�j�������Œ���^l��L[6�Xz��$/N�r��o�\Q�L��-��z2j �&�F+�N��.C�`��B�d#��B�=ǧY&R�p[���.�r����M�� /%��rő?�j��W�u�|����#(BR��u�(}�FA��9'Q�$ѣ�7&�Oq���^A.b��+��(�ƎGhp�>��4�. .tC�Gw��?�� O ��!)*y��V��p�i$�.�5��Ք��,�;�<O�5G�w(wSK��f�{��9�j"JI㳆 �}�H���)#��.��)� �p3J�Xq?�?�,��A&ty/���AjR����]�>w觿����;>�s��4��n��)6c2�7��%��s�c��z��Ok�D��+N�`ԣ:��b�mN9�h���P��׳FM$��$FK�e��plW<�<�A�y�C��p/li=�qF���4X�.�T� ��&�&��; :����7��U���iF� \x�A[��<=(�<uYR-=*�Xʮ$�wa�����N��ǹA�����@��_�"`ɼlL�)�F)晙�:���_'�������e�Y�Dv�������a%r�2�BT�Z��(� h���bm���Tv�b�|���7f�³(�w7WT���`c����m����>�aRTЗ��.M��G�� E�/�8��5:%3�W��f�i�C��j��P�LH$Ӝ�g��Ep���3OPR�<�ʷ����� B=�a�`�9���N U��%\3�j�%#���=��Fʜ/���61�5nEٜ��Ɵ��=��(�KY�K���Ng�J�D��O!]#����a�,�~�!�ӕ�k呍z��.{Z�X���d���f���Ć��t�'^�_q���?��6 E�M}������@u��#�E��s�F������,9���D6��Q�M�#؝^k#��uA���?�^���T�����5�wD`����o\�&����Eě�(Ӹ�i��0Z]����O��JN`�"1�!�ae��F;t4W�dl���z`<������5M��1}V��h�*K��u��39϶�\N��f|��%Ȁъ?L��#=�1���ݛt�Y�T�dm#�{t��������RK���[��#ʱ�� H���o�A��b0p!�r���;�-<���0��mC H������3�p�G,)�1Q�N�a�Z�G��;M�+��Y:o�ܨ��[�_�}k��d ����$����6�]]f���^���H���q��iUA�>�]�F���y���w��;��P���Ԯ�a\q�lt��'F�q��z3�S��A گ;�2$Lz�#�ze�y���l8�#P��R�������[}=������[�ӯ�i���3�#���T8h1�L3�����s�[#v���?�ʛ��ɷ#6���52�E��7��\v����80����]�olqT]r� h��Q����Z ����?����{!G�.;�E��M�B8�V�����O�W9�^�c!(���8a�����j�әD�����;>�K� 5%G�/m�� �����/�5K'�fJ1����X+��Х�_�l)}�T�t��A�}�E��N��3TQ�q�jW�]���})&����������N�9�����0��z.9r,��жYK���u_U�vuޔ7�.�]$`���R,�fC��Kl���ԝ�����i��tb�ͮ��1��ڧ�Uj'���_ ��R6����"����>p�5��i[+�DXI��b��gYDI�H�)���"�EЊ��N��It�����@��;�c�Qψ��M�-CW��A7��k�V��G���)i�+8�X��c��B�O�\l:<��ν��f�n���bu��詢TF�1��e ���A��y�)�_)�<I��7Nt�ו3��K=m���vbv{��۽�w�+ŭ��%�J퀔b�"��ת���g?�*���A6�<���~F3�v�QJ��I|� �Z���`�7o�U�R�&���w1�ܱ�v�.vke���3�"����{ I_�n\:N���eTӽ�w �M�9;���?�����9��l9Qf�r�Q�%�̙�c��o�0��Q6$������e�LX��:S�՚��_��|y����"��F��!�P��LiR��aIS3 s�f�Ŵ�0����J��#s�ɃCR�]B��"2�$D��ܠ��(A�g��^�����P2@��D��a��}f*����#(*����X��PxOϻg ع����;��Z��]�ÍEn��+�oc-��{�LI�v�� f������YqM`9!��Ra!F�}��7����A������Y�0X�_La#�\��`(-�,�!�f���?�{��Z��;�`Q�yϰ{J*j�S��,�YС�����gZ��>�l�r��F���˹X�6�u�K��>�H'��ctc9x>��v�ʌ)�A`��{K���d�a�ڍ*U�Z�P���Ͻ���*GO �)��ɒ�D/���&�Ѐ���# �qd�̘���L{Ӿ���C�*\8<��!�G׀KW{S�A�(U�,�/�36��S�S}<&!���ߤ�=�P�w�&�%G�T�Њ���q�7���+P�C��箁 � &�htK��bEm���,�k�=�jWx�[Jb������م?���7'���W�C$���Y�a&��\[���&a��^`�r���2WIk�o 6e�����34�ܼ*�A����Љ���{�:�A=/�:�GLJ���'Гb�������$��� A^��1�D�y4K�.x�v�4����w��n������e�q���",��(���TU������L��(W�����!�`=!������s m�?���5�o#���r���tJqb�:-/�y���E��[�4�?��Bkv�m�}�2 Ǝ����d2��qN ���2<��5&B\��(�d����(7�g��o�e�?��aH�KVU+f]N�z 9U����P����dm�R�H�CL�*�߳�~$GZ�E&����� �@mլ�8`��%O2�k�Dp���FҦz���0/�%p�IL �LS���<��Y�=�i{|�n�9�&
Behavioral task
behavioral1
Sample
LUMINA BYPASS.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
LUMINA BYPASS.exe
Resource
win10v2004-20240802-en
General
-
Target
LUMINA BYPASS.rar
-
Size
5.8MB
-
MD5
c778af15214b6ffc32e2f87698c8a767
-
SHA1
5e9fbd8d8300272864f386a8f2fa5ba68d49e8ce
-
SHA256
4bc3e6dcd1faa1d14ad6f5c002d3ab64befeda2daf1dd21d7109e465246efe92
-
SHA512
88b600ed67714922ef50ae8afc56b5f6d271a1cea5b696d0938bf9e1dd82fbbe590a6c9f4c936d19593b1f66d9edfd8062748693e8144fdb64ccb98babf59a62
-
SSDEEP
98304:TTBKceak0s9fG61N8Q8nsdsAE3G3CkzSmdTkhA9fMA9su6ASfZbcoOoANYcy4+S9:TkD9fJ8vnsdXf3Ca3rfrsu6nRNEecf+Q
Malware Config
Signatures
-
resource yara_rule static1/unpack001/LUMINA BYPASS.exe vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/LUMINA BYPASS.exe
Files
-
LUMINA BYPASS.rar.rar
Password: 3252
-
LUMINA BYPASS.exe.exe windows:6 windows x64 arch:x64
Password: 3252
6a6b8af51f4f2f09505522fa1bbe876a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
wininet
InternetCloseHandle
kernel32
LoadLibraryA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptCreateHash
msvcp140
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord32
crypt32
CertFindCertificateInStore
ws2_32
WSAGetLastError
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_wassert
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-math-l1-1-0
cos
api-ms-win-crt-locale-l1-1-0
localeconv
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ