Behavioral task
behavioral1
Sample
192638613dd864e5f5ba157796d5f161999e357621660ed98d99bf6b905f43a9.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
192638613dd864e5f5ba157796d5f161999e357621660ed98d99bf6b905f43a9.exe
Resource
win10v2004-20241007-en
General
-
Target
192638613dd864e5f5ba157796d5f161999e357621660ed98d99bf6b905f43a9
-
Size
304KB
-
MD5
931e3f6924d392b27fa3c5747bea9163
-
SHA1
2b73286b3117a7479407e0aa53e40d9b20f2e7b5
-
SHA256
192638613dd864e5f5ba157796d5f161999e357621660ed98d99bf6b905f43a9
-
SHA512
37b7d574ebe88fd21f4524f54fb862e68115f3e00a07d2a66f058a54129b46910d60c3cf34e1795f7722dabbfbf248f4e476a379ed850d87d909873e504e3f8d
-
SSDEEP
6144:eO0dkDl5i6k4Ft6Afvbt9V0ENK5ZM/TIbpKZ8mrx/KD:eO0dW5i4r6AXjKEKSEpKZ8m1/KD
Malware Config
Extracted
lumma
https://moutheventushz.shop/api
https://respectabosiz.shop/api
https://bakedstusteeb.shop/api
https://conceszustyb.shop/api
https://nightybinybz.shop/api
https://standartedby.shop/api
https://mutterissuen.shop/api
https://worddosofrm.shop/api
https://geerkenmsu.shop/api
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 192638613dd864e5f5ba157796d5f161999e357621660ed98d99bf6b905f43a9
Files
-
192638613dd864e5f5ba157796d5f161999e357621660ed98d99bf6b905f43a9.exe windows:6 windows x86 arch:x86
8ea762cb12f12d0d3d5d10e2af0b8ece
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileW
ExitProcess
GetCommandLineW
GetCurrentProcessId
GetCurrentThreadId
GetLogicalDrives
GetSystemDirectoryW
GlobalLock
GlobalUnlock
user32
CloseClipboard
FindWindowExW
GetClipboardData
GetDC
GetForegroundWindow
GetSystemMetrics
GetWindowLongW
GetWindowThreadProcessId
IsWindowEnabled
IsWindowVisible
OpenClipboard
ReleaseDC
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
DeleteDC
DeleteObject
GetCurrentObject
GetDIBits
GetObjectW
GetPixel
SelectObject
StretchBlt
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
shell32
SHEmptyRecycleBinW
SHGetFileInfoW
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantInit
Sections
.text Size: 254KB - Virtual size: 253KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ