Lumen[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Lumen.exe
Size 14.6MB
Sample260716-w5pjcaft7x
SHA256 4d885f177023db26469b93bd899d04aff88561cc74ffa54fab1e3e6e999f7ada
MD5 e1564a4d8623298c1ea679b7cb049f2d
SHA1 f4c52f5570bf95fddf92e5cd9169e0e78fa3c4cb
SHA512 7c298c8c44021d7fabd899da0894dac96141c47c16af586e06187383098be43f74f47ac7db98c9213d2b7588ce36ff10398e8263ec899d2ff077db5d1878935c
SSDEEP 196608:4oLKswLQYQdsImBYmoYlB9OBQreF3fF5U5PR5jegf8Iw:1vwLQYcs7BYmoYlB9OeregpMvI
TLSH
T1B0F6BFA874FC00F8E826C1B4C7865717FB723825077066DB5AD489A52F33AE52E7E742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Lumen.exe

File Explorer

Lumen.exe

.exe 14.6MB

Lumen.exe

IMPHASH 1fb2252b8f8f5ac901bb25bdc6447d6f
SHA256 4d885f177023db26469b93bd899d04aff88561cc74ffa54fab1e3e6e999f7ada
MD5 e1564a4d8623298c1ea679b7cb049f2d
SHA1 f4c52f5570bf95fddf92e5cd9169e0e78fa3c4cb
SHA512 7c298c8c44021d7fabd899da0894dac96141c47c16af586e06187383098be43f74f47ac7db98c9213d2b7588ce36ff10398e8263ec899d2ff077db5d1878935c
SSDEEP 196608:4oLKswLQYQdsImBYmoYlB9OBQreF3fF5U5PR5jegf8Iw:1vwLQYcs7BYmoYlB9OeregpMvI
TLSH
T1B0F6BFA874FC00F8E826C1B4C7865717FB723825077066DB5AD489A52F33AE52E7E742
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8545872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

listen recv bind accept WSAIoctl getsockname htonl send WSASocketA getpeername recvfrom sendto htons inet_addr inet_ntoa ntohs gethostbyaddr gethostbyname getservbyport getservbyname socket WSAStringToAddressW WSACleanup closesocket WSASend select shutdown WSASetLastError WSASocketW getaddrinfo WSAStartup connect WSARecv getsockopt freeaddrinfo ioctlsocket setsockopt WSAGetLastError

crypt32

CertAddCertificateContextToStore CryptProtectData CryptUnprotectData CertOpenStore CertFindCertificateInStore CertOpenSystemStoreW CertVerifyCertificateChainPolicy CertFreeCertificateContext CertOpenSystemStoreA CertEnumCertificatesInStore CertCloseStore CertCreateCertificateContext CertGetCertificateChain CertFreeCertificateChain

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

dcomp

DCompositionCreateDevice

d3dcompiler_47

D3DCompile

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA GetModuleFileNameA GetModuleHandleExA GetProcAddress LoadLibraryExW FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleExW

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID IsValidCodePage GetLocaleInfoEx EnumSystemLocalesW GetLocaleInfoA GetLocaleInfoW GetOEMCP IsValidLocale FormatMessageA GetCPInfo LCMapStringEx FormatMessageW LCMapStringW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte CompareStringW GetStringTypeW MultiByteToWideChar

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime GetSystemFirmwareTable

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlCaptureStackBackTrace RtlUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx

api-ms-win-core-synch-l1-1-0

TryAcquireSRWLockExclusive WaitForSingleObject CreateEventW SetWaitableTimer InitializeSRWLock TryAcquireSRWLockShared WaitForSingleObjectEx ReleaseSRWLockExclusive SetEvent AcquireSRWLockExclusive SleepEx CreateMutexA InitializeCriticalSectionEx SetWaitableTimerEx ReleaseMutex CreateWaitableTimerExW

api-ms-win-core-errorhandling-l1-1-0

GetLastError RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-io-l1-1-0

PostQueuedCompletionStatus GetQueuedCompletionStatus DeviceIoControl CreateIoCompletionPort

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64 GetSystemDirectoryA GetLogicalProcessorInformationEx GetLocalTime

api-ms-win-core-processthreads-l1-1-0

TerminateThread GetCurrentProcess GetCurrentThreadId QueueUserAPC GetCurrentThread SwitchToThread GetCurrentProcessId ExitProcess SetThreadPriority GetStartupInfoW ExitThread TerminateProcess CreateThread CreateProcessA

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerExA CreateWaitableTimerA

api-ms-win-core-heap-l2-1-0

GlobalFree GlobalAlloc LocalFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll Sleep InitOnceBeginInitialize WaitOnAddress SleepConditionVariableSRW InitOnceComplete WakeByAddressSingle

api-ms-win-core-kernel32-legacy-l1-1-2

Process32Next Process32First

api-ms-win-core-file-l1-1-0

FlushFileBuffers GetFullPathNameW GetFileInformationByHandle GetFileSizeEx CreateFileW FindNextFileA ReadFile FindFirstFileA SetFileInformationByHandle SetFilePointerEx SetEndOfFile CreateDirectoryW GetDriveTypeW FindFirstFileExW GetFileAttributesA FindClose CreateDirectoryA GetFileAttributesExW CreateFileA DeleteFileA

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler CoIncrementMTAUsage CoTaskMemFree

api-ms-win-core-winrt-l1-1-0

RoInitialize RoGetActivationFactory

api-ms-win-mm-time-l1-1-0

timeBeginPeriod timeEndPeriod

bcrypt

BCryptGenRandom

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-registry-l1-1-0

RegQueryValueExA RegOpenKeyExA RegCloseKey

api-ms-win-core-file-l1-2-2

AreFileApisANSI GetTempPathA

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileExA

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-console-l2-1-0

FillConsoleOutputCharacterA GetConsoleScreenBufferInfo FillConsoleOutputAttribute SetConsoleCursorPosition

api-ms-win-core-console-l1-1-0

WriteConsoleW AllocConsole SetConsoleMode GetConsoleMode GetConsoleOutputCP SetConsoleCtrlHandler

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA GetCommandLineW GetStdHandle FreeEnvironmentStringsW SetStdHandle GetEnvironmentStringsW SetEnvironmentVariableW GetCurrentDirectoryW

api-ms-win-core-memory-l1-1-0

VirtualAlloc

winmm

joyGetDevCapsA joyGetPosEx joyGetNumDevs

dwmapi

DwmSetWindowAttribute

comdlg32

GetOpenFileNameA

kernel32

ConvertThreadToFiberEx ReadConsoleW ReadConsoleA VirtualProtect RtlVirtualUnwind LeaveCriticalSection EnterCriticalSection InitializeCriticalSection Module32First Module32Next FindFirstFileW FindNextFileW GetFileType GetSystemTime SystemTimeToFileTime FreeLibrary ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetEnvironmentVariableW GetACP WriteFile GetModuleHandleW GetSystemTimeAsFileTime DeleteCriticalSection CreateFiberEx WakeConditionVariable WakeAllConditionVariable ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue ConvertFiberToThread SwitchToFiber DeleteFiber GetSystemInfo LoadLibraryW

user32

DrawTextA SetWindowDisplayAffinity MapVirtualKeyA RegisterClassA EnumWindows UpdateWindow BeginPaint EndPaint GetWindowThreadProcessId DispatchMessageA DestroyWindow SetWindowPos GetKeyboardState ShowWindow OpenClipboard CloseClipboard EmptyClipboard GetRawInputData AttachThreadInput DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus BringWindowToTop RegisterRawInputDevices TranslateMessage GetClipboardData SetClipboardData ToUnicode FillRect GetWindowLongPtrA PostQuitMessage SetWinEventHook SetWindowLongPtrA FindWindowA RegisterClassExA UnhookWinEvent SetForegroundWindow IsIconic GetWindowRect IsWindow GetAsyncKeyState SendInput GetKeyState LoadCursorA ScreenToClient ClientToScreen GetKeyboardLayout GetForegroundWindow SetCursor GetClientRect MessageBoxA SetCursorPos GetCursorPos GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetKeyNameTextA PeekMessageA

gdi32

CreateFontA SelectObject SetTextColor SetBkMode DeleteObject CreateSolidBrush

advapi32

CryptAcquireContextW ReportEventW RegisterEventSourceW CryptGenRandom SystemFunction036 DeregisterEventSource CryptReleaseContext

shell32

ShellExecuteA SHGetFolderPathA SHGetKnownFolderPath

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

CopyFile2 GetFileInformationByHandleEx MoveFileExW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork FreeLibraryWhenCallbackReturns

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsGetValue FlsFree FlsAlloc

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime

api-ms-win-core-heap-l1-1-0

HeapReAlloc GetProcessHeap HeapAlloc HeapQueryInformation HeapFree HeapSize

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

oleaut32

SysStringLen SysFreeString SetErrorInfo GetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

8.5MB

Virtual Size

8.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

104KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.*4B

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Lumen.exe

ws2_32

crypt32

d3d11

dcomp

d3dcompiler_47

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-core-file-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-mm-time-l1-1-0

bcrypt

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

winmm

dwmapi

comdlg32

kernel32

user32

gdi32

advapi32

shell32

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-datetime-l1-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-1

generic