Edit tour

Windows Analysis Report
v_dolg.exe

Overview

General Information

Sample name:	v_dolg.exe
Analysis ID:	1577367
MD5:	378706614b22957208e09fc84fceece8
SHA1:	d35e1f89f36aed26553b665f791cd69d82136fb8
SHA256:	df6e6d5bead4aa34f8e0dd325400a5829265b0f615cd1da48d155cc30b89ad6d
Tags:	18521511316185215113209bulletproofexeuser-abus3reports
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for sample

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

v_dolg.exe (PID: 7628 cmdline: "C:\Users\user\Desktop\v_dolg.exe" MD5: 378706614B22957208E09FC84FCEECE8)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["impend-differ.biz", "print-vexer.biz", "se-blurry.biz", "dare-curbys.biz", "zinc-sneark.biz", "covery-mover.biz", "dwell-exclaim.biz", "formy-spill.biz"], "Build id": "7Tl6Mk--legeng"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:23.274508+0100	2028371	3	Unknown Traffic	192.168.2.7	49803	23.55.153.106	443	TCP
2024-12-18T12:42:25.743411+0100	2028371	3	Unknown Traffic	192.168.2.7	49812	172.67.157.254	443	TCP
2024-12-18T12:42:27.328996+0100	2028371	3	Unknown Traffic	192.168.2.7	49818	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:26.550676+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49812	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:26.550676+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49812	172.67.157.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:20.566681+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.7	54422	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:19.428975+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.7	60017	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:20.123421+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.7	56217	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:20.338320+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.7	49547	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:21.039707+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.7	56912	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:20.804369+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.7	64276	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:19.669772+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.7	61833	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:19.906169+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.7	52213	1.1.1.1	53	UDP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:42:24.067183+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	49803	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: v_dolg.exe

Avira: detected

Found malware configuration

Source: 1.2.v_dolg.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["impend-differ.biz", "print-vexer.biz", "se-blurry.biz", "dare-curbys.biz", "zinc-sneark.biz", "covery-mover.biz", "dwell-exclaim.biz", "formy-spill.biz"], "Build id": "7Tl6Mk--legeng"}

Multi AV Scanner detection for submitted file

Source: v_dolg.exe

ReversingLabs: Detection: 81%

Machine Learning detection for sample

Source: v_dolg.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: impend-differ.biz
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: print-vexer.biz
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dare-curbys.biz
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: covery-mover.biz
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: formy-spill.biz
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: zinc-sneark.biz
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: se-blurry.biz
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: dare-curbys.biz
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000001.00000002.1864723985.0000000000401000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 7Tl6Mk--legeng

Source: v_dolg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.7:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49812 version: TLS 1.2

Source:

Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: v_dolg.exe, 00000001.00000002.1864723985.000000000044E000.00000040.00000001.01000000.00000003.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.7:52213 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.7:52213 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.7:49547 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.7:49547 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.7:56912 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.7:64276 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.7:56912 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.7:64276 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.7:61833 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.7:61833 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.7:56217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.7:56217 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.7:60017 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.7:60017 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.7:54422 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.7:54422 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49812 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49812 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:49803 -> 23.55.153.106:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: formy-spill.biz

Source: Joe Sandbox View

IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49812 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49818 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49803 -> 23.55.153.106:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: / https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=740ec1569cb3c9fe2d825efd; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 18 Dec 2024 11:42:23 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: user-PC\user/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: NoClassInfo CLSID:{0000032A-0000-0000-C000-000000000046} Flags:17 IID:{00000000-0000-0000-C000-000000000046}tps://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=740ec1569cb3c9fe2d825efd; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 18 Dec 2024 11:42:23 GMTDateProxy-Con equals www.youtube.com (Youtube)
Source: v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tps://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: dare-curbys.biz
Source: global traffic	DNS traffic detected: DNS query: se-blurry.biz
Source: global traffic	DNS traffic detected: DNS query: zinc-sneark.biz
Source: global traffic	DNS traffic detected: DNS query: dwell-exclaim.biz
Source: global traffic	DNS traffic detected: DNS query: formy-spill.biz
Source: global traffic	DNS traffic detected: DNS query: covery-mover.biz
Source: global traffic	DNS traffic detected: DNS query: print-vexer.biz
Source: global traffic	DNS traffic detected: DNS query: impend-differ.biz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fas
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=0Xxx
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=kOc26QwM0vlX&l=e
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impend-differ.biz/api
Source: v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: v_dolg.exe, 00000001.00000002.1866244212.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/Y
Source: v_dolg.exe, 00000001.00000002.1866244212.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/a
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000002.1866244212.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: v_dolg.exe, 00000001.00000002.1866244212.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiO
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiZ;I
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.7:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49812 version: TLS 1.2

Source: v_dolg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@10/2

Source: C:\Users\user\Desktop\v_dolg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: v_dolg.exe

ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\v_dolg.exe

File read: C:\Users\user\Desktop\v_dolg.exe

Jump to behavior

Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: v_dolg.exe

Static file information: File size 3794944 > 1048576

Source: v_dolg.exe

Static PE information: Raw size of .MPRESS1 is bigger than: 0x100000 < 0x35b400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\v_dolg.exe

Unpacked PE file: 1.2.v_dolg.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: v_dolg.exe	Static PE information: section name: .MPRESS1
Source: v_dolg.exe	Static PE information: section name: .MPRESS2

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\v_dolg.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Window searched: window name: RegmonClass	Jump to behavior

Source: C:\Users\user\Desktop\v_dolg.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\v_dolg.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\v_dolg.exe	API/Special instruction interceptor: Address: B5257A
Source: C:\Users\user\Desktop\v_dolg.exe	API/Special instruction interceptor: Address: ABF6BE

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\v_dolg.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\v_dolg.exe

Special instruction interceptor: First address: 60D88F instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\v_dolg.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\v_dolg.exe TID: 7944	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe TID: 7944	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\v_dolg.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: v_dolg.exe, 00000001.00000003.1392757468.0000000000E00000.00000004.00001000.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1392867189.0000000000E00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: v_dolg.exe, 00000001.00000003.1393199475.0000000000E00000.00000004.00001000.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1393317550.0000000000E00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__
Source: v_dolg.exe, 00000001.00000002.1865967070.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: v_dolg.exe, 00000001.00000003.1392972449.0000000000E00000.00000004.00001000.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1393088337.0000000000E00000.00000004.00001000.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1393423549.0000000000E00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__

Source: C:\Users\user\Desktop\v_dolg.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\v_dolg.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\v_dolg.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\v_dolg.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\v_dolg.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\v_dolg.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\v_dolg.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\v_dolg.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\v_dolg.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\v_dolg.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\v_dolg.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\v_dolg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\v_dolg.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Users\user\Desktop\v_dolg.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\v_dolg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	OS Credential Dumping	721 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Software Packing	LSASS Memory	33 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	114 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	223 System Information Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
v_dolg.exe	82%	ReversingLabs	Win32.Trojan.Casdet
v_dolg.exe	100%	Avira	HEUR/AGEN.1314118
v_dolg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://lev-tolstoi.com/Y	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/api	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/	0%	Avira URL Cloud	safe
https://community.fas	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/a	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apiO	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apiZ;I	0%	Avira URL Cloud	safe
https://lev-tolstoi.com:443/api	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
dare-curbys.biz	unknown	unknown	false	high
impend-differ.biz	unknown	unknown	false	high
se-blurry.biz	unknown	unknown	false	high
zinc-sneark.biz	unknown	unknown	false	high
print-vexer.biz	unknown	unknown	false	high
dwell-exclaim.biz	unknown	unknown	false	high
covery-mover.biz	unknown	unknown	false	high
formy-spill.biz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	false		high
formy-spill.biz	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
https://lev-tolstoi.com/api	true	Avira URL Cloud: safe	unknown
print-vexer.biz	false		high
impend-differ.biz	false		high
dwell-exclaim.biz	false		high
zinc-sneark.biz	false		high
se-blurry.biz	false		high
covery-mover.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.vimeo.com	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/Y	v_dolg.exe, 00000001.00000002.1866244212.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=0Xxx	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/a	v_dolg.exe, 00000001.00000002.1866244212.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/privacy_agreement/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://impend-differ.biz/api	v_dolg.exe, 00000001.00000002.1865967070.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fas	v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/my/wishlist/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=kOc26QwM0vlX&l=e	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	v_dolg.exe, 00000001.00000003.1833371640.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiZ;I	v_dolg.exe, 00000001.00000002.1865967070.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:27060	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	v_dolg.exe, 00000001.00000002.1865967070.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/api	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	v_dolg.exe, 00000001.00000002.1865967070.0000000000EEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiO	v_dolg.exe, 00000001.00000002.1866244212.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1864150774.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/	v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	v_dolg.exe, 00000001.00000003.1856564409.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000001.00000003.1833331428.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577367
Start date and time:	2024-12-18 12:40:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	v_dolg.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@10/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: v_dolg.exe

Simulations

Behavior and APIs

Time	Type	Description
06:42:19	API Interceptor	10x Sleep call for process: v_dolg.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.157.254	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse
	ardware-v1.exe	Get hash	malicious	LummaC	Browse
	https://t.co/nq9BYOxCg9	Get hash	malicious	HTMLPhisher	Browse
23.55.153.106	cccc2.exe	Get hash	malicious	LummaC	Browse
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse
	99awhy8l.exe	Get hash	malicious	LummaC	Browse
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse
	ardware-v1.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	172.67.157.254
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
s-part-0035.t-0009.t-msedge.net	Setup2.exe	Get hash	malicious	Cryptbot	Browse	13.107.246.63
	clcs.exe	Get hash	malicious	Cryptbot	Browse	13.107.246.63
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	stealc_default2.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63
	F1TwARdSKB.js	Get hash	malicious	Mint Stealer	Browse	13.107.246.63
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	13.107.246.63
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	13.107.246.63
	https://syndiclair-my.sharepoint.com/:o:/g/personal/ml_syndiclair_fr/En8EbZMYpZ5CodZQ05mt4IMBGZHEHcSylnIeMh0DoULmZw?e=UkXb4Y	Get hash	malicious	Unknown	Browse	13.107.246.63
	Cb89Ti1Mib.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	WErY5oc4hl.ps1	Get hash	malicious	XWorm	Browse	13.107.246.63
steamcommunity.com	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	cccc2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	23.44.201.32
CLOUDFLARENETUS	winrar-x64-701.exe	Get hash	malicious	Unknown	Browse	104.21.80.99
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	winrar-x64-701.exe	Get hash	malicious	Unknown	Browse	172.67.177.42
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	104.21.23.76
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.64.80
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	172.66.0.145
	https://www.ispringsolutions.com/ispring-suite	Get hash	malicious	Unknown	Browse	104.21.80.1
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	104.21.66.86

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	winrar-x64-701.exe	Get hash	malicious	Unknown	Browse	172.67.157.254 23.55.153.106
	cccc2.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	CompleteStudio.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	winrar-x64-701.exe	Get hash	malicious	Unknown	Browse	172.67.157.254 23.55.153.106
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	172.67.157.254 23.55.153.106
	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.157.254 23.55.153.106
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106

File type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Entropy (8bit):	7.956425596190051
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	v_dolg.exe
File size:	3'794'944 bytes
MD5:	378706614b22957208e09fc84fceece8
SHA1:	d35e1f89f36aed26553b665f791cd69d82136fb8
SHA256:	df6e6d5bead4aa34f8e0dd325400a5829265b0f615cd1da48d155cc30b89ad6d
SHA512:	bef7a09ce1ffd0a0b169a6ec7c143ca322c929139ca0af40353502ae22fed455fe10a9b80ba93cc399a88add94f921b7aa801033ddae351f8f8d477781ca476e
SSDEEP:	98304:SaBCZwNZbJRa6YuWjsnxks5HqRhzYc/D2iBTF:SaMwP3YuWwxks5HQD2iz
TLSH:	CD0633C25851A6A9E8348571EFD16D447F933C3A86E024DD338EBB2F1633D09E82DA5D
File Content Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L.....Lg.....................J....................@.................................:):..................................................".................................................

File Icon


Icon Hash:	4cda84868282c655

Static PE Info

General

Entrypoint:	0xc09193
Entrypoint Section:	.MPRESS2
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x674CEE8B [Sun Dec 1 23:17:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	065136716995edc1d4927c94cbed78e4

Entrypoint Preview

Instruction
pushad
call 00007FCCF86BD975h
pop eax
add eax, 00000B5Ah
mov esi, dword ptr [eax]
add esi, eax
sub eax, eax
mov edi, esi
lodsw
shl eax, 0Ch
mov ecx, eax
push eax
lodsd
sub ecx, eax
add esi, ecx
mov ecx, eax
push edi
push ecx
dec ecx
mov al, byte ptr [ecx+edi+06h]
mov byte ptr [ecx+esi], al
jne 00007FCCF86BD968h
sub eax, eax
lodsb
mov ecx, eax
and cl, FFFFFFF0h
and al, 0Fh
shl ecx, 0Ch
mov ch, al
lodsb
or ecx, eax
push ecx
add cl, ch
mov ebp, FFFFFD00h
shl ebp, cl
pop ecx
pop eax
mov ebx, esp
lea esp, dword ptr [esp+ebp*2-00000E70h]
push ecx
sub ecx, ecx
push ecx
push ecx
mov ecx, esp
push ecx
mov dx, word ptr [edi]
shl edx, 0Ch
push edx
push edi
add ecx, 04h
push ecx
push eax
add ecx, 04h
push esi
push ecx
call 00007FCCF86BD9D3h
mov esp, ebx
pop esi
pop edx
sub eax, eax
mov dword ptr [edx+esi], eax
mov ah, 10h
sub edx, eax
sub ecx, ecx
cmp ecx, edx
jnc 00007FCCF86BD998h
mov ebx, ecx
lodsb
inc ecx
and al, FEh
cmp al, E8h
jne 00007FCCF86BD964h
inc ebx
add ecx, 04h
lodsd
or eax, eax
js 00007FCCF86BD978h
cmp eax, edx
jnc 00007FCCF86BD957h
jmp 00007FCCF86BD978h
add eax, ebx
js 00007FCCF86BD951h
add eax, edx
sub eax, ebx
mov dword ptr [esi-04h], eax
jmp 00007FCCF86BD948h
call 00007FCCF86BD975h
pop edi
add edi, FFFFFF4Dh
mov al, E9h
stosb
mov eax, 00000B56h
stosd
call 00007FCCF86BD975h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x809000	0x194	.MPRESS2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80a000	0x42298	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8090a0	0x30	.MPRESS2
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.MPRESS1	0x1000	0x808000	0x35b400	d118ce912664cfba526b69922019528c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.MPRESS2	0x809000	0xcfd	0xe00	18347266d68828049842b746fe81a525	False	0.5426897321428571	data	5.764746466183774	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x80a000	0x42298	0x42400	d8123a250cc7d48bb4b2b2ca040ec254	False	0.5552660672169811	data	6.099574294470979	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x79f988	0x22dfa	empty	English	Ireland	0
RT_ICON	0x80a110	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.5921669793621013
RT_ICON	0x80b1e0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.46303731695795936
RT_ICON	0x80f430	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.3523896841358098
RT_ICON	0x81fc80	0xc009	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9946095482191167
RT_ICON	0x82bcb4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.47373358348968103
RT_ICON	0x82cd84	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.34346953235710914
RT_ICON	0x830fd4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.2791612445285697
RT_ICON	0x841824	0x9455	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.99146762173123
RT_MENU	0x8031d8	0x4a	empty	English	United States	0
RT_DIALOG	0x803224	0xea	empty	English	United States	0
RT_STRING	0x803310	0x9c	empty			0
RT_ACCELERATOR	0x8033ac	0x10	empty	English	United States	0
RT_GROUP_ICON	0x84adc4	0x3e	data	English	United States	0.8225806451612904
RT_GROUP_ICON	0x84ae2c	0x3e	data	English	United States	0.8709677419354839
RT_MANIFEST	0x84aeac	0xe3b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.38594564919022784
None	0x804278	0xb	empty	French	France	0
None	0x804284	0x103	empty	French	France	0
None	0x804388	0x78f	empty	French	France	0
None	0x804b18	0x4b	empty	French	France	0
None	0x804b64	0x238	empty	French	France	0
None	0x804d9c	0x238	empty	French	France	0
None	0x804fd4	0x48	empty	French	France	0
None	0x80501c	0x244	empty	French	France	0
None	0x805260	0x153	empty	French	France	0
None	0x8053b4	0x305	empty	French	France	0
None	0x8056bc	0x153	empty	French	France	0
None	0x805810	0x353	empty	French	France	0
None	0x805b64	0x305	empty	French	France	0
None	0x805e6c	0x13c	empty	French	France	0
None	0x805fa8	0x238	empty	French	France	0
None	0x8061e0	0x208	empty	French	France	0
None	0x8063e8	0x238	empty	French	France	0
None	0x806620	0x238	empty	French	France	0
None	0x806858	0x208	empty	French	France	0
None	0x806a60	0x238	empty			0
None	0x806c98	0x553	empty			0
None	0x8071ec	0x153	empty	French	France	0
None	0x807340	0x10d	empty	French	France	0
None	0x807450	0x238	empty	French	France	0
None	0x807688	0x238	empty	French	France	0
None	0x8078c0	0x107	empty			0
None	0x8079c8	0x11d	empty	French	France	0
None	0x807ae8	0x252	empty	French	France	0
None	0x807d3c	0x46e	empty			0
None	0x8081ac	0x25e	empty	French	France	0

Imports

DLL	Import
KERNEL32.DLL	GetModuleHandleA, GetProcAddress
SHELL32.dll	SHEmptyRecycleBinW
USER32.dll	CloseClipboard
GDI32.dll	BitBlt
ole32.dll	CoCreateInstance
OLEAUT32.dll	SysAllocString

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Ireland
English	United States
French	France

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T12:42:19.428975+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.7	60017	1.1.1.1	53	UDP
2024-12-18T12:42:19.428975+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.7	60017	1.1.1.1	53	UDP
2024-12-18T12:42:19.669772+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.7	61833	1.1.1.1	53	UDP
2024-12-18T12:42:19.669772+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.7	61833	1.1.1.1	53	UDP
2024-12-18T12:42:19.906169+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.7	52213	1.1.1.1	53	UDP
2024-12-18T12:42:19.906169+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.7	52213	1.1.1.1	53	UDP
2024-12-18T12:42:20.123421+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.7	56217	1.1.1.1	53	UDP
2024-12-18T12:42:20.123421+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.7	56217	1.1.1.1	53	UDP
2024-12-18T12:42:20.338320+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.7	49547	1.1.1.1	53	UDP
2024-12-18T12:42:20.338320+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.7	49547	1.1.1.1	53	UDP
2024-12-18T12:42:20.566681+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.7	54422	1.1.1.1	53	UDP
2024-12-18T12:42:20.566681+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.7	54422	1.1.1.1	53	UDP
2024-12-18T12:42:20.804369+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.7	64276	1.1.1.1	53	UDP
2024-12-18T12:42:20.804369+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.7	64276	1.1.1.1	53	UDP
2024-12-18T12:42:21.039707+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.7	56912	1.1.1.1	53	UDP
2024-12-18T12:42:21.039707+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.7	56912	1.1.1.1	53	UDP
2024-12-18T12:42:23.274508+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49803	23.55.153.106	443	TCP
2024-12-18T12:42:24.067183+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	49803	23.55.153.106	443	TCP
2024-12-18T12:42:25.743411+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49812	172.67.157.254	443	TCP
2024-12-18T12:42:26.550676+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49812	172.67.157.254	443	TCP
2024-12-18T12:42:26.550676+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49812	172.67.157.254	443	TCP
2024-12-18T12:42:27.328996+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49818	172.67.157.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 12:42:21.442981958 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:21.443028927 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:21.443154097 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:21.867121935 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:21.867161989 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:23.274432898 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:23.274507999 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:23.277910948 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:23.277921915 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:23.278445005 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:23.328784943 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:23.402107954 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:23.447330952 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.067215919 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.067254066 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.067275047 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.067281961 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.067291975 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:24.067328930 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.067342997 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.067358017 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:24.067384005 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:24.251418114 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.251462936 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.251522064 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:24.251535892 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.251580954 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:24.282643080 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.282684088 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.282752037 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.282757998 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:24.282808065 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:24.284904003 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:24.284925938 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.284935951 CET	49803	443	192.168.2.7	23.55.153.106
Dec 18, 2024 12:42:24.284945011 CET	443	49803	23.55.153.106	192.168.2.7
Dec 18, 2024 12:42:24.527812004 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:24.527861118 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:24.527941942 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:24.528372049 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:24.528383970 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:25.743268967 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:25.743411064 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:25.745181084 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:25.745191097 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:25.745518923 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:25.746906042 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:25.746931076 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:25.746989965 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:26.550694942 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:26.550808907 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:26.550880909 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:26.609246969 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:26.609282017 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:26.609301090 CET	49812	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:26.609311104 CET	443	49812	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:26.700205088 CET	49818	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:26.700258017 CET	443	49818	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:26.700319052 CET	49818	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:26.700659990 CET	49818	443	192.168.2.7	172.67.157.254
Dec 18, 2024 12:42:26.700674057 CET	443	49818	172.67.157.254	192.168.2.7
Dec 18, 2024 12:42:27.328995943 CET	49818	443	192.168.2.7	172.67.157.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 12:42:19.428975105 CET	60017	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:19.659269094 CET	53	60017	1.1.1.1	192.168.2.7
Dec 18, 2024 12:42:19.669771910 CET	61833	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:19.902348995 CET	53	61833	1.1.1.1	192.168.2.7
Dec 18, 2024 12:42:19.906168938 CET	52213	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:20.119478941 CET	53	52213	1.1.1.1	192.168.2.7
Dec 18, 2024 12:42:20.123420954 CET	56217	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:20.336042881 CET	53	56217	1.1.1.1	192.168.2.7
Dec 18, 2024 12:42:20.338320017 CET	49547	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:20.563527107 CET	53	49547	1.1.1.1	192.168.2.7
Dec 18, 2024 12:42:20.566680908 CET	54422	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:20.796161890 CET	53	54422	1.1.1.1	192.168.2.7
Dec 18, 2024 12:42:20.804368973 CET	64276	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:21.036007881 CET	53	64276	1.1.1.1	192.168.2.7
Dec 18, 2024 12:42:21.039706945 CET	56912	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:21.280718088 CET	53	56912	1.1.1.1	192.168.2.7
Dec 18, 2024 12:42:21.284678936 CET	53279	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:21.422137976 CET	53	53279	1.1.1.1	192.168.2.7
Dec 18, 2024 12:42:24.295784950 CET	50622	53	192.168.2.7	1.1.1.1
Dec 18, 2024 12:42:24.526597977 CET	53	50622	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 12:42:19.428975105 CET	192.168.2.7	1.1.1.1	0x52cf	Standard query (0)	dare-curbys.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:19.669771910 CET	192.168.2.7	1.1.1.1	0x182e	Standard query (0)	se-blurry.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:19.906168938 CET	192.168.2.7	1.1.1.1	0xf498	Standard query (0)	zinc-sneark.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:20.123420954 CET	192.168.2.7	1.1.1.1	0x7b46	Standard query (0)	dwell-exclaim.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:20.338320017 CET	192.168.2.7	1.1.1.1	0xb3c5	Standard query (0)	formy-spill.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:20.566680908 CET	192.168.2.7	1.1.1.1	0x2a9f	Standard query (0)	covery-mover.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:20.804368973 CET	192.168.2.7	1.1.1.1	0xd84	Standard query (0)	print-vexer.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:21.039706945 CET	192.168.2.7	1.1.1.1	0x13a3	Standard query (0)	impend-differ.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:21.284678936 CET	192.168.2.7	1.1.1.1	0xa775	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:24.295784950 CET	192.168.2.7	1.1.1.1	0xd650	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 12:41:35.402585030 CET	1.1.1.1	192.168.2.7	0x4b3d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 12:41:35.402585030 CET	1.1.1.1	192.168.2.7	0x4b3d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:19.659269094 CET	1.1.1.1	192.168.2.7	0x52cf	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:19.902348995 CET	1.1.1.1	192.168.2.7	0x182e	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:20.119478941 CET	1.1.1.1	192.168.2.7	0xf498	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:20.336042881 CET	1.1.1.1	192.168.2.7	0x7b46	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:20.563527107 CET	1.1.1.1	192.168.2.7	0xb3c5	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:20.796161890 CET	1.1.1.1	192.168.2.7	0x2a9f	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:21.036007881 CET	1.1.1.1	192.168.2.7	0xd84	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:21.280718088 CET	1.1.1.1	192.168.2.7	0x13a3	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:21.422137976 CET	1.1.1.1	192.168.2.7	0xa775	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:24.526597977 CET	1.1.1.1	192.168.2.7	0xd650	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:42:24.526597977 CET	1.1.1.1	192.168.2.7	0xd650	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49803	23.55.153.106	443	7628	C:\Users\user\Desktop\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:42:23 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-18 11:42:24 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 18 Dec 2024 11:42:23 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=740ec1569cb3c9fe2d825efd; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-18 11:42:24 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-18 11:42:24 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-18 11:42:24 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49812	172.67.157.254	443	7628	C:\Users\user\Desktop\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:42:25 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-18 11:42:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 11:42:26 UTC	1040	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:42:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=btfu3tl4614gdk97j3fad53brk; expires=Sun, 13-Apr-2025 05:29:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VvsMc16m%2BfFjiNr3LynJEWvbFDleM%2FIw4q4O9U7xLg5r%2BCSNGklDmkyQi0CZapPaSP5rh1%2By0yx3GjTHhbUHPxMSehplGfJ2p9bcWOW%2B%2BiRP0W7rP3EiOfZKbQWZQfoI3Vw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ee3b49b7ac47a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1508&min_rtt=1499&rtt_var=580&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1858688&cwnd=244&unsent_bytes=0&cid=f5b578e14fd65fac&ts=818&x=0"
2024-12-18 11:42:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 11:42:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	06:41:37
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\v_dolg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\v_dolg.exe"
Imagebase:	0x400000
File size:	3'794'944 bytes
MD5 hash:	378706614B22957208E09FC84FCEECE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report v_dolg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
v_dolg.exe