D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\ep_setup.pdb
Behavioral task
behavioral1
Sample
entry_1_0/ep_setup (1).exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
entry_1_0/ep_setup (1).exe
Resource
win10v2004-20240226-en
General
-
Target
file_d90a1e1b684c4b609b4ab724f669eb80_2024-02-29_09_21_32_441000.zip
-
Size
1.0MB
-
MD5
40505d872aca98ac428ec234be27bab9
-
SHA1
8fd59875d5abb55095a3047ab2b1e5991e82dcea
-
SHA256
59dfeee74c204f2f9f030965baf88e8236371fa07b011a1d67a9759e8119f719
-
SHA512
de23577c2ae5b42846b11d69ef91f37514ceaf9be15712f7269a027ac5db3533411c003e74be5c7e346b7cdd623ea8f13d94de84f44842951a995c12a700a501
-
SSDEEP
24576:+l6vq+8rRAeTbuQZmBASfKLwdJ+pYmI8RFKuB:+l6vq+8FVWQcBHpmv0uB
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 1 IoCs
Processes:
resource yara_rule static1/unpack001/entry_1_0/ep_setup (1).exe family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/entry_1_0/ep_setup (1).exe
Files
-
file_d90a1e1b684c4b609b4ab724f669eb80_2024-02-29_09_21_32_441000.zip.zip
-
entry_1_0/ep_setup (1).exe.exe windows:6 windows x64 arch:x64
11977f8fc78984c7718f55a8b8333a0e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
GetProcessTimes
GetExitCodeProcess
FindFirstFileW
SetLastError
WriteFile
RemoveDirectoryW
GetModuleFileNameW
GetTempPathW
FindClose
CreateThread
GetCurrentDirectoryW
GetProcAddress
MoveFileExW
FreeLibrary
CopyFileW
CreateSymbolicLinkW
MoveFileW
LoadLibraryExW
WriteConsoleW
HeapReAlloc
HeapSize
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
LocalFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
MultiByteToWideChar
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
HeapFree
HeapAlloc
GetWindowsDirectoryW
K32EnumProcesses
FindResourceW
LoadResource
FreeConsole
CloseHandle
Process32FirstW
DeleteFileW
LockResource
Process32NextW
GetLastError
Sleep
CreateEventW
CreateToolhelp32Snapshot
OpenProcess
FreeResource
GetSystemDirectoryW
K32GetProcessImageFileNameW
GetCurrentThreadId
CreateFileW
LocalAlloc
WaitForSingleObject
TerminateProcess
GetCurrentProcess
CreateDirectoryW
GetFileSizeEx
SizeofResource
GetStdHandle
GetModuleHandleExW
ExitProcess
RtlPcToFileHeader
RaiseException
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
user32
LoadIconW
wsprintfW
TranslateMessage
FindWindowW
LoadCursorW
ExitWindowsEx
SetProcessDpiAwarenessContext
FindWindowExW
SendMessageTimeoutW
SendMessageW
LoadStringW
SwitchToThisWindow
GetWindowThreadProcessId
GetMessageW
DefWindowProcW
MessageBoxW
CreateWindowExW
RegisterClassExW
DispatchMessageW
advapi32
RegDeleteKeyValueW
RevertToSelf
EqualSid
AllocateAndInitializeSid
RegCreateKeyExW
CreateProcessWithTokenW
ImpersonateLoggedOnUser
RegDeleteTreeW
RegSetValueExW
FreeSid
CheckTokenMembership
DuplicateTokenEx
RegOpenKeyW
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
OpenProcessToken
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
shell32
ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
Shell_NotifyIconW
CommandLineToArgvW
SHFileOperationW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
rstrtmgr
RmRegisterResources
RmGetList
RmStartSession
RmShutdown
RmEndSession
RmRestart
version
VerQueryValueW
shlwapi
PathRemoveExtensionW
PathFileExistsW
PathStripPathW
PathRemoveFileSpecW
Exports
Exports
ZZLaunchExplorer
ZZLaunchExplorerDelayed
ZZRestartExplorer
ZZTestBalloon
Sections
.text Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
manifest.json