lumma | 06cf6f465d408f3a5d7e15ce32196f51f548af104905959bbe4fbfb65c860350

Analysis

user interaction
yes
max time kernel
16s
max time network
8s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/11/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
Size 788KB
Sample261106-cdeehsf16v
SHA256 06cf6f465d408f3a5d7e15ce32196f51f548af104905959bbe4fbfb65c860350
MD5 3cd1ccc53f42f5aa63dc512725c0e503
SHA1 ac213fdbe6ac3881db7e5cda39ad8ab4d8367244
SHA512 671b965b2dbcb34b56fd8bf47443ee1d3f89eb4011e1fdbe175c8b2cf9450e953ecb18935c7717b3fe7c2bcbbe7b97221019e24c9f847aba2e891aa4a7f7e4ea
SSDEEP 12288:bREgy+ozFy5I+kXge2LyF4OPDmpREgy+ozFy5I+kXge2LyF4OPDmL:9X8F8IoU4gmzX8F8IoU4gmL
TLSH
T14005F1688A2ECE37C36D1378E280022567F54753E452FB09B99895E24D2730D5F2BA7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery lumma stealer

Malware Config

Extracted

Family

lumma

https://ignoredshee.com
https://importenptoc.com
https://voicesharped.com
https://inputrreparnt.com
https://torpdidebar.com
https://rebeldettern.com
https://actiothreaz.com
https://garulouscuto.com
https://breedertremnd.com

Signatures

Family: Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4864 set thread context of 3344	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	80
PID 4864 set thread context of 4948	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	4864	WerFault.exe	79

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3344	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	80
PID 4864 wrote to memory of 3344	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	80
PID 4864 wrote to memory of 3344	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	80
PID 4864 wrote to memory of 3344	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	80
PID 4864 wrote to memory of 3344	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	80
PID 4864 wrote to memory of 3344	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	80
PID 4864 wrote to memory of 1628	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	81
PID 4864 wrote to memory of 4948	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	82
PID 4864 wrote to memory of 4948	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	82
PID 4864 wrote to memory of 4948	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	82
PID 4864 wrote to memory of 4948	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	82
PID 4864 wrote to memory of 4948	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	82
PID 4864 wrote to memory of 4948	4864	DeepSeek.Desktop.jailbreak.1.0.0 (1).exe	82

C:\Users\Admin\AppData\Local\Temp\DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
"C:\Users\Admin\AppData\Local\Temp\DeepSeek.Desktop.jailbreak.1.0.0 (1).exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
  "C:\Users\Admin\AppData\Local\Temp\DeepSeek.Desktop.jailbreak.1.0.0 (1).exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3344
- C:\Users\Admin\AppData\Local\Temp\DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
  "C:\Users\Admin\AppData\Local\Temp\DeepSeek.Desktop.jailbreak.1.0.0 (1).exe"
  2⤵
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\DeepSeek.Desktop.jailbreak.1.0.0 (1).exe
  "C:\Users\Admin\AppData\Local\Temp\DeepSeek.Desktop.jailbreak.1.0.0 (1).exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 980
  2⤵
  - Program crash
  PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4864 -ip 4864
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CB7969E09FEDDE857775A5B52018E613

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CB7969E09FEDDE857775A5B52018E613
Size 1KB
SHA256 ddcd1e8a20638d4aaff7201bb1d56452acd2c759f1686bdc38f73dd15732bdc2
MD5 404cec03f94fcadd4ca3048e787ea269
SHA1 b5ee89e77326ab2bf1775bd99c19a28947ff8184
SHA512 4531caed27e73497190ae442f8106b60b93467954262984e57d83cd662898e280d5ef40224d2085c866a3b49394677fd1d7176b8c944c43ac3d449e08924180b
TLSH
T1E321B98EC82C8CC56D097D0478E062677D3563C2A65C41F3040DC0225BD2793B6AD1AD
MD5 SHA1 SHA512 TLSH

Submit Download

F0FF5583D0C038A2C92CEAEF52CFB343

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0FF5583D0C038A2C92CEAEF52CFB343
Size 1KB
SHA256 38d895f5105bc2545822c17a2444f4b0ea3d298d2c15a38296aa7295a3d85ce9
MD5 9594980a801baf457183e059640af947
SHA1 27e6663299d340dfe54571ceccec01be74495dc6
SHA512 0d17856f806097468b996fed0898e9aea436b5f190daa63d1cba79285192d87016c06365abff832de4de1380cc01f68e261b9da1f51df11c70198ca404ff8b0e
TLSH
T14041D61CE678D683CC83BE1467BCD643BC6983C7F9D0CB5294989245081B7CEBB55220
MD5 SHA1 SHA512 TLSH

Submit Download

CB7969E09FEDDE857775A5B52018E613

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CB7969E09FEDDE857775A5B52018E613
Size 292B
SHA256 15ba0743c42e24fc5b0735f460d9ca234ea43a4e1489f1be9e448fd655dc5fe6
MD5 b6c5c9f684d8cb7cadb7ef24494f8d37
SHA1 a972ef9b8ed323a16902019956042dc786da807a
SHA512 eb25df9e0e9020a6d5e48d54e2bb79557c8a82a19ff1ac43bf73c741b838bc9f7f4acaaede97a25107d0a167100b9d555062b7ebec85231ac884ac58301b98b7
TLSH
T1D7E0C91CE6B64621F170CB3D40D51557E9792E059955C78506F4870C3539E52FC72B23
MD5 SHA1 SHA512 TLSH

Submit Download

F0FF5583D0C038A2C92CEAEF52CFB343

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0FF5583D0C038A2C92CEAEF52CFB343
Size 288B
SHA256 cf5d14c99efe9484a513e8b33dded6306cde2a42e4b61aab28690a20452eff83
MD5 3f3ce95bd17be9185a5175dff199f318
SHA1 ff7886d595898f85059a61126e0284a955f76538
SHA512 0aa41b7beaf21719dc6d07b86999ca6b222dd5106130757161dac71a24c2672c8805a63a1a8fcaf81b678502fc4c3c615a3f576e12c952344e0ba89631e163f7
TLSH
T1BDD0C91CA2B54221F191DE3E41D12547A9696A119805E39506F0830C7928E41FD31B57
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3344-4-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/3344-10-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/3344-6-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/3344-25-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/4864-0-0x0000000000B40000-0x0000000000C0C000-memory.dmp

Download

memory/4864-3-0x0000000003204000-0x0000000003206000-memory.dmp

Download

memory/4864-1-0x0000000005BF0000-0x0000000006196000-memory.dmp

Download

memory/4948-11-0x0000000000400000-0x000000000045F000-memory.dmp

Download

memory/4948-24-0x0000000000400000-0x000000000045F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads