Behavioral task
behavioral1
Sample
2844-4-0x0000000000400000-0x0000000000481000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2844-4-0x0000000000400000-0x0000000000481000-memory.exe
Resource
win10v2004-20231020-en
General
-
Target
2844-4-0x0000000000400000-0x0000000000481000-memory.dmp
-
Size
516KB
-
MD5
1a8fc1b25eff9795797001911baf2a45
-
SHA1
2402025a27700296290e390f305bbe727a765782
-
SHA256
9c6f735b59fc4414c37a166ae753dabcdb747924a48fca2a7ed8d3e301600d2a
-
SHA512
f76eb2a80665c4a84c73cb495a8ee5a9cf704f7f4600f47c21fb447cd09810d543630f897dd31a7a4f82e86fd3c0a120749a03636080ff4dacb9eaec5c70a53f
-
SSDEEP
12288:n2R7sNLFZ/nz4cNp6XDgRtu4kkh4Uk4zBc1c3iyyzTXgrkuOLLLLuFixdHQHu:n2R7sNOKtJfAIiyaTCkuOLLLLuFivHW
Malware Config
Signatures
-
Detect Lumma Stealer payload V2 1 IoCs
resource yara_rule sample family_lumma_V2 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2844-4-0x0000000000400000-0x0000000000481000-memory.dmp
Files
-
2844-4-0x0000000000400000-0x0000000000481000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 416KB - Virtual size: 415KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ