Windows Analysis Report
LisectAVT_2403002A_236.exe

Overview

General Information

Sample name: LisectAVT_2403002A_236.exe
Analysis ID: 1482389
MD5: 8ecbc517b61cdb069495b3f3e3887a0f
SHA1: 4b9170f6fe8e1b77fa1462efd4299930479f98cd
SHA256: 4c98f158e7654d83e23027e9c94b5a6d27837c3e0302e0619b7540fe1387645e
Tags: exeRaccoonStealer
Infos:

Detection

LummaC
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Yara detected LummaC Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Detected VMProtect packer
Found many strings related to Crypto-Wallets (likely being stolen)
LummaC encrypted strings found
Machine Learning detection for sample
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Detected potential crypto function
Entry point lies outside standard sections
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: LisectAVT_2403002A_236.exe Avira: detected
Antivirus detection for URL or domain
Source: associationokeo.shop Avira URL Cloud: Label: malware
Source: https://unhappytidydryypwto.shop/api#: Avira URL Cloud: Label: phishing
Source: unhappytidydryypwto.shop Avira URL Cloud: Label: phishing
Source: https://unhappytidydryypwto.shop/ Avira URL Cloud: Label: phishing
Source: colorfulequalugliess.shop Avira URL Cloud: Label: phishing
Source: https://unhappytidydryypwto.shop:443/api Avira URL Cloud: Label: phishing
Source: turkeyunlikelyofw.shop Avira URL Cloud: Label: malware
Source: https://unhappytidydryypwto.shop/api Avira URL Cloud: Label: phishing
Source: detectordiscusser.shop Avira URL Cloud: Label: malware
Source: https://unhappytidydryypwto.shop/apin:L Avira URL Cloud: Label: phishing
Source: relevantvoicelesskw.shop Avira URL Cloud: Label: phishing
Source: https://unhappytidydryypwto.shop/44 Avira URL Cloud: Label: phishing
Found malware configuration
Source: 0.2.LisectAVT_2403002A_236.exe.3b0000.0.unpack Malware Configuration Extractor: LummaC {"C2 url": ["associationokeo.shop", "turkeyunlikelyofw.shop", "pooreveningfuseor.pw", "edurestunningcrackyow.fun", "detectordiscusser.shop", "relevantvoicelesskw.shop", "colorfulequalugliess.shop", "wisemassiveharmonious.shop", "unhappytidydryypwto.shop"], "Build id": "GjKsB2--"}
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: LisectAVT_2403002A_236.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: associationokeo.shop
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: turkeyunlikelyofw.shop
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: pooreveningfuseor.pw
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: edurestunningcrackyow.fun
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: detectordiscusser.shop
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: relevantvoicelesskw.shop
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: colorfulequalugliess.shop
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: wisemassiveharmonious.shop
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: unhappytidydryypwto.shop
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: Workgroup: -
Source: 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String decryptor: GjKsB2--
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C4F69 CryptUnprotectData, 0_2_003C4F69
Uses 32bit PE files
Source: LisectAVT_2403002A_236.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: LisectAVT_2403002A_236.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: number of queries: 1001
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, dword ptr [esi+00000080h] 0_2_003D3216
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov ecx, dword ptr [esi+00000080h] 0_2_003D3216
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, dword ptr [esi+00000080h] 0_2_003D3216
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, dword ptr [esi+00000080h] 0_2_003D12E2
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then cmp dword ptr [eax-08h], 5C3924FCh 0_2_003C541A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 0_2_003B95E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then lea esi, dword ptr [edx+ecx] 0_2_003CD860
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 0_2_003C390E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov ecx, dword ptr [esi+08h] 0_2_003E2156
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then movzx eax, byte ptr [esi+ecx] 0_2_003BD1C0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then test esi, esi 0_2_003E52C9
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then jmp ecx 0_2_003E3458
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then jmp eax 0_2_003E4489
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov ecx, dword ptr [esi+04h] 0_2_003C05BD
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 0_2_003DD620
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, dword ptr [esp+28h] 0_2_003C561D
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, dword ptr [esi+00000080h] 0_2_003D3216
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov ecx, dword ptr [esi+00000080h] 0_2_003D3216
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, dword ptr [esi+00000080h] 0_2_003D3216
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov ecx, dword ptr [esp+000000A8h] 0_2_003C4810
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then jmp eax 0_2_003C19E7
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then jmp ecx 0_2_003BFA7F
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then jmp ecx 0_2_003BFA72
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then add ecx, dword ptr [esp+eax*4+30h] 0_2_003B7B20
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, dword ptr [003EDC58h] 0_2_003CCB43
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov edi, dword ptr [esi+0Ch] 0_2_003CFB8E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov ecx, dword ptr [esp+10h] 0_2_003CCB80
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, dword ptr [esi+08h] 0_2_003E2C52
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov ecx, dword ptr [esi+00000080h] 0_2_003D0D8E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov ecx, dword ptr [esi+04h] 0_2_003C0E43
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 4x nop then mov eax, edi 0_2_003E4FB2

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: associationokeo.shop
Source: Malware configuration extractor URLs: turkeyunlikelyofw.shop
Source: Malware configuration extractor URLs: pooreveningfuseor.pw
Source: Malware configuration extractor URLs: edurestunningcrackyow.fun
Source: Malware configuration extractor URLs: detectordiscusser.shop
Source: Malware configuration extractor URLs: relevantvoicelesskw.shop
Source: Malware configuration extractor URLs: colorfulequalugliess.shop
Source: Malware configuration extractor URLs: wisemassiveharmonious.shop
Source: Malware configuration extractor URLs: unhappytidydryypwto.shop
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: unhappytidydryypwto.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: unhappytidydryypwto.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 13684Host: unhappytidydryypwto.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 16199Host: unhappytidydryypwto.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20574Host: unhappytidydryypwto.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1379Host: unhappytidydryypwto.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 584281Host: unhappytidydryypwto.shop
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: unhappytidydryypwto.shop
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: unhappytidydryypwto.shop
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1388317441.000000000391C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1361447801.0000000003937000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361401916.000000000393A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361519752.0000000003937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1361447801.0000000003937000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361401916.000000000393A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361519752.0000000003937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1361447801.0000000003937000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361401916.000000000393A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361519752.0000000003937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1361447801.0000000003937000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361401916.000000000393A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361519752.0000000003937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1361447801.0000000003937000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361401916.000000000393A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361519752.0000000003937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1361447801.0000000003937000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361401916.000000000393A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361519752.0000000003937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1361447801.0000000003937000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361401916.000000000393A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361519752.0000000003937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1389454135.0000000003A2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1389454135.0000000003A2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1360508594.0000000001419000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1462122491.00000000013C5000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1372307247.0000000001469000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1360508594.00000000013E1000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1462355021.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000002.1463876472.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1461923804.00000000013D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unhappytidydryypwto.shop/
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1418365611.0000000001466000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1405389775.0000000001465000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unhappytidydryypwto.shop/44
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1410106897.000000000146C000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000002.1464141859.0000000001466000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unhappytidydryypwto.shop/api
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1461606764.0000000001465000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000002.1464141859.0000000001466000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unhappytidydryypwto.shop/api#:
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1461606764.0000000001465000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1387782522.0000000001468000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000002.1464141859.0000000001466000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unhappytidydryypwto.shop/apin:L
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1387782522.0000000001468000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://unhappytidydryypwto.shop:443/api
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1361447801.0000000003937000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361401916.000000000393A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361519752.0000000003937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1361447801.0000000003937000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361401916.000000000393A000.00000004.00000800.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1361519752.0000000003937000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1389454135.0000000003A2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1389454135.0000000003A2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1389454135.0000000003A2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1389454135.0000000003A2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1389454135.0000000003A2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1389454135.0000000003A2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.252:443 -> 192.168.2.9:49712 version: TLS 1.2

System Summary
barindex
Detected VMProtect packer
Source: LisectAVT_2403002A_236.exe Static PE information: .vmp0 and .vmp1 section names
Contains functionality to call native functions
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E6060 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E6060
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C9080 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C9080
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003D20C1 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003D20C1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C4280 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C4280
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C541A NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C541A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E5440 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E5440
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E24B2 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E24B2
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E5640 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E5640
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C46B7 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C46B7
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C56F7 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C56F7
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E27AF NtOpenSection, 0_2_003E27AF
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E27F1 NtMapViewOfSection, 0_2_003E27F1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E67D0 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E67D0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E5810 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E5810
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E286A NtClose, 0_2_003E286A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CD860 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003CD860
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E5940 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E5940
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E2987 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E2987
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E5BD0 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E5BD0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C4D10 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C4D10
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E5D40 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E5D40
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C8E50 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C8E50
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CCF46 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003CCF46
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E0F80 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E0F80
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003DF1E0 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003DF1E0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E1220 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E1220
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C2277 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C2277
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C7305 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C7305
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E6400 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E6400
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E14A0 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E14A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C6492 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C6492
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CC5F0 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003CC5F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C960A NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C960A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E1600 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E1600
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E1710 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E1710
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C2700 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C2700
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CC765 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003CC765
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CA762 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003CA762
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C6790 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C6790
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E1840 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E1840
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CA880 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003CA880
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E1950 NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E1950
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E5AB0 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003E5AB0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C7C59 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C7C59
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E2C52 NtFreeVirtualMemory, 0_2_003E2C52
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C9C41 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003C9C41
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CEDB2 NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003CEDB2
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003D0F04 NtAllocateVirtualMemory,NtFreeVirtualMemory,NtAllocateVirtualMemory,NtFreeVirtualMemory, 0_2_003D0F04
Detected potential crypto function
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E6060 0_2_003E6060
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003D3216 0_2_003D3216
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003D12E2 0_2_003D12E2
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003B4640 0_2_003B4640
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CD860 0_2_003CD860
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CCF46 0_2_003CCF46
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003B51F0 0_2_003B51F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003B3240 0_2_003B3240
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003D2382 0_2_003D2382
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CF3FD 0_2_003CF3FD
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003E6400 0_2_003E6400
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003B64F0 0_2_003B64F0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003CD622 0_2_003CD622
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C960A 0_2_003C960A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003B1700 0_2_003B1700
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003D3216 0_2_003D3216
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_0040F87F 0_2_0040F87F
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C3A27 0_2_003C3A27
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C7A8C 0_2_003C7A8C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003B7B20 0_2_003B7B20
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003B3C60 0_2_003B3C60
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C9C41 0_2_003C9C41
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003BFDB0 0_2_003BFDB0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003D6D8E 0_2_003D6D8E
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003B2E70 0_2_003B2E70
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003B5F30 0_2_003B5F30
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003D0F04 0_2_003D0F04
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003C2F77 0_2_003C2F77
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003DEF80 0_2_003DEF80
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: String function: 003B8560 appears 44 times
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: String function: 003BFF60 appears 154 times
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: String function: 0040B648 appears 35 times
Uses 32bit PE files
Source: LisectAVT_2403002A_236.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: LisectAVT_2403002A_236.exe Binary or memory string: %p.slnB
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372778166.0000000003924000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: LisectAVT_2403002A_236.exe String found in binary or memory: gRAIjEhiRwIjGFyMaK/eUulv3FK6RznFPxa13xzZPGcI8Ndq0kjBPDdM8VeCYp5RRM0+dYlJPh/ADd756Sj6Q6imTq57Sd6eekiPUU7JQT424emp4HFR+4gRT8o4EU/lhCaZMr2BK3bVgyhghLuqtpFxUWpFH1TBljBUZtSeGqeIIGabyB8cwBTUjVEs20rKyuHwHX6O548RE8iltT+VTZlg+tVd+qZNsjAr1Wwebo4o0Uqm7NVKZuzRSGXtgpNJUYaQ
Source: LisectAVT_2403002A_236.exe String found in binary or memory: q1e2Od4OTFHaXYmrA4aKVUmbiQ4n4+MZLmROvnJ6yzezSSPinQzhbMTdDO9znHdTFLV9oT2ILVkKv+VZz7xhndv5l59fQFVfnl4yeuSiVk+jiJVF0Mr52dH/adDcDoEL+0QvC82BBNvNfiDcOPzSbEn8KbKPFXmSz6flFNV+b2z0Z0nzAmDT941n65Rq3W6uUqPdzrn1rqo0ZhPNJhXpCbZX4iwhntgZ3otzlgZDLr9Rw4cWO50llt0fwf/3t/Dz/sxu
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File read: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: LisectAVT_2403002A_236.exe Static file information: File size 5735941 > 1048576
Source: LisectAVT_2403002A_236.exe Static PE information: Raw size of .vmp1 is bigger than: 0x100000 < 0x577c00
Source: LisectAVT_2403002A_236.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .vmp1
PE file contains sections with non-standard names
Source: LisectAVT_2403002A_236.exe Static PE information: section name: .vmp0
Source: LisectAVT_2403002A_236.exe Static PE information: section name: .vmp1
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F704F push esi; ret 0_2_003F7055
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F708D push ebp; ret 0_2_003F70E4
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F5121 push esi; ret 0_2_003F5122
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F72F3 push ebp; ret 0_2_003F72F8
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F62C6 push esi; ret 0_2_003F62DE
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F75D2 push edi; ret 0_2_003F75D4
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F66BB push ebp; ret 0_2_003F66C2
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_0040B68D push ecx; ret 0_2_0040B6A0
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F67F5 push esi; ret 0_2_003F67FE
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F6836 push esi; ret 0_2_003F683C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F889C push ebp; ret 0_2_003F88A1
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F793D push edi; ret 0_2_003F7945
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F6A3B push ebp; ret 0_2_003F6A3C
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F6A39 push ebp; ret 0_2_003F6A3A
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_003F6A33 push esi; ret 0_2_003F6A38
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Code function: 0_2_00409FD0 push ecx; ret 0_2_00409FE3

Hooking and other Techniques for Hiding and Protection
barindex
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Memory written: PID: 6236 base: DF0005 value: E9 8B 2F 75 76 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Memory written: PID: 6236 base: 77542F90 value: E9 7A D0 8A 89 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: LisectAVT_2403002A_236.exe, LisectAVT_2403002A_236.exe, 00000000.00000002.1462827539.00000000003F5000.00000020.00000001.01000000.00000003.sdmp Binary or memory string: ?SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe RDTSC instruction interceptor: First address: 946311 second address: 89BEFD instructions: 0x00000000 rdtsc 0x00000002 rol cl, 1 0x00000004 shrd ax, di, 00000068h 0x00000009 ror al, FFFFFFA0h 0x0000000c add cl, FFFFFFFEh 0x0000000f not dl 0x00000011 mov eax, ebp 0x00000013 lahf 0x00000014 not cl 0x00000016 cwd 0x00000018 dec cl 0x0000001a xor bl, cl 0x0000001c stc 0x0000001d rcr dl, cl 0x0000001f mov eax, dword ptr [esp+ecx] 0x00000022 lea ebp, dword ptr [ebp-00000004h] 0x00000028 bsr edx, ebp 0x0000002b mov dword ptr [ebp+00h], eax 0x0000002f sub edi, 00000004h 0x00000035 shr dx, cl 0x00000038 sub dx, 1519h 0x0000003d mov edx, dword ptr [edi] 0x0000003f cmc 0x00000040 cmp esp, ebp 0x00000042 xor edx, ebx 0x00000044 cmc 0x00000045 rol edx, 02h 0x00000048 stc 0x00000049 cmc 0x0000004a cmp ebx, edi 0x0000004c lea edx, dword ptr [edx+360718EFh] 0x00000052 test ch, FFFFFFB5h 0x00000055 cmp ebx, 53A90A0Dh 0x0000005b stc 0x0000005c not edx 0x0000005e cmp bl, dh 0x00000060 cmp dl, FFFFFFFBh 0x00000063 lea edx, dword ptr [edx+25193D95h] 0x00000069 xor ebx, edx 0x0000006b jmp 00007FC658F8C32Ch 0x00000070 add esi, edx 0x00000072 jmp 00007FC6591E2D61h 0x00000077 lea eax, dword ptr [esp+60h] 0x0000007b cmp ebp, eax 0x0000007d jmp 00007FC6591A71BDh 0x00000082 ja 00007FC65950681Dh 0x00000088 jmp esi 0x0000008a sub edi, 00000001h 0x00000090 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe RDTSC instruction interceptor: First address: 8F202E second address: 8F2042 instructions: 0x00000000 rdtsc 0x00000002 movsx ecx, di 0x00000005 mov ebp, esp 0x00000007 push edi 0x00000008 push esi 0x00000009 inc ecx 0x0000000a dec bx 0x0000000d mov ecx, FFFB0000h 0x00000012 xchg ebp, ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe RDTSC instruction interceptor: First address: 8969E4 second address: 8969ED instructions: 0x00000000 rdtsc 0x00000002 pop ebp 0x00000003 cbw 0x00000005 pop edi 0x00000006 xchg edx, esi 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe RDTSC instruction interceptor: First address: 60051B second address: 60052F instructions: 0x00000000 rdtsc 0x00000002 movsx ecx, di 0x00000005 mov ebp, esp 0x00000007 push edi 0x00000008 push esi 0x00000009 inc ecx 0x0000000a dec bx 0x0000000d mov ecx, FFFB0000h 0x00000012 xchg ebp, ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe RDTSC instruction interceptor: First address: 65CFBC second address: 65CFC5 instructions: 0x00000000 rdtsc 0x00000002 pop ebp 0x00000003 cbw 0x00000005 pop edi 0x00000006 xchg edx, esi 0x00000008 pop ebx 0x00000009 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe TID: 4952 Thread sleep time: -210000s >= -30000s Jump to behavior
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696497155j
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696497155
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1360508594.0000000001408000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1462122491.0000000001407000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000002.1463953963.0000000001409000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1461923804.0000000001407000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696497155o
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1463772710.00000000013AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: LisectAVT_2403002A_236.exe Binary or memory string: 9SDokXWuT7k/o0zmFdI+5yZXyfjdDVtvdBCKQMC7RUN74ZnXXnXfhxjfIuiZlHWLOEZh7yU2OUXaC0KOu1lA7guRD8jUl+YL/jV4e4s8Af3Yf0SL+EH9Nir8/I/6cgr8AuehgFsatiaOZiP5ud66KrfNQakFogGwqi01OGshxNLlXk75qdnYqEmja4bFX50KvIXsUhbKrnbOpHRo5rei0yg1qt3msWkBojOykFtdII2ep8Ti5TC6idfMCnds9Npph6Fq
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.000000000394B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696497155p
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: LisectAVT_2403002A_236.exe Binary or memory string: WtvuF+P406voTx9Wltl3E/5lGVHZO7Qh5ejQhhFihjaCUi6MEor4Vj/NhscRXP5vyZCubEizzJAyXtsIMrKDuopDcRMMFbv6vBv6z++TpP7ZBgP1ako6UXVMcir1+swte3aZvpyZd+T7mVpjZqlgwRH3Ayl5z1nbXp6eqzQwKdul+SvLGL+tLe/jPr5yXn5sujJvEz0PvGAL9aK/teXD3kJlu1LvwMFdtjHsCSYee9T7mpKGgbpYqSMjRK1UvNA3tykU
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1373080900.000000000393D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696497155
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696497155f
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696497155s
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1372974037.0000000003945000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Process information queried: ProcessInformation Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
LummaC encrypted strings found
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: associationokeo.shop
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: turkeyunlikelyofw.shop
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: pooreveningfuseor.pw
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: edurestunningcrackyow.fun
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: detectordiscusser.shop
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: relevantvoicelesskw.shop
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: colorfulequalugliess.shop
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: wisemassiveharmonious.shop
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1462760099.00000000003E7000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: unhappytidydryypwto.shop
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1461606764.0000000001465000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1438996556.0000000001463000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000003.1439136954.0000000001476000.00000004.00000020.00020000.00000000.sdmp, LisectAVT_2403002A_236.exe, 00000000.00000002.1464141859.0000000001466000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: LisectAVT_2403002A_236.exe PID: 6236, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1463595133.00000000010F5000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: 4<d4<d4<Wallets/Electrum-LTC53<C:\Users\user\AppData\Roaming\Electrum-LTC\wallets3p2<%appdata%\Electrum-LTC\wallets<*
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1463595133.00000000010F5000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: 4<d4<d4<Wallets/ElectronCash53<C:\Users\user\AppData\Roaming\ElectronCash\wallets3p2<%appdata%\ElectronCash\wallets<*
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1461923804.00000000013D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1463595133.00000000010F5000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: 1<window-state.json
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1463595133.00000000010F5000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: 4<d4<d4<Wallets/Exodus<C:\Users\user\AppData\Roaming\Exodus\exodus.wallet3p2<%appdata%\Exodus\exodus.wallet<keystoreC
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1462122491.00000000013C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ExodusWeb3
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1463595133.00000000010F5000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: d4<app-store.json<Wallets/BinanceC:\Users\user\AppData\Roaming\Binancep2<%appdata%\Binance mC
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1463595133.00000000010F5000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: d4<Wallets/Ethereum<_lC
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1461923804.00000000013D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: LisectAVT_2403002A_236.exe, 00000000.00000003.1462122491.00000000013C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Source: LisectAVT_2403002A_236.exe, 00000000.00000002.1463595133.00000000010F5000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: 4<d4<d4<Wallets/Ledger Live53<C:\Users\user\AppData\Roaming\Ledger Live*p2<%appdata%\Ledger Live
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001 Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\Application Data\Mozilla\Firefox Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ca4gppea.default\key4.db Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\MNULNCRIYC Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\PSAMNLJHZW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\QVTVNIBKSD Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\FACWLRWHGG Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\MNULNCRIYC Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\PSAMNLJHZW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\QVTVNIBKSD Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\YPSIACHYXW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\ZSSZYEFYMU Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\FACWLRWHGG Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\PSAMNLJHZW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\QVTVNIBKSD Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\ZSSZYEFYMU Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\FACWLRWHGG Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\MNULNCRIYC Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\NHPKIZUUSG Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\PSAMNLJHZW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\QVTVNIBKSD Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\YPSIACHYXW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\ZSSZYEFYMU Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\FACWLRWHGG Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\MNULNCRIYC Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\NHPKIZUUSG Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\PSAMNLJHZW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\YPSIACHYXW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\ZSSZYEFYMU Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\FACWLRWHGG Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\HTAGVDFUIE Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\MNULNCRIYC Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\PSAMNLJHZW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\QVTVNIBKSD Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\VAMYDFPUND Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\YPSIACHYXW Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\ZBEDCJPBEY Jump to behavior
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: C:\Users\user\Documents\ZSSZYEFYMU Jump to behavior
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\Desktop\LisectAVT_2403002A_236.exe Directory queried: number of queries: 1001
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: LisectAVT_2403002A_236.exe PID: 6236, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: LisectAVT_2403002A_236.exe PID: 6236, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482389 Sample: LisectAVT_2403002A_236.exe Startdate: 25/07/2024 Architecture: WINDOWS Score: 100 10 unhappytidydryypwto.shop 2->10 14 Found malware configuration 2->14 16 Antivirus detection for URL or domain 2->16 18 Antivirus / Scanner detection for submitted sample 2->18 20 7 other signatures 2->20 6 LisectAVT_2403002A_236.exe 2->6         started        signatures3 process4 dnsIp5 12 unhappytidydryypwto.shop 104.21.48.252, 443, 49706, 49707 CLOUDFLARENETUS United States 6->12 22 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 6->22 24 Query firmware table information (likely to detect VMs) 6->24 26 Found many strings related to Crypto-Wallets (likely being stolen) 6->26 28 4 other signatures 6->28 signatures6
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.48.252
 unhappytidydryypwto.shop United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
unhappytidydryypwto.shop 104.21.48.252 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
edurestunningcrackyow.fun true
  • Avira URL Cloud: safe
 unknown
unhappytidydryypwto.shop true
  • Avira URL Cloud: phishing
 unknown
pooreveningfuseor.pw true
  • Avira URL Cloud: safe
 unknown
associationokeo.shop true
  • Avira URL Cloud: malware
 unknown
colorfulequalugliess.shop true
  • Avira URL Cloud: phishing
 unknown
turkeyunlikelyofw.shop true
  • Avira URL Cloud: malware
 unknown
detectordiscusser.shop true
  • Avira URL Cloud: malware
 unknown
wisemassiveharmonious.shop true
  • Avira URL Cloud: safe
 unknown
https://unhappytidydryypwto.shop/api false
  • Avira URL Cloud: phishing
 unknown
relevantvoicelesskw.shop true
  • Avira URL Cloud: phishing
 unknown