Behavioral task
behavioral1
Sample
99df3f89e632c4bb95e5a5c4f0303ea50eeec3e89dd65a3fc5a1244670360a01.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
99df3f89e632c4bb95e5a5c4f0303ea50eeec3e89dd65a3fc5a1244670360a01.exe
Resource
win10v2004-20241007-en
General
-
Target
99df3f89e632c4bb95e5a5c4f0303ea50eeec3e89dd65a3fc5a1244670360a01
-
Size
344KB
-
MD5
8adbd07e55bb8f7936e9c3ea67ef52c9
-
SHA1
20f337e761b7863686fde778ea10544e4de04f97
-
SHA256
99df3f89e632c4bb95e5a5c4f0303ea50eeec3e89dd65a3fc5a1244670360a01
-
SHA512
db892c2ca52f805d53527f50e5a3b180bff4e4ad91b4d4897c532ac43155942ef3475980cb6bc12152ed7ac6fb6f95339b36c2b1129410c2b44d6cba5105f97c
-
SSDEEP
3072:HD7A9dkUaVH9y5WroZqOmoevrM9F56OxRNpFWE5ExRpuMdECjnNd0rCh8qG1CV1p:vA9baCWrHFOxBBEwoJjNuuG1CTp
Malware Config
Extracted
lumma
https://varitycookypowerw.xyz/api
https://spitechallengddwlsv.xyz/api
https://voyagedprivillywk.xyz/api
https://fiondationkvowos.xyz/api
https://matterrydamagedowkds.xyz/api
https://clerkpolicemandwusi.xyz/api
https://surprisedscaledowp.xyz/api
https://singerreasonnbasldd.xyz/api
https://coalitionformutalew.xyz/api
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99df3f89e632c4bb95e5a5c4f0303ea50eeec3e89dd65a3fc5a1244670360a01
Files
-
99df3f89e632c4bb95e5a5c4f0303ea50eeec3e89dd65a3fc5a1244670360a01.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 235KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ