Behavioral task
behavioral1
Sample
opptdirytaom.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
opptdirytaom.exe
Resource
win10v2004-20240802-en
General
-
Target
opptdirytaom
-
Size
306KB
-
MD5
69d16125f643b9a34f9e63bcdd66747e
-
SHA1
137ea6a6fb1071750c3f1b68b7e879230337171f
-
SHA256
fd7af4c8df941b85ba3bb227a3ad52e77b953f44ba979bc7be8cd1cc953eb5d1
-
SHA512
b993bfb60d8e27a089784583c33c600755969776f3fc5177d2fa2754abcad23aa9d9815e5841cb1c2df944d30ab830fcb3bf22050d6e4b30ea8f86a0f299698c
-
SSDEEP
6144:9vQaHClkXkwdKQnfSjdBEhrfSNXuPxuBJxfaClvm7ZUprV:9/ClkXRiXAcuPcBesvm7U
Malware Config
Extracted
lumma
https://bakefirefighteossw.shop/api
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource opptdirytaom
Files
-
opptdirytaom.exe windows:6 windows x86 arch:x86
97c79fcb7db8de03404d5d59ebf6db18
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetLastError
GetSystemDirectoryW
GlobalLock
GlobalUnlock
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
oleaut32
SysAllocString
SysFreeString
SysStringLen
VariantClear
VariantInit
user32
CloseClipboard
GetClipboardData
GetDC
GetSystemMetrics
GetWindowLongW
OpenClipboard
ReleaseDC
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
DeleteObject
GetCurrentObject
GetDIBits
GetObjectW
SelectObject
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
xabv Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE