lumma | aa2be9cbb2ccf935fb2c677590ec144d7e6517b275337fcb1abcbcef55c86cb9

Analysis

max time kernel
150s
max time network
57s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
Size 110.4MB
Sample260824-cmkynack9t
SHA256 aa2be9cbb2ccf935fb2c677590ec144d7e6517b275337fcb1abcbcef55c86cb9
MD5 a953590c32d1ca2738e988bcde02d9a0
SHA1 65b00c8b5964a1a2e94ad92b727d650e99f8b3e1
SHA512 58efb9c8087819e9ffcd14defd3a8058671f52aa92256543de08cf16c2ecd8bdabd31d9de7ddb8ef29938acb4efb6167d17762e03aab176a779e700c39f43eb8
SSDEEP 98304:wuMKqX7urwIpkxo0U2ejknGUQ8kcSXud5Rb8BKJ4PGb/HESuqAO7O:T+xoD2dnGmkcSXG5RbaKnHEFJO
TLSH
T1C048AD90FDDB40F5F9031A3058A7626F57345D098BA4CBD7EA247F59E8336E12B3260A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://reflectsurmise.cfd/api

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4216 set thread context of 2348	4216	2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 2348	4216	2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe	89
PID 4216 wrote to memory of 2348	4216	2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe	89
PID 4216 wrote to memory of 2348	4216	2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe	89
PID 4216 wrote to memory of 2348	4216	2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe	89
PID 4216 wrote to memory of 2348	4216	2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe	89
PID 4216 wrote to memory of 2348	4216	2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_a953590c32d1ca2738e988bcde02d9a0_coinminer_elex_frostygoop_glassworm_hive_poet-rat_salatstealer_sliver_snatch.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe
  "C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-0-0x0000000000730000-0x000000000078B000-memory.dmp

Download

memory/2348-1-0x0000000000730000-0x000000000078B000-memory.dmp

Download

memory/2348-5-0x0000000000730000-0x000000000078B000-memory.dmp

Download

memory/2348-7-0x0000000000730000-0x000000000078B000-memory.dmp

Download

memory/2348-8-0x0000000000730000-0x000000000078B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads