Behavioral task
behavioral1
Sample
be9d59c3d0d868387985f389c2992f9b4d51e16c37db194abc078b3034b0e7a8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
be9d59c3d0d868387985f389c2992f9b4d51e16c37db194abc078b3034b0e7a8.exe
Resource
win10v2004-20241007-en
General
-
Target
be9d59c3d0d868387985f389c2992f9b4d51e16c37db194abc078b3034b0e7a8.exe
-
Size
332KB
-
MD5
4d85799c044b617d8fa3b3bd91f75a41
-
SHA1
d75d4ba4ff2889e0a93b4f20ef2f1a990fa916d4
-
SHA256
be9d59c3d0d868387985f389c2992f9b4d51e16c37db194abc078b3034b0e7a8
-
SHA512
cb7c20a7dd3bd1ff739d92a51dd2c31dc03b4282a4db4880a5bc036fc2221767cbdda501fb6b11680fc9b3b03d77a6e5c18b9e0783f2ea9915c4a87f515e56e8
-
SSDEEP
6144:FmyyGBlJDGJoh+c1Klx5vDXAlFwmvFdvjT8LYyGiDoFh9YV:nBlJDGtxhAbwCvbT8EFN39
Malware Config
Extracted
lumma
https://robinsharez.shop/api
https://handscreamny.shop/api
https://chipdonkeruz.shop/api
https://versersleep.shop/api
https://crowdwarek.shop/api
https://apporholis.shop/api
https://femalsabler.shop/api
https://soundtappysk.shop/api
Signatures
-
Lumma family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be9d59c3d0d868387985f389c2992f9b4d51e16c37db194abc078b3034b0e7a8.exe
Files
-
be9d59c3d0d868387985f389c2992f9b4d51e16c37db194abc078b3034b0e7a8.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 268KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ