Edit tour
Windows
Analysis Report
2.exe
Overview
General Information
Detection
LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Benign windows process drops PE files
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected CryptOne packer
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected SmokeLoader
Yara detected Vidar
Yara detected Vidar stealer
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Opens network shares
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Execution of Suspicious File Type Extension
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara detected Keylogger Generic
Yara signature match
Classification
- System is w10x64
- 2.exe (PID: 7436 cmdline:
"C:\Users\ user\Deskt op\2.exe" MD5: 4D956BA3709B6BE0CC4910690EF93F0B) - explorer.exe (PID: 2580 cmdline:
C:\Windows \Explorer. EXE MD5: 662F4F92FDE3557E86D110526BB578D5) - 38F9.exe (PID: 7932 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\38F9.ex e MD5: EA9DD1EAE2E521666D3F06382104EC10) - WerFault.exe (PID: 8164 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 7 932 -s 151 2 MD5: C31336C1EFC2CCB44B4326EA793040F2) - D818.exe (PID: 7224 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\D818.ex e MD5: AC1CC39DC3DF2AB7197EC22259A09E17) - katB4C0.tmp (PID: 4480 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\katB4C0 .tmp MD5: 66064DBDB70A5EB15EBF3BF65ABA254B) - cmd.exe (PID: 7724 cmdline:
"C:\Window s\System32 \cmd.exe" /c timeout /t 10 & d el /f /q " C:\Users\u ser\AppDat a\Local\Te mp\katB4C0 .tmp" & rd /s /q "C: \ProgramDa ta\FIEGCBK EGCFC" & e xit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7812 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - timeout.exe (PID: 7832 cmdline:
timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
- jssrvvh (PID: 7868 cmdline:
C:\Users\u ser\AppDat a\Roaming\ jssrvvh MD5: 4D956BA3709B6BE0CC4910690EF93F0B)
- jssrvvh (PID: 6468 cmdline:
C:\Users\u ser\AppDat a\Roaming\ jssrvvh MD5: 4D956BA3709B6BE0CC4910690EF93F0B)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Lumma Stealer, LummaC2 Stealer | Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. | No Attribution |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
SmokeLoader | The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body. |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Vidar | Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. | No Attribution |
{"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "whispedwoodmoodsksl.shop", "boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "whispedwoodmoodsksl.shop", "boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "whispedwoodmoodsksl.shop", "boredimperissvieos.shop"], "Build id": "swg5EG--"}
{"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "42d0618304a88d6476bc55d33c23d7e6", "Version": "9.8"}
{"Version": 2022, "C2 list": ["http://dbfhns.in/tmp/index.php", "http://guteyr.cc/tmp/index.php", "http://greendag.ru/tmp/index.php", "http://lobulraualov.in.net/tmp/index.php"]}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_LummaCStealer_3 | Yara detected LummaC Stealer | Joe Security | ||
JoeSecurity_Vidar_2 | Yara detected Vidar | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Crypt | Yara detected CryptOne packer | Joe Security | ||
Windows_Trojan_Smokeloader_3687686f | unknown | unknown |
| |
Windows_Trojan_RedLineStealer_ed346e4c | unknown | unknown |
| |
Windows_Trojan_RedLineStealer_ed346e4c | unknown | unknown |
| |
JoeSecurity_CredentialStealer | Yara detected Credential Stealer | Joe Security | ||
Click to see the 33 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation | Detects executables containing potential Windows Defender anti-emulation checks | ditekSHen |
| |
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation | Detects executables containing potential Windows Defender anti-emulation checks | ditekSHen |
| |
JoeSecurity_Vidar_1 | Yara detected Vidar stealer | Joe Security | ||
Click to see the 7 entries |
System Summary |
---|
Source: | Author: Max Altgelt (Nextron Systems): |
Timestamp: | 05/26/24-10:28:23.404116 |
SID: | 2039103 |
Source Port: | 49738 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:26.528096 |
SID: | 2039103 |
Source Port: | 49741 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:31.624034 |
SID: | 2039103 |
Source Port: | 49747 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:30.628218 |
SID: | 2039103 |
Source Port: | 49745 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:55.119711 |
SID: | 2039103 |
Source Port: | 49760 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:22.363903 |
SID: | 2039103 |
Source Port: | 49737 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:30.181811 |
SID: | 2052787 |
Source Port: | 55411 |
Destination Port: | 53 |
Protocol: | UDP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:56.160957 |
SID: | 2039103 |
Source Port: | 49761 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:21.316978 |
SID: | 2039103 |
Source Port: | 49736 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:24.455656 |
SID: | 2039103 |
Source Port: | 49739 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:29.589480 |
SID: | 2039103 |
Source Port: | 49743 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:32.680599 |
SID: | 2039103 |
Source Port: | 49748 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 05/26/24-10:28:25.535669 |
SID: | 2039103 |
Source Port: | 49740 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: |
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: | ||
Source: | Avira: |
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: | ||
Source: | Malware Configuration Extractor: |
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link | ||
Source: | Virustotal: | Perma Link |
Source: | ReversingLabs: | ||
Source: | ReversingLabs: |
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: |
Source: | Code function: | 6_2_0041537E | |
Source: | Code function: | 11_2_6CB5A9A0 | |
Source: | Code function: | 11_2_6CB544C0 | |
Source: | Code function: | 11_2_6CB24420 | |
Source: | Code function: | 11_2_6CB54440 | |
Source: | Code function: | 11_2_6CBA25B0 | |
Source: | Code function: | 11_2_6CB3E6E0 | |
Source: | Code function: | 11_2_6CB38670 | |
Source: | Code function: | 11_2_6CB5A650 | |
Source: | Code function: | 11_2_6CB7A730 | |
Source: | Code function: | 11_2_6CB80180 | |
Source: | Code function: | 11_2_6CB543B0 | |
Source: | Code function: | 11_2_6CB77C00 | |
Source: | Code function: | 11_2_6CB7BD30 | |
Source: | Code function: | 11_2_6CB37D60 | |
Source: | Code function: | 11_2_6CB79EC0 | |
Source: | Code function: | 11_2_6CB53FF0 | |
Source: | Code function: | 11_2_6CB53850 | |
Source: | Code function: | 11_2_6CB59840 | |
Source: | Code function: | 11_2_6CB7DA40 |
Compliance |
---|
Source: | Unpacked PE file: |
Source: | Static PE information: |
Source: | File opened: | Jump to behavior |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Source: | Code function: | 6_2_00427353 | |
Source: | Code function: | 6_2_00427353 | |
Source: | Code function: | 6_2_004168EF | |
Source: | Code function: | 6_2_00409960 | |
Source: | Code function: | 6_2_00409960 | |
Source: | Code function: | 6_2_00404970 | |
Source: | Code function: | 6_2_00415FE1 | |
Source: | Code function: | 6_2_0043B050 | |
Source: | Code function: | 6_2_00417062 | |
Source: | Code function: | 6_2_00417062 | |
Source: | Code function: | 6_2_00426174 | |
Source: | Code function: | 6_2_004381BB | |
Source: | Code function: | 6_2_00426271 | |
Source: | Code function: | 6_2_00426284 | |
Source: | Code function: | 6_2_004102B2 | |
Source: | Code function: | 6_2_004164D2 | |
Source: | Code function: | 6_2_00403570 | |
Source: | Code function: | 6_2_00421580 | |
Source: | Code function: | 6_2_004025A0 | |
Source: | Code function: | 6_2_00414660 | |
Source: | Code function: | 6_2_00436670 | |
Source: | Code function: | 6_2_00431680 | |
Source: | Code function: | 6_2_004106B1 | |
Source: | Code function: | 6_2_004138D2 | |
Source: | Code function: | 6_2_004248E0 | |
Source: | Code function: | 6_2_00423931 | |
Source: | Code function: | 6_2_00423AD0 | |
Source: | Code function: | 6_2_00422AFB | |
Source: | Code function: | 6_2_00415AFA | |
Source: | Code function: | 6_2_0040CB10 | |
Source: | Code function: | 6_2_0040FBB4 | |
Source: | Code function: | 6_2_0041CCD0 | |
Source: | Code function: | 6_2_00425CEE | |
Source: | Code function: | 6_2_00423C97 | |
Source: | Code function: | 6_2_00433D0A | |
Source: | Code function: | 6_2_00438F15 | |
Source: | Code function: | 6_2_0057D097 | |
Source: | Code function: | 6_2_0059917C | |
Source: | Code function: | 6_2_00576248 | |
Source: | Code function: | 6_2_005772C9 | |
Source: | Code function: | 6_2_005772C9 | |
Source: | Code function: | 6_2_005812E0 | |
Source: | Code function: | 6_2_0059B2B7 | |
Source: | Code function: | 6_2_005863DB | |
Source: | Code function: | 6_2_005864D8 | |
Source: | Code function: | 6_2_005864EB | |
Source: | Code function: | 6_2_00570519 | |
Source: | Code function: | 6_2_005875BA | |
Source: | Code function: | 6_2_005875BA | |
Source: | Code function: | 6_2_00576739 | |
Source: | Code function: | 6_2_005637D7 | |
Source: | Code function: | 6_2_00562807 | |
Source: | Code function: | 6_2_005968D7 | |
Source: | Code function: | 6_2_005748C7 | |
Source: | Code function: | 6_2_005918E7 | |
Source: | Code function: | 6_2_00570918 | |
Source: | Code function: | 6_2_00576B56 | |
Source: | Code function: | 6_2_00584B47 | |
Source: | Code function: | 6_2_00564BD7 | |
Source: | Code function: | 6_2_00584B47 | |
Source: | Code function: | 6_2_00569BC7 | |
Source: | Code function: | 6_2_00569BC7 | |
Source: | Code function: | 6_2_00583B98 | |
Source: | Code function: | 6_2_00581C89 | |
Source: | Code function: | 6_2_00582D5B | |
Source: | Code function: | 6_2_0056CD77 | |
Source: | Code function: | 6_2_00575D61 | |
Source: | Code function: | 6_2_00593E13 | |
Source: | Code function: | 6_2_0056FE1B | |
Source: | Code function: | 6_2_00583ECF | |
Source: | Code function: | 6_2_00583EFE | |
Source: | Code function: | 6_2_00585F55 | |
Source: | Code function: | 6_2_0057CF1A |
Networking |
---|
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: |
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior | ||
Source: | Network Connect: | Jump to behavior |
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: | ||
Source: | URLs: |
Source: | HTTP traffic detected: |