D:\a\SourcePauseTool\SourcePauseTool\Release\spt.pdb
Behavioral task
behavioral1
Sample
spt.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
spt.dll
Resource
win10v2004-20240508-en
General
-
Target
spt.dll
-
Size
991KB
-
MD5
42e9cf174f813d7afb08e9bece8afef0
-
SHA1
c982972badecbc337c338c5cec3f217123ecd751
-
SHA256
cfb02e8da44dfe984087b9e5996ce446fa498bc34d73697b7805cd95c2a05d49
-
SHA512
c68d7364ef9c9eecf1f10b4582106b1c8ef9b7a7ce281bfdd7bd9e74f2cc1b9f06cce530e9eab05d58bec7a128c30efebdc2d5cb80f6d185808fccc27fd15ec8
-
SSDEEP
24576:GsWfpqemVeJcsmEqFFm5sJ3vhv0f0mNKALVG1:Gs+9wTJ/hvPmnZG1
Malware Config
Signatures
-
Detect Lumma Stealer payload V4 1 IoCs
resource yara_rule sample family_lumma_v4 -
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource spt.dll
Files
-
spt.dll.dll windows:5 windows x86 arch:x86
a2d95cc3c7440108219724de67b37e70
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadLibraryExA
LoadLibraryA
LoadLibraryW
FreeLibrary
LoadLibraryExW
VirtualProtect
GetCurrentProcess
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
VirtualQuery
HeapSize
WriteConsoleW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleHandleA
MultiByteToWideChar
WideCharToMultiByte
InterlockedExchange
HeapCreate
HeapFree
InterlockedCompareExchange
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
FormatMessageW
GetLastError
EncodePointer
DecodePointer
RaiseException
IsProcessorFeaturePresent
QueueUserWorkItem
GetModuleHandleExW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
SetEvent
ResetEvent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
TerminateProcess
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
SetEnvironmentVariableA
ExitProcess
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
ws2_32
closesocket
select
WSAStartup
getaddrinfo
socket
WSAGetLastError
WSACleanup
accept
listen
recv
send
ioctlsocket
bind
freeaddrinfo
tier0
Msg
?DevMsg@@YAXPBDZZ
?DevWarning@@YAXPBDZZ
Warning
_AssertValidWritePtr
g_pMemAlloc
AssertValidStringPtr
psapi
GetModuleInformation
Exports
Exports
CreateInterface
cvar
g_pCVar
Sections
.text Size: 652KB - Virtual size: 652KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 257KB - Virtual size: 257KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 38KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ