Behavioral task
behavioral1
Sample
4320-1469-0x0000000000400000-0x0000000000465000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4320-1469-0x0000000000400000-0x0000000000465000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
4320-1469-0x0000000000400000-0x0000000000465000-memory.dmp
-
Size
404KB
-
MD5
7c3db5436f64645ead70734c3bbcb3e5
-
SHA1
995ba42a05d07b99ad82cf60cfe8669e71ca9672
-
SHA256
40f7f84c1781e33fcb4a5bf11c5f06c93103a45f25882c74930c4330464ffe60
-
SHA512
fdc85c91ef4882b5f9cff9c6a016b38be3f03147369ca49fb7355f05132bce80c369c7fcfb07f1447547bcc26226b34208bff5ef36500b77855c3588223cb24c
-
SSDEEP
12288:z4nR3kPIypkuFRjZBBVZg748xZBdffIfQol:zcL4d3BVPiBdYfN
Malware Config
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 4320-1469-0x0000000000400000-0x0000000000465000-memory.dmp
Files
-
4320-1469-0x0000000000400000-0x0000000000465000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 337KB - Virtual size: 337KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ