVKywr6:TgvPEc7z5ZRvsCjY7HZ+H5AIyc6
TLSH
T1E435339F2002B95CF79F55CE141932310B8265F27C2F7D96EF345848898FE6A4B5AF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tranny

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tranny
Size 402KB
SHA256 547e64e47098fe6bb2241ec89db76f6eae06bdad0f7e4d081d1c9c14d4f90c8f
MD5 5f608a909f924d7c22c988d060cd9d1b
SHA1 b1899f135a113a7e09ecdb73edc0cacebdd9ccc4
SHA512 bc8127baa5959bc0f442302beab5b0e586a3f94bb59fba5eaa5cde0a30fed262bbb42cc6a84c202f21215ac82c8897e4cdaf0e4f390cb0574f0502a5bf3f92f6
SSDEEP 6144:bMZ/TAAf9JSnPN/FYJMb73dAKVOJLwfKkoyISRddLAOz04pXdO1A:o/TASDSnPN/FYmb739cpkLogdLe4FdwA
TLSH
T110946B0377924077FFD3D2B34B49EA12A7B95A5E0013C63F12A829B5FAB1171566E0B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-29-0x00000000006F0000-0x000000000074B000-memory.dmp

Download

memory/1696-30-0x00000000006F0000-0x000000000074B000-memory.dmp

Download

memory/1696-31-0x00000000006F0000-0x000000000074B000-memory.dmp

Download

memory/1696-32-0x00000000006F0000-0x000000000074B000-memory.dmp

Download

memory/1696-33-0x00000000006F0000-0x000000000074B000-memory.dmp

Download