Overview

overview

8

Static

static

3

lumiware.exe

windows10-2004-x64

8

lumiware.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    60s
  • max time network
    51s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 06:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lumiware.exe
  • Size 8.6MB
  • Sample261023-hcbj5act8n
  • SHA256 e91e31fb9563e20ec4b72f298ac0550cdc9d34d7ed349ff2c3b0ec2c07da6c6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryransomware

Malware Config

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Loads dropped DLL 6 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies Control Panel 3 IoCs
    defense_evasion
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lumiware.exe
    "C:\Users\Admin\AppData\Local\Temp\lumiware.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Users\Admin\AppData\Local\Temp\lumiware.exe
      "C:\Users\Admin\AppData\Local\Temp\lumiware.exe"
      2⤵
      • Loads dropped DLL
      • Sets desktop wallpaper using registry
      • Reads the TCP/IP host and domain name from the registry
      • Modifies Control Panel
      PID:3232
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1972

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_bz2.pyd
          • Size 83KB
          • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_ctypes.pyd
          • Size 122KB
          • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\_lzma.pyd
          • Size 156KB
          • SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\base_library.zip
          • Size 1.3MB
          • SHA256 26f45ed445d94e1655b69d73843ddd8e1d53682003ec2ed6ba83f8fcf9022e98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\1.jpg
          • Size 131KB
          • SHA256 4d35279bcabc844824ea4031522c988e4066398187db8cd8e932af573aee01fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          10.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\10.jpg
          • Size 101KB
          • SHA256 95271c62bcc7cbcbcbe0729edc1552296b9675437222cdfc046e84d2b12bdf4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          2.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\2.jpg
          • Size 57KB
          • SHA256 2512aaa32a58c410f3aac6a36d7023b66a760c89ff70dc393b55c5a5c76eb169
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          3.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\3.jpg
          • Size 61KB
          • SHA256 d362eb33f74c1ebd902b185999c20b6d968dff64a8a01bc2a2713431807d1295
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          4.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\4.jpg
          • Size 92KB
          • SHA256 810f8f603742a0b0f372717e881358b595b38febba3d67e37555d6bb49d961af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          5.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\5.jpg
          • Size 131KB
          • SHA256 9e392b93cc57a0e99423ea744e67a5859fc237604641db4576cb1356b970888d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          6.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\6.jpg
          • Size 124KB
          • SHA256 be80e38fa8e5788057a11fd1a9a99d46d8fb92db42d958ab67d43ab3e7a5301b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\7.jpg
          • Size 109KB
          • SHA256 299d6cecfa111c1d8a634e0e747ba63cbd68a2202e711ef617206374e93f5618
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          8.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\8.jpg
          • Size 98KB
          • SHA256 3e2bfea758eed8aa39636f6ae65b00b289fc49b0dc65bc70103c60775b4c13ab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          9.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\image\9.jpg
          • Size 99KB
          • SHA256 999a75096ed60418ddf740ea7f36093e0b9b4128413a3a07951b3dee1c89037f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45162\python312.dll
          • Size 6.6MB
          • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download