Behavioral task
behavioral1
Sample
1980-54-0x0000000000400000-0x00000000004DC000-memory.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1980-54-0x0000000000400000-0x00000000004DC000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
1980-54-0x0000000000400000-0x00000000004DC000-memory.dmp
-
Size
880KB
-
MD5
8e51123a6149492f2133178475a7164e
-
SHA1
05f715a3de75aa3b7fabb3ff59c79335f9582df5
-
SHA256
1d468bd43f379393f60d2f9aa85784158db2e15ac9e46bd6f4eb548e892085cd
-
SHA512
8ff71dacca1a93821140d260931d1dc695848108de1e0cf583db58b75fae5643ae169128006c2a47ef071ef1615f8532d745ef30d13e05181ceafdc90e1a0b4a
-
SSDEEP
3072:aNu5n9Ephmo10MM7TdPoIVC8dlWgEtGJPWRtXx33ieLQsJo/9hmdkhXPrI2:aNu5nuWIMoI3aRthhLZWVho72
Malware Config
Extracted
lumma
82.117.255.127
Signatures
-
Detect Lumma Stealer payload V2 1 IoCs
resource yara_rule sample family_lumma_V2 -
Detect Lumma Stealer payload V4 1 IoCs
resource yara_rule sample family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1980-54-0x0000000000400000-0x00000000004DC000-memory.dmp
Files
-
1980-54-0x0000000000400000-0x00000000004DC000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 150KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.voltbl Size: 512B - Virtual size: 52B
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ