Behavioral task
behavioral1
Sample
a948976eded517477a4f71a15578a9e1.exe
Resource
win7-20231215-en
General
-
Target
a948976eded517477a4f71a15578a9e1.exe
-
Size
104KB
-
MD5
a948976eded517477a4f71a15578a9e1
-
SHA1
3762de142aae4044829461ed186a9b397e668d1f
-
SHA256
73dea3ec1437dd358cc7c48d80bcd41001c79bf344a3039908159a9bed5d8583
-
SHA512
f935453f15ba296b47be1c273f97512eefb61659065442024db92c864d2edfe281b252fb91c8e39111dab26d10747c821285799e11e38c11a835d28d8ec5117f
-
SSDEEP
1536:SXpTCaBA4oCe7TX454bdgunpIr/5OlJ8bBjXO1IK3hrDNljWLVI/S:WpTSZhgB5OlJ8bBK1IChrDNl
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 1 IoCs
resource yara_rule sample family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a948976eded517477a4f71a15578a9e1.exe
Files
-
a948976eded517477a4f71a15578a9e1.exe.exe windows:4 windows x86 arch:x86
040269cc4548194cd7e3788fb7d80a57
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetTickCount
QueryPerformanceCounter
QueryPerformanceFrequency
GetTimeFormatA
GetLocalTime
ExpandEnvironmentStringsA
CloseHandle
WriteFile
CreateFileA
CreateThread
DeleteFileA
GetTempPathA
GetVersionExA
GlobalMemoryStatus
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetStringTypeW
CreateMutexA
GetLastError
Sleep
GetSystemDirectoryA
CopyFileA
TerminateThread
CreateProcessA
GetStringTypeA
FlushFileBuffers
SetStdHandle
SetFilePointer
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
SetEndOfFile
UnhandledExceptionFilter
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
ReadFile
GetVersion
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
GetCurrentProcess
TerminateProcess
ExitProcess
user32
FindWindowA
SendMessageA
mpr
WNetAddConnection2A
WNetCancelConnection2A
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
shell32
ShellExecuteA
ws2_32
getsockname
inet_ntoa
gethostbyaddr
recv
socket
connect
select
setsockopt
htons
htonl
sendto
WSAGetLastError
inet_addr
gethostbyname
WSAStartup
WSACleanup
closesocket
ioctlsocket
ntohl
accept
listen
bind
WSAAsyncSelect
send
WSASocketA
wininet
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetReadFile
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE