lumma | 3f8e54b3c1b5de6a763ebc0606286ad198ee7ad19f9af43fe39be77e99acc625

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_d2d6f9683201c3f27420f1104e88bf20_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.1MB
Sample260801-g4ce3azdkh
SHA256 3f8e54b3c1b5de6a763ebc0606286ad198ee7ad19f9af43fe39be77e99acc625
MD5 d2d6f9683201c3f27420f1104e88bf20
SHA1 887d3a9dd2540b694ce5793a6a6a00aca07977d7
SHA512 f27b781043d1c9124a05f33f65cdfaffd952f9e2f877b6e4d1832f614f82ff3e3e156178983cd4524c25f4a63e7e4ef3061712d6f75f031c93c4810b79e7ae4a
SSDEEP 24576:Daa1UjU3qqATpNxwq8jfN6NTN3puIqJ64NNliJPYGB12ANb0Vv+h:11eU3qFTpgq8TN+TXiJ64N3of2ANbMo
TLSH
T1A8451221B9C0C133D867153159F1DBF94A3DF8600F20AADBA7C81B7B9E206D19B3566B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma persistence privilege_escalation stealer

Malware Config

Extracted

Family

lumma

https://stochalyqp.xyz/alfp
https://narrathfpt.top/tekq
https://escczlv.top/bufi
https://localixbiw.top/zlpa
https://korxddl.top/qidz
https://diecam.top/laur
https://citellcagt.top/gjtu
https://peppinqikp.xyz/xaow

Attributes

build_id
5bd78f1044ce509f086494549ae1b242

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.exe	X4VcK6Tio0.exe

Executes dropped EXE 2 IoCs

pid	Process
6128	X4VcK6Tio0.exe
1720	Fquth7QXJI.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 2596	1720	Fquth7QXJI.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_d2d6f9683201c3f27420f1104e88bf20_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 6128	3012	2026-08-01_d2d6f9683201c3f27420f1104e88bf20_amadey_elex_luca-stealer_lynx_njrat.exe	89
PID 3012 wrote to memory of 1720	3012	2026-08-01_d2d6f9683201c3f27420f1104e88bf20_amadey_elex_luca-stealer_lynx_njrat.exe	90
PID 1720 wrote to memory of 2596	1720	Fquth7QXJI.exe	92
PID 1720 wrote to memory of 2596	1720	Fquth7QXJI.exe	92
PID 1720 wrote to memory of 2596	1720	Fquth7QXJI.exe	92
PID 1720 wrote to memory of 2596	1720	Fquth7QXJI.exe	92
PID 1720 wrote to memory of 2596	1720	Fquth7QXJI.exe	92
PID 1720 wrote to memory of 2596	1720	Fquth7QXJI.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-01_d2d6f9683201c3f27420f1104e88bf20_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_d2d6f9683201c3f27420f1104e88bf20_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Roaming\X4VcK6Tio0.exe
  "C:\Users\Admin\AppData\Roaming\X4VcK6Tio0.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  PID:6128
- C:\Users\Admin\AppData\Roaming\Fquth7QXJI.exe
  "C:\Users\Admin\AppData\Roaming\Fquth7QXJI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fquth7QXJI.exe

Path C:\Users\Admin\AppData\Roaming\Fquth7QXJI.exe
Size 936KB
SHA256 fdd64d8a52aeb1ca21ab4863fc5dba75bda229dd3bf1638dac9b300537724793
MD5 aa4628ca9b5fc6f7209ceac1462b4451
SHA1 ca9988d26b7775bcd668f4c495df7757922079d8
SHA512 3737ee40a5d98a1f8fefa155f39fb813b52ca06777e173f5556f33fe33402a23c51a0b578b88877bc3a56a1c4a17c8f677abc7f4318ba03a7abed523fef59f9c
SSDEEP 24576:ZeFOyibRzGhjfuYKV4NQF1x6g+NDoOZMR4XRvoVjW6spjTSQ6MDl:ZzbRzGhjg6g+NLM0GjW6stTN6M
TLSH
T14615AE28969192D9FC3500B980B156A578727A33C32C3FFB82A4F3739E0B6C58F56759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X4VcK6Tio0.exe

Path C:\Users\Admin\AppData\Roaming\X4VcK6Tio0.exe
Size 11KB
SHA256 b3345ab02ca9c19e600350c4852499b433f1da3699f1793b89ac8ded09f053ab
MD5 287ab028f1ceab5f2e96de2eead2debc
SHA1 1aefa06d5273076127f5df221dc68f7b7c614793
SHA512 2a784aa8b3832bfc4ce0d2f1a4ca472e3002dd45700ae855bd440c5430f4f4003bc5377344461be72fd9302c350357b5ed1b1f3097394d45627f5cea8caf59af
SSDEEP 192:M9bXfZ/HsmmPlAj2F7R0UZm7NVA6p3+PHK2d2yX5Xz6MWD9ep:07fZ/HxmPlAjEqUZ+m6Z+Pq23Xd6MWp
TLSH
T1EA32C700E7E29067E87E997859B76A045BB4B7165C05CF7F2AC8518B08327A489B3E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2596-23-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/2596-25-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/2596-26-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/2596-27-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/6128-15-0x00007FFAA609F000-0x00007FFAA60A0000-memory.dmp

Download

memory/6128-16-0x000001D410550000-0x000001D410558000-memory.dmp

Download

memory/6128-20-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/6128-21-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

memory/6128-28-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads