Lumen[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Lumen.exe
Size 14.5MB
Sample260622-pcdstabz5x
SHA256 af7dea0ab0f4f02ff7ff36ce4f99a266656446e216c9030c883c43e761fd4d94
MD5 58a97e803195791c03e9b446b061fd29
SHA1 ed8d297df37aa8f2cb8a1269b614cc5a6d2d3671
SHA512 f0561851fb739a5f9799ca82318b1ccebc75627823f1aabfd69afae1a607ae6ffd1e97ab9eab67fb66ad61a661c6e0321887692fc55eaa2a29c1642cc977fc0f
SSDEEP 196608:Fz680XbIZt4F+WCo/QFAboBEx4eTiEEfF5U5OgGmq3PwYTYT+96n:d680Xbwtc+WCo/QFgoBk4e+K1H
TLSH
T166E6C09864FC00E8D937C074C7566663FE71781807706AEB5BA489B52F33AE12E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Lumen.exe

File Explorer

Lumen.exe

.exe 14.5MB

Lumen.exe

IMPHASH 2919a3c86cd256c79e3eb5336caad80b
SHA256 af7dea0ab0f4f02ff7ff36ce4f99a266656446e216c9030c883c43e761fd4d94
MD5 58a97e803195791c03e9b446b061fd29
SHA1 ed8d297df37aa8f2cb8a1269b614cc5a6d2d3671
SHA512 f0561851fb739a5f9799ca82318b1ccebc75627823f1aabfd69afae1a607ae6ffd1e97ab9eab67fb66ad61a661c6e0321887692fc55eaa2a29c1642cc977fc0f
SSDEEP 196608:Fz680XbIZt4F+WCo/QFAboBEx4eTiEEfF5U5OgGmq3PwYTYT+96n:d680Xbwtc+WCo/QFgoBk4e+K1H
TLSH
T166E6C09864FC00E8D937C074C7566663FE71781807706AEB5BA489B52F33AE12E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8470332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAIoctl accept bind getsockname htonl listen recv send WSASocketA getpeername recvfrom sendto htons inet_addr inet_ntoa ntohs gethostbyaddr gethostbyname getservbyport getservbyname socket WSAStringToAddressW WSACleanup closesocket WSASend select shutdown WSASetLastError WSASocketW getaddrinfo WSAStartup connect WSARecv getsockopt freeaddrinfo ioctlsocket setsockopt WSAGetLastError

crypt32

CertAddCertificateContextToStore CryptProtectData CryptUnprotectData CertOpenStore CertFindCertificateInStore CertOpenSystemStoreW CertVerifyCertificateChainPolicy CertFreeCertificateContext CertOpenSystemStoreA CertEnumCertificatesInStore CertCloseStore CertCreateCertificateContext CertGetCertificateChain CertFreeCertificateChain

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

dcomp

DCompositionCreateDevice

d3dcompiler_47

D3DCompile

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA LoadLibraryExW FreeLibraryAndExitThread GetModuleHandleExW GetModuleHandleA GetProcAddress GetModuleHandleExA GetModuleFileNameW

api-ms-win-core-localization-l1-2-0

LCMapStringEx GetCPInfo LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP FormatMessageA GetLocaleInfoA FormatMessageW GetLocaleInfoEx

api-ms-win-core-string-l1-1-0

CompareStringW WideCharToMultiByte MultiByteToWideChar GetStringTypeW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable GetSystemTimePreciseAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlCaptureStackBackTrace RtlUnwind RtlUnwindEx

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx CreateWaitableTimerExW InitializeSRWLock SetWaitableTimer TryAcquireSRWLockShared CreateEventW SetWaitableTimerEx WaitForSingleObjectEx SleepEx WaitForSingleObject TryAcquireSRWLockExclusive CreateMutexA AcquireSRWLockExclusive SetEvent ReleaseSRWLockExclusive ReleaseMutex

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter SetLastError GetLastError UnhandledExceptionFilter RaiseException

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort DeviceIoControl PostQueuedCompletionStatus GetQueuedCompletionStatus

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetLogicalProcessorInformationEx GetSystemDirectoryA GetTickCount64

api-ms-win-core-processthreads-l1-1-0

TerminateProcess CreateProcessA TerminateThread SetThreadPriority GetCurrentProcessId GetCurrentThread ExitProcess GetCurrentProcess GetStartupInfoW QueueUserAPC CreateThread ExitThread GetCurrentThreadId

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA CreateWaitableTimerExA

api-ms-win-core-heap-l2-1-0

GlobalAlloc LocalFree GlobalFree

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW Sleep WakeByAddressAll WaitOnAddress WakeByAddressSingle InitOnceBeginInitialize InitOnceComplete

api-ms-win-core-kernel32-legacy-l1-1-2

Process32Next Process32First

api-ms-win-core-file-l1-1-0

CreateFileW CreateDirectoryW FindFirstFileA GetFullPathNameW FindFirstFileExW SetFilePointerEx SetFileInformationByHandle SetEndOfFile GetFileAttributesExW GetFileSizeEx FlushFileBuffers ReadFile GetFileAttributesA GetFileInformationByHandle CreateDirectoryA GetDriveTypeW FindClose DeleteFileA CreateFileA FindNextFileA

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler CoTaskMemFree

api-ms-win-core-winrt-l1-1-0

RoInitialize RoGetActivationFactory

api-ms-win-mm-time-l1-1-0

timeBeginPeriod timeEndPeriod

bcrypt

BCryptGenRandom

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-file-l1-2-2

GetTempPathA AreFileApisANSI

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileExA

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-console-l2-1-0

FillConsoleOutputCharacterA GetConsoleScreenBufferInfo FillConsoleOutputAttribute SetConsoleCursorPosition

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler AllocConsole WriteConsoleW GetConsoleMode SetConsoleMode GetConsoleOutputCP

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle GetCommandLineW GetCommandLineA GetCurrentDirectoryW GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

api-ms-win-core-memory-l1-1-0

VirtualAlloc

dwmapi

DwmSetWindowAttribute

comdlg32

GetOpenFileNameA

kernel32

ConvertThreadToFiberEx ReadConsoleW ReadConsoleA WakeAllConditionVariable RtlVirtualUnwind DeleteCriticalSection VirtualProtect GetSystemInfo LeaveCriticalSection EnterCriticalSection InitializeCriticalSection Module32First Module32Next ReleaseSRWLockShared ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetEnvironmentVariableW GetACP WriteFile GetModuleHandleW GetSystemTimeAsFileTime AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue SwitchToFiber DeleteFiber CreateFiberEx FindFirstFileW FindNextFileW GetFileType ConvertFiberToThread GetSystemTime SystemTimeToFileTime FreeLibrary WakeConditionVariable LoadLibraryW

user32

DrawTextA SetWindowDisplayAffinity MapVirtualKeyA RegisterClassA EnumWindows UpdateWindow BeginPaint EndPaint GetWindowThreadProcessId DispatchMessageA DestroyWindow SetWindowPos GetKeyboardState ShowWindow OpenClipboard CloseClipboard EmptyClipboard GetRawInputData AttachThreadInput DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus BringWindowToTop RegisterRawInputDevices TranslateMessage GetClipboardData SetClipboardData ToUnicode FillRect GetWindowLongPtrA PostQuitMessage SetWinEventHook SetWindowLongPtrA FindWindowA RegisterClassExA UnhookWinEvent SetForegroundWindow IsIconic GetWindowRect IsWindow GetAsyncKeyState SendInput GetKeyState LoadCursorA ScreenToClient MessageBoxA GetKeyboardLayout GetForegroundWindow SetCursor GetClientRect SetCursorPos GetCursorPos GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetKeyNameTextA PeekMessageA ClientToScreen

gdi32

CreateFontA SelectObject SetTextColor SetBkMode DeleteObject CreateSolidBrush

advapi32

CryptAcquireContextW ReportEventW RegisterEventSourceW CryptGenRandom SystemFunction036 DeregisterEventSource CryptReleaseContext

shell32

ShellExecuteA SHGetFolderPathA SHGetKnownFolderPath

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

CopyFile2 MoveFileExW GetFileInformationByHandleEx

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns CloseThreadpoolWork

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsSetValue FlsGetValue FlsFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime

api-ms-win-core-heap-l1-1-0

HeapQueryInformation HeapFree HeapAlloc HeapSize GetProcessHeap HeapReAlloc

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

oleaut32

SysStringLen SysFreeString SetErrorInfo GetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

8.4MB

Virtual Size

8.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

102KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Ng1

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Lumen.exe

ws2_32

crypt32

d3d11

dcomp

d3dcompiler_47

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-core-file-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-mm-time-l1-1-0

bcrypt

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

dwmapi

comdlg32

kernel32

user32

gdi32

advapi32

shell32

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-datetime-l1-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-1

generic