Behavioral task
behavioral1
Sample
2512-3-0x0000000000930000-0x0000000000DD9000-memory.exe
Resource
win7-20240903-en
General
-
Target
2512-3-0x0000000000930000-0x0000000000DD9000-memory.dmp
-
Size
4.7MB
-
MD5
2429a721d33c23a8db8d201030e5b0ae
-
SHA1
aaa2453cf34ecadbb06f529a1b107c2776378291
-
SHA256
301ed1a3ae93f54ff85a81375cf35bcc74976f4205246ebd9a4c75748663f4bb
-
SHA512
77fd31af657eed2952b293037dfd64f7cecd781997b837f42031c50616109c0db0bffc59e9af507f28dc42d305ba3bafc6262f7d318980d97b84c2edb8c15412
-
SSDEEP
98304:71D0OG7RlnSvNuSeM2BZ3xcxkMANMQHjZexL:RSlnSvNuSeMQZ3qxkZNvjZeN
Malware Config
Extracted
lumma
https://clearancek.site
https://licendfilteo.site
https://spirittunek.store
https://bathdoomgaz.store
https://studennotediw.store
https://dissapoiznw.store
https://eaglepawnoy.store
https://mobbipenju.store
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2512-3-0x0000000000930000-0x0000000000DD9000-memory.dmp
Files
-
2512-3-0x0000000000930000-0x0000000000DD9000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 151KB - Virtual size: 372KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ozjdnhgg Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bggtaqmq Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE