Behavioral task
behavioral1
Sample
LumaPlay_x64.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
LumaPlay_x64.exe
Resource
debian12-armhf-20240221-en
General
-
Target
LumaPlay_x64.exe
-
Size
149KB
-
MD5
113ab94c75f69258726c91a5a94d95c3
-
SHA1
3272db5ac69f2cd675b9c377e1b3692ed2016211
-
SHA256
6ddefd167a478df42f580a762762be0b130aad0544d28152f12c0e0aa793e267
-
SHA512
5650549e4278f128925061c257cafcdabb5465c81e6a22d8f3935afb92c9cfa7d7b296c5682c802b361f8d60bc891fc2e451130bbbd466965fab17ff58888240
-
SSDEEP
3072:q4ED2+27DBI7q36lciI0AOF+wR7qA4PP9OE416yYKU:qFh2XBy/pI3j47dT
Malware Config
Signatures
-
R77 family
-
r77 rootkit payload 1 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule sample r77_payload -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource LumaPlay_x64.exe
Files
-
LumaPlay_x64.exe.exe windows:6 windows x64 arch:x64
4717a0d656bdafd244dd8482ac93a625
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetProcessId
WaitForSingleObject
GetModuleHandleA
CloseHandle
GetProcAddress
VirtualAllocEx
ExitProcess
CreateRemoteThread
CreateProcessA
VirtualFreeEx
GetPrivateProfileIntA
GetPrivateProfileStringA
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
GetModuleFileNameA
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadContext
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
ReadConsoleW
ReadFile
SetEndOfFile
VirtualQuery
GetSystemInfo
VirtualAlloc
Thread32Next
VirtualFree
SetFilePointerEx
HeapSize
CreateFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleHandleExW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
LCMapStringW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
WriteConsoleW
user32
MessageBoxA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyValueA
RegCloseKey
shlwapi
StrStrIA
PathRemoveFileSpecA
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ