Edit tour
Windows
Analysis Report
Content Collaboration Terms.dll.exe
Overview
General Information
| Sample name: | Content Collaboration Terms.dll.exe |
| Analysis ID: | 1566965 |
| MD5: | 66dcbe9accf7623c0d0523932c08d686 |
| SHA1: | 2aeb7f8b8e3c3bb13e7e1eb1775d596e9d5471fc |
| SHA256: | 3b04fb9046116e28e410d1ee850bcf2a466dd487ba0103cfaa2a023519465518 |
| Tags: | exeuser-smica83 |
| Infos: |  |
 | |
Detection
LummaC Stealer
| Score: | 87 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for dropped file
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Injects a PE file into a foreign processes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
Content Collaboration Terms.dll.exe (PID: 2072 cmdline: "C:\Users\ user\Deskt op\Content Collabora tion Terms .dll.exe" MD5: 66DCBE9ACCF7623C0D0523932C08D686) 
decrypted_app_1.exe (PID: 5232 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\decryp ted_app_1. exe" MD5: CE5D5ECD5C40EBE7AF638B409566C0E5) 
BitLockerToGo.exe (PID: 1016 cmdline: "C:\Window s\BitLocke rDiscovery VolumeCont ents\BitLo ckerToGo.e xe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)
- cleanup
{"C2 url": ["powerful-avoids.sbs", "disobey-curly.sbs", "blade-govern.sbs", "leg-sate-boat.sbs", "story-tense-faz.sbs", "frogs-severz.sbs", "motion-treesz.sbs", "occupy-blushi.sbs", "spade-noted.cyou"]}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_LummaCStealer_2 | Yara detected LummaC Stealer | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_LummaCStealer_2 | Yara detected LummaC Stealer | Joe Security | ||
| JoeSecurity_LummaCStealer_2 | Yara detected LummaC Stealer | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-02T21:35:17.318515+0100 | 2028371 | 3 | Unknown Traffic | 192.168.2.5 | 49957 | 104.21.20.152 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-02T21:35:20.163053+0100 | 2054653 | 1 | A Network Trojan was detected | 192.168.2.5 | 49957 | 104.21.20.152 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-02T21:35:20.163053+0100 | 2049836 | 1 | A Network Trojan was detected | 192.168.2.5 | 49957 | 104.21.20.152 | 443 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2024-12-02T21:33:15.880583+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.5 | 49708 | 185.209.21.227 | 8297 | TCP |
| 2024-12-02T21:34:51.154321+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.5 | 49901 | 172.67.74.152 | 443 | TCP |
| 2024-12-02T21:34:53.085250+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.5 | 49906 | 34.117.59.81 | 443 | TCP |
| 2024-12-02T21:34:56.348344+0100 | 2803305 | 3 | Unknown Traffic | 192.168.2.5 | 49912 | 172.67.74.152 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Malware Configuration Extractor: | ||
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | String decryptor: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||