Behavioral task
behavioral1
Sample
1488-5-0x0000000001290000-0x00000000012E7000-memory.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1488-5-0x0000000001290000-0x00000000012E7000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
1488-5-0x0000000001290000-0x00000000012E7000-memory.dmp
-
Size
348KB
-
MD5
f1f5c91e4b8b501faad6a9823ef4473f
-
SHA1
5148876c321c637f9b1a5186d741b574a78842e0
-
SHA256
5f21be538676fd2dec224e6fc5455240f2e57cd29e6047505c388a2b780bdc94
-
SHA512
086a2252efa8267aca7c3a23a8bc731fb48d189bcaf06ebd76547ee7a74976ab9ca8096fb0153bca292af109e595c468ccdff9b5bcc47f07a39fb33ce1145d11
-
SSDEEP
6144:mS9zI5ol2V6IQYLtNiPwVEM1mYDvmZZ7eqUOpzNvuDaaan9I:mS9zI5olInrmy3vTqUOp9uDaaan
Malware Config
Extracted
lumma
https://conformfucdioz.shop/api
https://applyzxcksdia.shop/api
https://replacedoxcjzp.shop/api
https://declaredczxi.shop/api
https://catchddkxozvp.shop/api
https://arriveoxpzxo.shop/api
https://contemplateodszsv.shop/api
https://bindceasdiwozx.shop/api
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1488-5-0x0000000001290000-0x00000000012E7000-memory.dmp
Files
-
1488-5-0x0000000001290000-0x00000000012E7000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 244KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ