lumma | c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f

Sharing

Copy URL Twitter E-mail

General

Target
c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f
Size 6.3MB
Sample240525-bfnwasha61
SHA256 c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f
MD5 6c7b1c7f2a466936f3c06f608358311a
SHA1 14723c060f07a69d9bb5a6d04debccd55b32781d
SHA512 6d31d272eed382edec75873f116d5e49ea02672affaa0bc7e8c8733e1244e245e66ee016eafb25d3c9322f153e02c3538c798c6e74d860464c68acab6d06937b
SSDEEP 98304:Wy2Ra3s45KZATR1DPBLPjmFk1wTdrobphQ7O9CKkq7xb4T0HmphWdo80jT:WM5igRjLik1OibpCyCZT0mpMeT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma risepro

Malware Config

Signatures

Detect Lumma Stealer payload V4 1 IoCs

resource	yara_rule
sample	family_lumma_v4

Lumma family
lumma
Risepro family
risepro

File Explorer

c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f

.exe 6.3MB

c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f

IMPHASH 50daf93fbd8aef383dbf1ae02f88939d
SHA256 c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f
MD5 6c7b1c7f2a466936f3c06f608358311a
SHA1 14723c060f07a69d9bb5a6d04debccd55b32781d
SHA512 6d31d272eed382edec75873f116d5e49ea02672affaa0bc7e8c8733e1244e245e66ee016eafb25d3c9322f153e02c3538c798c6e74d860464c68acab6d06937b
SSDEEP 98304:Wy2Ra3s45KZATR1DPBLPjmFk1wTdrobphQ7O9CKkq7xb4T0HmphWdo80jT:WM5igRjLik1OibpCyCZT0mpMeT
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detect Lumma Stealer payload V4

Digest

f4:3f:73:ed:b1:2c:02:5f:30:bc:10:ef:f5:89:19:46:b9:7d:cb:d4:54:da:65:64:c8:ca:1c:3a:58:77:7a:81

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=5218067,CN=netSkope\, Inc.,O=netSkope\, Inc.,STREET=2445 Augustine Drive\, Suite 301,L=Santa Clara,ST=California,C=US,1.2.840.113549.1.9.1=#0c166365727461646d696e406e6574736b6f70652e636f6d,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 21, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

07:c0:71:36:a8:f3:52:4e:17:fb:f4:ab

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 1, 2024 - Mar 17, 2027

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

4558272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jenkins\iad0-cisystem\workspace\client-hotfix-pipeline\client\stAgent\out\bin\winnt-x86-Release\stAgentSvc.pdb

crypt32

CertEnumCertificatesInStore CertOpenStore CertDuplicateCertificateContext CertGetCertificateContextProperty CryptAcquireCertificatePrivateKey CertCreateCertificateContext CryptStringToBinaryA CertAddCertificateContextToStore CryptUnprotectData CryptProtectData CertGetCertificateChain CertFreeCertificateChain CertNameToStrA CryptFindOIDInfo CertStrToNameA CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetNameStringA CertFindCertificateInStore CryptMsgGetParam CryptQueryObject CryptMsgClose CertOpenSystemStoreA CertGetIntendedKeyUsage CertCloseStore

ws2_32

WSAGetLastError inet_pton WSACleanup WSAStartup ntohl socket shutdown getaddrinfo freeaddrinfo htons ntohs getnameinfo htonl connect closesocket getsockopt __WSAFDIsSet ioctlsocket select inet_ntop getsockname bind send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAPoll WSAResetEvent WSAWaitForMultipleEvents inet_ntoa inet_addr gethostname getpeername sendto recvfrom recv listen accept WSAIoctl setsockopt WSASetLastError

dbghelp

MiniDumpWriteDump

userenv

DestroyEnvironmentBlock LoadUserProfileW UnloadUserProfile CreateEnvironmentBlock ExpandEnvironmentStringsForUserW

advapi32

OpenServiceA SetServiceObjectSecurity QueryServiceStatusEx QueryServiceObjectSecurity StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerExA AllocateAndInitializeSid FreeSid CheckTokenMembership GetUserNameW CryptSignHashA LsaFreeMemory LsaQueryInformationPolicy LsaOpenPolicy LsaClose SetFileSecurityW CryptGetHashParam CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam ImpersonateLoggedOnUser CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW DeregisterEventSource EnumServicesStatusExA QueryServiceConfigA RegCloseKey RegOpenCurrentUser RegGetValueA RegQueryValueExA RevertToSelf GetTokenInformation OpenThreadToken DuplicateToken OpenProcessToken CreateWellKnownSid CreateProcessAsUserA LookupAccountSidW EqualSid ConvertStringSecurityDescriptorToSecurityDescriptorA RegCreateKeyExA RegFlushKey CryptHashData GetSecurityDescriptorDacl BuildExplicitAccessWithNameW OpenSCManagerA CloseServiceHandle SetEntriesInAclW ChangeServiceConfig2A CreateServiceA ChangeServiceConfigA StartServiceA QueryServiceStatus ControlService DeleteService CryptReleaseContext CryptGenRandom CryptAcquireContextW DeleteAce GetNamedSecurityInfoW SetNamedSecurityInfoW GetAce ConvertSidToStringSidA GetAclInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExA RegDeleteValueA RegEnumValueA RegOpenKeyExA RegQueryInfoKeyA RegSetValueExA RegDeleteKeyExA

kernel32

DuplicateHandle GetCurrentProcess CreateSemaphoreA HeapAlloc WaitForMultipleObjectsEx GetEnvironmentVariableA GetTickCount GetModuleHandleA GetProcAddress GetSystemDirectoryA GetSystemWow64DirectoryA GetShortPathNameA GetCurrentDirectoryA GetModuleFileNameA SetCurrentDirectoryA WaitForMultipleObjects WaitForSingleObject OpenProcess TerminateProcess GetExitCodeProcess ResetEvent QueryPerformanceCounter Thread32Next GetSystemPowerStatus Thread32First CreateToolhelp32Snapshot ProcessIdToSessionId K32GetModuleFileNameExA K32GetProcessMemoryInfo LoadLibraryA GetProcessIoCounters K32EnumProcesses GlobalMemoryStatusEx FreeLibrary GetProcessTimes GetSystemTimes GetVolumeInformationA GetLogicalDriveStringsA GetDiskFreeSpaceExA FormatMessageA VerifyVersionInfoA VerSetConditionMask GetTickCount64 ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection QueryPerformanceFrequency MultiByteToWideChar WideCharToMultiByte MoveFileExA CompareFileTime GetStdHandle GetFileType ReadFile PeekNamedPipe SleepEx VerifyVersionInfoW RtlUnwind ExpandEnvironmentStringsA GetEnvironmentVariableW CreateFileW Wow64RevertWow64FsRedirection DeleteFileA DeleteFileW LocalFree CopyFileW FlushFileBuffers GetNativeSystemInfo Process32First WriteFile QueryFullProcessImageNameA CreateFileA Process32Next GetOverlappedResult CreateProcessW CreateProcessA HeapFree LocalAlloc GetComputerNameExA LoadLibraryExW GetComputerNameExW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW GetModuleHandleExW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber LoadLibraryW FindClose FindFirstFileW FindNextFileW GetSystemTime SystemTimeToFileTime InitializeCriticalSection OutputDebugStringA GetModuleFileNameW SetErrorMode CreateMutexA ReleaseMutex GetLocalTime AddVectoredExceptionHandler GetErrorMode SetUnhandledExceptionFilter GetWindowsDirectoryW GetFileAttributesW OutputDebugStringW DeviceIoControl GetCurrentThread WTSGetActiveConsoleSessionId GlobalAlloc GlobalFree InterlockedPushEntrySList GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter AreFileApisANSI GetProcessHeap OpenEventW GetConsoleCP ExitThread FreeLibraryAndExitThread WriteConsoleW GetDriveTypeW SystemTimeToTzSpecificLocalTime LCMapStringW MoveFileExW SetFilePointerEx SetEndOfFile RemoveDirectoryW FileTimeToSystemTime SetConsoleCtrlHandler ExitProcess GetTimeZoneInformation GetCommandLineA GetCommandLineW GetDateFormatW Sleep DecodePointer DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetSystemTimeAsFileTime ReleaseSemaphore GetCurrentProcessId GetCurrentThreadId WaitForSingleObjectEx SetEvent CreateEventA CloseHandle GetStringTypeExA GetUserDefaultLCID LCMapStringA GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW CreateDirectoryW GetCurrentDirectoryW CreateWaitableTimerA ResumeThread SetWaitableTimer OpenEventA GetLocaleInfoEx GetCPInfo CompareStringEx GetTimeFormatW CompareStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetFileSizeEx ReadConsoleInputW SetStdHandle HeapReAlloc HeapSize FindFirstFileExW CreateThread LocalSize LCMapStringEx EncodePointer GetStringTypeW GetExitCodeThread GetConsoleScreenBufferInfo SetConsoleTextAttribute SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeSRWLock CreateEventW GetFileAttributesA IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW lstrcmpW lstrlenW Wow64DisableWow64FsRedirection GetDynamicTimeZoneInformation WriteConsoleA Wow64EnableWow64FsRedirection

user32

RegisterPowerSettingNotification LoadStringA MessageBoxW GetUserObjectInformationW GetProcessWindowStation

shell32

SHCreateDirectoryExW SHGetFolderPathW SHGetKnownFolderPath ord680 SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoInitialize CoTaskMemFree

oleaut32

SysStringLen SysFreeString VariantInit SysAllocStringByteLen SysAllocString VariantClear SysStringByteLen

iphlpapi

GetAdaptersAddresses GetExtendedTcpTable GetBestRoute2 SetPerTcpConnectionEStats GetExtendedUdpTable GetPerTcpConnectionEStats Icmp6ParseReplies NotifyRouteChange2 Icmp6SendEcho2 IcmpSendEcho2Ex IcmpCloseHandle Icmp6CreateFile IcmpCreateFile CancelMibChangeNotify2 NotifyIpInterfaceChange GetIfEntry2 IcmpParseReplies NotifyUnicastIpAddressChange

wldap32

ord211 ord60 ord46 ord217 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord301 ord200 ord30 ord79 ord143

wtsapi32

WTSFreeMemory WTSEnumerateSessionsA WTSCloseServer WTSQuerySessionInformationA WTSQuerySessionInformationW WTSQueryUserToken WTSOpenServerA

psapi

EnumProcesses

shlwapi

PathAppendA PathFileExistsA

pdh

PdhAddCounterA PdhGetFormattedCounterValue PdhCollectQueryData PdhOpenQueryA PdhCloseQuery PdhAddEnglishCounterA

bcrypt

BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash BCryptHashData BCryptGenRandom

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

wintrust

WinVerifyTrust

powrprof

CallNtPowerInformation

msi

ord93 ord71 ord267 ord8

wevtapi

EvtRender EvtNext EvtQuery EvtClose

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpSetTimeouts

secur32

CompleteAuthToken FreeCredentialsHandle GetUserNameExA AcquireCredentialsHandleA InitializeSecurityContextA DeleteSecurityContext

ncrypt

NCryptSignHash NCryptFreeObject

Sharing

General

Malware Config

Signatures

File Explorer

c41745d8a3ead8489fba5d9ddbadbcc868194da360463eae2d63a0a09c07c19f

crypt32

ws2_32

dbghelp

userenv

advapi32

kernel32

user32

shell32

ole32

oleaut32

iphlpapi

wldap32

wtsapi32

psapi

shlwapi

pdh

bcrypt

version

wintrust

powrprof

msi

wevtapi

winhttp

secur32

ncrypt

generic