lumma | ep_setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ep_setup.exe
Size 2.4MB
Sample240226-rpdppagb29
SHA256 a25e2487bb4b638d6333d652db58532f3f29dd5ddb7711f70f52e0e61e8d3f51
MD5 253012a62bc1d805c8c0b1bbf936c6f0
SHA1 33728ba8f5ad3a4f0e1a5d6890022c377c0c00f8
SHA512 06842aab184f35c855dbf450534f9de7d66bb5923d0119c3ada19a08dc9f5c2b287321c571cf8b4727927517c6dabe37130e7b9a6eed4892159112ab6e45f57f
SSDEEP 24576:j+G047epooYKZYzX1HWvWKz4E+hhf4udB2mMmsZJlrA9yoiO2V0KcJx3UnpLco7r:B047epoC8cWKssZfM9m1AJxUFr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma

Malware Config

Signatures

Detect Lumma Stealer payload V4 1 IoCs

resource	yara_rule
sample	family_lumma_v4

Lumma family
lumma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ep_setup.exe

File Explorer

ep_setup.exe

.exe 2.4MB

ep_setup.exe

IMPHASH 11977f8fc78984c7718f55a8b8333a0e
SHA256 a25e2487bb4b638d6333d652db58532f3f29dd5ddb7711f70f52e0e61e8d3f51
MD5 253012a62bc1d805c8c0b1bbf936c6f0
SHA1 33728ba8f5ad3a4f0e1a5d6890022c377c0c00f8
SHA512 06842aab184f35c855dbf450534f9de7d66bb5923d0119c3ada19a08dc9f5c2b287321c571cf8b4727927517c6dabe37130e7b9a6eed4892159112ab6e45f57f
SSDEEP 24576:j+G047epooYKZYzX1HWvWKz4E+hhf4udB2mMmsZJlrA9yoiO2V0KcJx3UnpLco7r:B047epoC8cWKssZfM9m1AJxUFr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detect Lumma Stealer payload V4
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\ep_setup.pdb

kernel32

GetCurrentProcessId CreateProcessW GetModuleHandleW GetProcessTimes GetExitCodeProcess FindFirstFileW SetLastError WriteFile RemoveDirectoryW GetModuleFileNameW GetTempPathW FindClose CreateThread GetCurrentDirectoryW GetProcAddress MoveFileExW FreeLibrary CopyFileW CreateSymbolicLinkW MoveFileW LoadLibraryExW WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle LocalFree FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW MultiByteToWideChar SetFilePointerEx GetConsoleMode GetConsoleOutputCP LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapFree HeapAlloc GetWindowsDirectoryW K32EnumProcesses FindResourceW LoadResource FreeConsole CloseHandle Process32FirstW DeleteFileW LockResource Process32NextW GetLastError Sleep CreateEventW CreateToolhelp32Snapshot OpenProcess FreeResource GetSystemDirectoryW K32GetProcessImageFileNameW GetCurrentThreadId CreateFileW LocalAlloc WaitForSingleObject TerminateProcess GetCurrentProcess CreateDirectoryW GetFileSizeEx SizeofResource GetStdHandle GetModuleHandleExW ExitProcess RtlPcToFileHeader RaiseException EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

user32

LoadIconW wsprintfW TranslateMessage FindWindowW LoadCursorW ExitWindowsEx SetProcessDpiAwarenessContext FindWindowExW SendMessageTimeoutW SendMessageW LoadStringW SwitchToThisWindow GetWindowThreadProcessId GetMessageW DefWindowProcW MessageBoxW CreateWindowExW RegisterClassExW DispatchMessageW

advapi32

RegDeleteKeyValueW RevertToSelf EqualSid AllocateAndInitializeSid RegCreateKeyExW CreateProcessWithTokenW ImpersonateLoggedOnUser RegDeleteTreeW RegSetValueExW FreeSid CheckTokenMembership DuplicateTokenEx RegOpenKeyW GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey OpenProcessToken RegOpenKeyExW RegGetValueW RegQueryValueExW

shell32

ShellExecuteW ShellExecuteExW SHGetFolderPathW Shell_NotifyIconW CommandLineToArgvW SHFileOperationW

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysFreeString

rstrtmgr

RmRegisterResources RmGetList RmStartSession RmShutdown RmEndSession RmRestart

version

VerQueryValueW

shlwapi

PathRemoveExtensionW PathFileExistsW PathStripPathW PathRemoveFileSpecW

Name

.text

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ep_setup.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

rstrtmgr

version

shlwapi

generic