Behavioral task
behavioral1
Sample
1696-54-0x0000000000070000-0x00000000000A9000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1696-54-0x0000000000070000-0x00000000000A9000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
1696-54-0x0000000000070000-0x00000000000A9000-memory.dmp
-
Size
228KB
-
MD5
206edc6c01daf8bc26e9580c94e16c35
-
SHA1
91b6b4bfad5cba68cb1a14b58522c72b17fbc3a4
-
SHA256
f93e94d2c91b12461691da812d668b6b5d7a80c3968b2a4bd45fe8501f41f8af
-
SHA512
3e3c16a70b3c7857ccb943ad262f05b456cf7895720fa99baa9c719276277d350734edd88808936b215b2db8a1f0861bb140f7be5e0874435cfcb3b5937a93db
-
SSDEEP
3072:CvRen9jpcm91oZc6tKo3VCidiwgotGJ3xksl6KiEddiQVoA0XGsOM2XuRrQp:CvRenRz/Vo32bksQEdZ6LXGSQp
Malware Config
Extracted
lumma
82.117.255.127
Signatures
-
Detect Lumma Stealer payload V2 1 IoCs
resource yara_rule sample family_lumma_V2 -
Detect Lumma Stealer payload V4 1 IoCs
resource yara_rule sample family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1696-54-0x0000000000070000-0x00000000000A9000-memory.dmp
Files
-
1696-54-0x0000000000070000-0x00000000000A9000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 150KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.voltbl Size: 512B - Virtual size: 52B
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ