Behavioral task
behavioral1
Sample
1728051008fa5ad7882346a210ffc1b466c1a5582726f2013b6c33e9c6351df75d7db903d1884.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1728051008fa5ad7882346a210ffc1b466c1a5582726f2013b6c33e9c6351df75d7db903d1884.exe
Resource
win10v2004-20240802-en
General
-
Target
1728051008fa5ad7882346a210ffc1b466c1a5582726f2013b6c33e9c6351df75d7db903d1884.dat-decoded
-
Size
318KB
-
MD5
89f5c1154310d2e78b305f998fc9cbd8
-
SHA1
c5b9bd17441190d1bedb46487c8c5eba5f48fbb8
-
SHA256
799536a1dbc24acb629655fa4c650fc52f237802366b79d381a119680fe55044
-
SHA512
ffe167283e4451233aa405d72cf247e3bbb9d7a4ab292eecf0ae461fe381f50950f3ee3c17695f8993233601ace701f04e0a500cc24dcb8d650dbe8c887cfd2f
-
SSDEEP
6144:Al2vDBSk3YRXK5mPum7xW3uBE4zHHKdtL+kULzlby+wEtFqXw3Mz7Zn+U+moI6ba:Z0bRaULYtSKsZUp
Malware Config
Extracted
lumma
https://caffegclasiqwp.shop/api
https://stamppreewntnq.shop/api
https://stagedchheiqwo.shop/api
https://millyscroqwp.shop/api
https://evoliutwoqm.shop/api
https://condedqpwqm.shop/api
https://traineiwnqo.shop/api
https://locatedblsoqp.shop/api
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1728051008fa5ad7882346a210ffc1b466c1a5582726f2013b6c33e9c6351df75d7db903d1884.dat-decoded
Files
-
1728051008fa5ad7882346a210ffc1b466c1a5582726f2013b6c33e9c6351df75d7db903d1884.dat-decoded.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ