lumin (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lumin (1).exe
Size 5.7MB
Sample261003-vs3prsty7m
SHA256 e9be07e4958404190385d2b95a1cf1a9463f4d31579b5b2b76b3f706bb09db0c
MD5 d9a8df591fb2dc0a5f3d30c8cfb68359
SHA1 60b5d87f0b2c59d7eb160df66475c6c60a03cd19
SHA512 84c69de6cd2365d34ddaf73125ed89e0b60dba284fb5fae65215ed97157cf654d845de2f7e2a1870d8d88639e52bd27a9e679f173632e612fe86f6490b6e30d1
SSDEEP 98304:5gj1PESBXbJFtsZE88xLq+/jc6TJzoXRkfLH0tbaKUsBOt:5s9z4iTUtbFH
TLSH
T18B568D07E29480E8D0AED078C35AA537EB72BC890531B6DF1BE45B112F36F50AB2D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lumin (1).exe

File Explorer

lumin (1).exe

.exe 5.7MB

lumin (1).exe

IMPHASH e6c46dfb045275a34e6febc7c3da357c
SHA256 e9be07e4958404190385d2b95a1cf1a9463f4d31579b5b2b76b3f706bb09db0c
MD5 d9a8df591fb2dc0a5f3d30c8cfb68359
SHA1 60b5d87f0b2c59d7eb160df66475c6c60a03cd19
SHA512 84c69de6cd2365d34ddaf73125ed89e0b60dba284fb5fae65215ed97157cf654d845de2f7e2a1870d8d88639e52bd27a9e679f173632e612fe86f6490b6e30d1
SSDEEP 98304:5gj1PESBXbJFtsZE88xLq+/jc6TJzoXRkfLH0tbaKUsBOt:5s9z4iTUtbFH
TLSH
T18B568D07E29480E8D0AED078C35AA537EB72BC890531B6DF1BE45B112F36F50AB2D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3340880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

lumin.pdb

kernel32

LoadLibraryW LoadLibraryA CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP SetFileInformationByHandle MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW FlsFree FlsSetValue IsThreadAFiber MoveFileExW SleepEx ReadFileEx WriteFileEx GetExitCodeProcess WaitForSingleObject SetHandleInformation CreateThread GetFullPathNameW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetCurrentThreadId GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle SetFileAttributesW GetTempPathW DeleteFileW CreateWaitableTimerExW SetWaitableTimer SetLastError FindClose GetFinalPathNameByHandleW SetFilePointerEx FindNextFileW GetProcessTimes GlobalMemoryStatusEx GetSystemInfo GetSystemTimes GetProcessIoCounters FindFirstFileExW GetModuleHandleW LCIDToLocaleName GetUserDefaultUILanguage OpenProcess WakeAllConditionVariable SleepConditionVariableSRW LocalFree GetSystemTimeAsFileTime FlsGetValue InitializeSListHead SetUnhandledExceptionFilter SwitchToThread lstrlenW RtlUnwindEx GetCurrentThread SetThreadStackGuarantee DeleteCriticalSection GetModuleHandleA Sleep GetProcAddress OutputDebugStringW OutputDebugStringA RtlPcToFileHeader LoadLibraryExA VirtualQueryEx ReadProcessMemory Process32NextW Process32FirstW CreateToolhelp32Snapshot K32GetPerformanceInfo QueryPerformanceCounter QueryPerformanceFrequency RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException FormatMessageW HeapReAlloc AddVectoredExceptionHandler GetLastError CreateFileW EncodePointer FreeLibrary LoadLibraryExW TlsSetValue TlsGetValue InitializeCriticalSectionEx TlsAlloc InitOnceExecuteOnce AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock HeapAlloc CloseHandle HeapFree GetProcessHeap GetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW SetEnvironmentVariableW FreeEnvironmentStringsW GetCommandLineW

advapi32

RegQueryValueExW RegSetValueExW RegCreateKeyExW IsValidSid RegGetValueW RegOpenKeyExW RegCloseKey GetLengthSid CopySid GetTokenInformation OpenProcessToken EventWriteTransfer EventUnregister EventSetInformation EventRegister

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

bcryptprimitives

ProcessPrng

ntdll

NtDeviceIoControlFile NtWriteFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtOpenFile NtQueryInformationProcess RtlGetVersion NtReadFile

shell32

SHAppBarMessage SHGetKnownFolderPath ShellExecuteW CommandLineToArgvW DragFinish DragQueryFileW

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

DefWindowProcW RegisterRawInputDevices GetSystemMetrics IsIconic ClipCursor SetWindowDisplayAffinity ReleaseCapture ShowCursor MonitorFromPoint EnumDisplayMonitors SetCapture MonitorFromRect IsWindow SetCursorPos GetKeyState ToUnicodeEx RegisterTouchWindow SetCursor GetTouchInputInfo CloseTouchInputHandle GetKeyboardLayout MapVirtualKeyExW GetKeyboardState SetPropW SetParent EnableWindow GetWindowTextLengthW GetClipCursor GetWindowPlacement GetMonitorInfoW SetWindowPlacement LoadCursorW ChangeDisplaySettingsExW AdjustWindowRectEx GetMenu GetWindowTextW FlashWindowEx SetWindowLongW GetSystemMenu InvalidateRgn RegisterWindowMessageA IsWindowVisible SetWindowTextW IsWindowEnabled GetAsyncKeyState SystemParametersInfoW TrackMouseEvent GetParent ScreenToClient SetFocus GetForegroundWindow AdjustWindowRect RedrawWindow GetWindowLongPtrW PostMessageW IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem EnableMenuItem DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx ReleaseDC GetDC VkKeyScanW SetMenuItemInfoW AppendMenuW InsertMenuW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu GetWindow InvalidateRect FindWindowExW GetWindowLongW SetWindowRgn RegisterClassExW CreateWindowExW TranslateAcceleratorW SetWindowLongPtrW SetWindowPos GetMessageA TranslateMessage DispatchMessageA GetMenuItemInfoW MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx DispatchMessageW GetMessageW PeekMessageW PostThreadMessageW DestroyWindow UpdateWindow EnumChildWindows

comctl32

TaskDialogIndirect RemoveWindowSubclass DefSubclassProc SetWindowSubclass

ole32

CoInitializeEx OleInitialize CoCreateInstance CoUninitialize RegisterDragDrop RevokeDragDrop

shlwapi

SHCreateMemStream

ws2_32

WSAGetLastError closesocket send getpeername getsockname WSAIoctl recv WSASocketW ioctlsocket getsockopt bind setsockopt WSACleanup getaddrinfo freeaddrinfo shutdown connect WSASend WSAStartup

gdi32

CreateSolidBrush CreateCompatibleDC BitBlt SelectObject DeleteDC DeleteObject SetBkMode CreateDIBSection SetTextColor CreateRectRgn CombineRgn GetDeviceCaps

crypt32

CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertFreeCertificateContext CertCloseStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertOpenStore CertSetCertificateContextProperty CertAddEncodedCertificateToStore

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

pdh

PdhOpenQueryA PdhRemoveCounter PdhEnumObjectsA PdhCloseQuery PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData

psapi

GetProcessMemoryInfo GetModuleFileNameExW

powrprof

CallNtPowerInformation

api-ms-win-crt-string-l1-1-0

strcmp wcslen strlen _wcsicmp strcpy_s wcscmp

api-ms-win-crt-math-l1-1-0

pow __setusermatherr round trunc floor roundf

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _wassert _set_app_type _errno __p___argc _configure_narrow_argv __p___argv _cexit _exit _c_exit exit terminate _get_initial_narrow_environment _crt_atexit _register_onexit_function _initialize_onexit_table abort _register_thread_local_exe_atexit_callback _initterm_e _initterm _initialize_narrow_environment

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol strtol _wtoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fclose feof ferror __acrt_iob_func fflush __p__commode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf fgets _set_fmode fopen _setmode fwrite ftell fseek _fileno fread

api-ms-win-crt-heap-l1-1-0

free realloc _callnewh calloc malloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale