Behavioral task
behavioral1
Sample
2400-56-0x0000000000400000-0x0000000000505000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2400-56-0x0000000000400000-0x0000000000505000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
2400-56-0x0000000000400000-0x0000000000505000-memory.dmp
-
Size
1.0MB
-
MD5
52fc1d369ebfcf201c8bd373db75b759
-
SHA1
b21fdc7a5b8271fcd34dcc6ddefbfca1b704f014
-
SHA256
232a88dd416dfd4ca152effe406d0a05dd3702b561eabf650099d6d6d34ceaa5
-
SHA512
a962e1957f3b78db09871b07ff678641023750f637f98895053b28a4d8f3a099bd111e99d3aeaf50697388f7bd6cf12291967394b65149bec6e3188d0281a8bf
-
SSDEEP
6144:mowvdLFXw35ZYhDx7n3j+/AJS/xM/0Q69fmPHjJkdEb/T26MCpcsOhbn8ZkBle2:m7lRA3aDloJZsjudEDT26qhSkB4
Malware Config
Extracted
lumma
gstatic-node.io
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2400-56-0x0000000000400000-0x0000000000505000-memory.dmp
Files
-
2400-56-0x0000000000400000-0x0000000000505000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ