Lumen[.]exe | Triage™

Resubmissions

13/08/2026, 12:03

260813-n8js9sae93

13/08/2026, 11:56

260813-n4cjdsydmd5

Sharing

Copy URL Twitter E-mail

General

Target
Lumen.exe
Size 14.7MB
Sample260813-n8js9sae93
SHA256 39353eeb5a18fd64aaf9352c352a796cf3cc1549c5396e9672677dab4f4a71f7
MD5 e84a1d5363e739336f95ed134acef2c1
SHA1 0f68608e8d5d1e1c2b5c9a5b5d5f0bdcdea9f92a
SHA512 7f97fb3d0a531cd52546cf69641a50957d00621882e227b3056d91ae15896cf027a356ca54000f79723131b7bb901bca6fbe533655ecc6bcc9f10f4d186255ef
SSDEEP 393216:e0/EJ45Yv9GtRr8KknahHwkMNcTqwQRaeFxO:eyFakMNXG1
TLSH
T152F6C09965FC00E8E837D178C7565723FB7138180370A6EF1AA586A22F339E52E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Lumen.exe

File Explorer

Lumen.exe

.exe 14.7MB

Lumen.exe

IMPHASH 26b30390d06d58d4a33eaec120fcc226
SHA256 39353eeb5a18fd64aaf9352c352a796cf3cc1549c5396e9672677dab4f4a71f7
MD5 e84a1d5363e739336f95ed134acef2c1
SHA1 0f68608e8d5d1e1c2b5c9a5b5d5f0bdcdea9f92a
SHA512 7f97fb3d0a531cd52546cf69641a50957d00621882e227b3056d91ae15896cf027a356ca54000f79723131b7bb901bca6fbe533655ecc6bcc9f10f4d186255ef
SSDEEP 393216:e0/EJ45Yv9GtRr8KknahHwkMNcTqwQRaeFxO:eyFakMNXG1
TLSH
T152F6C09965FC00E8E837D178C7565723FB7138180370A6EF1AA586A22F339E52E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

8674000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

listen recv bind accept WSAIoctl getsockname htonl send WSASocketA getpeername recvfrom sendto htons inet_addr inet_ntoa ntohs gethostbyaddr gethostbyname getservbyport getservbyname socket WSAStringToAddressW WSACleanup closesocket WSASend select shutdown WSASetLastError WSASocketW getaddrinfo WSAStartup connect WSARecv getsockopt freeaddrinfo ioctlsocket setsockopt WSAGetLastError

crypt32

CertAddCertificateContextToStore CryptProtectData CryptUnprotectData CertOpenStore CertFindCertificateInStore CertOpenSystemStoreW CertVerifyCertificateChainPolicy CertFreeCertificateContext CertOpenSystemStoreA CertEnumCertificatesInStore CertCloseStore CertCreateCertificateContext CertGetCertificateChain CertFreeCertificateChain

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

dcomp

DCompositionCreateDevice

d3dcompiler_47

D3DCompile

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW GetModuleHandleA GetModuleFileNameA GetModuleHandleExW GetModuleHandleExA LoadLibraryExW GetProcAddress FreeLibraryAndExitThread

api-ms-win-core-localization-l1-2-0

IsValidLocale GetUserDefaultLCID LCMapStringW FormatMessageW GetLocaleInfoEx EnumSystemLocalesW GetLocaleInfoA GetLocaleInfoW GetCPInfo LCMapStringEx IsValidCodePage FormatMessageA GetOEMCP

api-ms-win-core-string-l1-1-0

CompareStringW MultiByteToWideChar WideCharToMultiByte GetStringTypeW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable GetSystemTimePreciseAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlCaptureStackBackTrace RtlUnwind RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle Sleep WaitOnAddress SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize WakeByAddressAll

api-ms-win-core-synch-l1-1-0

SetWaitableTimerEx TryAcquireSRWLockExclusive WaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive SetWaitableTimer CreateWaitableTimerExW TryAcquireSRWLockShared SetEvent AcquireSRWLockExclusive InitializeCriticalSectionEx InitializeSRWLock WaitForSingleObjectEx SleepEx CreateEventW CreateMutexA

api-ms-win-core-errorhandling-l1-1-0

SetLastError RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort DeviceIoControl GetQueuedCompletionStatus PostQueuedCompletionStatus

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetStartupInfoW CreateProcessA SetThreadPriority SwitchToThread GetCurrentThread GetCurrentThreadId ExitProcess QueueUserAPC CreateThread GetCurrentProcess ExitThread TerminateThread TerminateProcess

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-ansi-l1-1-0

CreateWaitableTimerA CreateWaitableTimerExA

api-ms-win-core-heap-l2-1-0

LocalFree GlobalFree GlobalAlloc

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx GetTickCount64 GetLocalTime GetSystemDirectoryA

api-ms-win-core-kernel32-legacy-l1-1-2

Process32Next Process32First

api-ms-win-core-file-l1-1-0

DeleteFileA CreateFileA FindFirstFileA SetFileInformationByHandle FindClose GetFullPathNameW GetFileSizeEx SetFilePointerEx SetEndOfFile FindNextFileA CreateFileW GetDriveTypeW GetFileAttributesExW GetFileAttributesA CreateDirectoryA FindFirstFileExW CreateDirectoryW GetFileInformationByHandle FlushFileBuffers ReadFile

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler CoTaskMemFree CoIncrementMTAUsage

api-ms-win-core-winrt-l1-1-0

RoInitialize RoGetActivationFactory

api-ms-win-mm-time-l1-1-0

timeBeginPeriod timeEndPeriod

bcrypt

BCryptGenRandom

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-registry-l1-1-0

RegQueryValueExA RegOpenKeyExA RegCloseKey

api-ms-win-core-file-l1-2-2

GetTempPathA AreFileApisANSI

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileExA

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-console-l2-1-0

SetConsoleCursorPosition GetConsoleScreenBufferInfo FillConsoleOutputCharacterA FillConsoleOutputAttribute

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleMode SetConsoleCtrlHandler AllocConsole GetConsoleOutputCP SetConsoleMode

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW GetCommandLineW GetStdHandle GetCurrentDirectoryW FreeEnvironmentStringsW GetCommandLineA SetStdHandle GetEnvironmentStringsW

api-ms-win-core-memory-l1-1-0

VirtualAlloc

winmm

joyGetDevCapsA joyGetPosEx joyGetNumDevs

dwmapi

DwmSetWindowAttribute

comdlg32

GetOpenFileNameA

kernel32

ConvertThreadToFiberEx ReadConsoleW ReadConsoleA VirtualProtect RtlVirtualUnwind LeaveCriticalSection EnterCriticalSection InitializeCriticalSection Module32First Module32Next FindFirstFileW FindNextFileW GetFileType GetSystemTime SystemTimeToFileTime FreeLibrary ReleaseSemaphore GetExitCodeThread CreateSemaphoreA GetEnvironmentVariableW GetACP WriteFile GetModuleHandleW GetSystemTimeAsFileTime DeleteCriticalSection CreateFiberEx WakeConditionVariable WakeAllConditionVariable ReleaseSRWLockShared AcquireSRWLockShared TlsAlloc TlsGetValue TlsSetValue ConvertFiberToThread SwitchToFiber DeleteFiber GetSystemInfo LoadLibraryW

user32

DrawTextA SetWindowDisplayAffinity MapVirtualKeyA RegisterClassA EnumWindows UpdateWindow BeginPaint EndPaint GetWindowThreadProcessId DispatchMessageA DestroyWindow SetWindowPos GetKeyboardState ShowWindow OpenClipboard CloseClipboard EmptyClipboard GetRawInputData AttachThreadInput DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus BringWindowToTop RegisterRawInputDevices TranslateMessage GetClipboardData SetClipboardData ToUnicode FillRect GetWindowLongPtrA PostQuitMessage SetWinEventHook SetWindowLongPtrA FindWindowA RegisterClassExA UnhookWinEvent SetForegroundWindow IsIconic GetWindowRect IsWindow GetAsyncKeyState SendInput GetKeyState LoadCursorA ScreenToClient ClientToScreen GetKeyboardLayout GetForegroundWindow SetCursor GetClientRect MessageBoxA SetCursorPos GetCursorPos GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetKeyNameTextA PeekMessageA

gdi32

CreateFontA SelectObject SetTextColor SetBkMode DeleteObject CreateSolidBrush

advapi32

CryptAcquireContextW ReportEventW RegisterEventSourceW CryptGenRandom SystemFunction036 DeregisterEventSource CryptReleaseContext

shell32

ShellExecuteA SHGetFolderPathA SHGetKnownFolderPath

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx CopyFile2 MoveFileExW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork FreeLibraryWhenCallbackReturns CloseThreadpoolWork SubmitThreadpoolWork

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsAlloc FlsGetValue FlsFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation SystemTimeToTzSpecificLocalTime FileTimeToSystemTime

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapSize HeapQueryInformation HeapFree HeapReAlloc

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

oleaut32

SysStringLen SysFreeString SetErrorInfo GetErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

8.6MB

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

104KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

250KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ywz

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Lumen.exe

ws2_32

crypt32

d3d11

dcomp

d3dcompiler_47

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-ansi-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-2

api-ms-win-core-file-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-mm-time-l1-1-0

bcrypt

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

winmm

dwmapi

comdlg32

kernel32

user32

gdi32

advapi32

shell32

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-datetime-l1-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-1

generic