Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Launcher.exe

"C:\Users\user\Desktop\Launcher.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2656
Target ID:	0
Parent PID:	1028
Name:	Launcher.exe
Path:	C:\Users\user\Desktop\Launcher.exe
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Size:	552960
MD5:	B7C46F4D20C5A3926DF76E882D2BABE7
Time:	17:49:56
Date:	22/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x9c0000
Modulesize:	577536
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Users\user\Desktop\Launcher.exe

"C:\Users\user\Desktop\Launcher.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6292
Target ID:	3
Parent PID:	2656
Name:	Launcher.exe
Path:	C:\Users\user\Desktop\Launcher.exe
Commandline:	"C:\Users\user\Desktop\Launcher.exe"
Size:	552960
MD5:	B7C46F4D20C5A3926DF76E882D2BABE7
Time:	17:49:57
Date:	22/12/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x9c0000
Modulesize:	577536
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected LummaC Stealer	Stealing of Sensitive Information, Remote Access Functionality
Found many strings related to Crypto-Wallets (likely being stolen)	Stealing of Sensitive Information	Data from Local System
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	2448
Target ID:	1
Parent PID:	2656
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	17:49:56
Date:	22/12/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 600

Details

Is windows:	true
Is dropped:	false
PID:	3480
Target ID:	6
Parent PID:	2656
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 600
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	17:49:57
Date:	22/12/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x720000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png

unknown

https://duckduckgo.com/chrome_newtab

unknown

https://duckduckgo.com/ac/?q=

unknown

https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp

unknown

https://steamcommunity.com/?subsection=broadcasts

unknown

https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.

unknown

https://store.steampowered.com/subscriber_agreement/

unknown

aspecteirs.lat

https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE

unknown

http://www.valvesoftware.com/legal.htm

unknown

https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en

unknown

https://lev-tolstoi.com/urT

unknown

https://community.fastly.steamstatic.com/public/shared/im

unknown

sweepyribs.lat

https://lev-tolstoi.com/S

unknown

https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

unknown

https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6

unknown

sustainskelet.lat

rapeflowwj.lat

https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl

unknown

https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis

unknown

https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC

unknown

https://lev-tolstoi.com/piC

unknown

https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1

unknown

https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&

unknown

https://steamcommunity.com/profiles/76561199724331900

23.55.153.106

https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en

unknown

https://lev-tolstoi.com/

unknown

http://store.steampowered.com/privacy_agreement/

unknown

https://store.steampowered.com/points/shop/

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://crl.rootca1.amazontrust.com/rootca1.crl0

unknown

http://ocsp.rootca1.amazontrust.com0:

unknown

energyaffai.lat

https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a

unknown

https://www.ecosia.org/newtab/

unknown

https://lev-tolstoi.com/apis/d

unknown

https://steamcommunity.com/profiles/76561199724331900/inventory/

unknown

https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br

unknown

https://store.steampowered.com/privacy_agreement/

unknown

https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng

unknown

https://lev-tolstoi.com/api

104.21.66.86

https://lev-tolstoi.com:443/apil

unknown

https://lev-tolstoi.com:443/apii

unknown

https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am

unknown

https://www.google.com/recaptcha/

unknown

https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref

unknown

https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477

unknown

https://store.steampo

unknown

grannyejh.lat

https://store.steampowered.com/;

unknown

https://store.steampowered.com/about/

unknown

https://steamcommunity.com/my/wishlist/

unknown

https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&

unknown

https://lev-tolstoi.com/er

unknown

necklacebudi.lat

https://help.steampowered.com/en/

unknown

https://steamcommunity.com/market/

unknown

https://store.steampowered.com/news/

unknown

https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi

unknown

https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

http://store.steampowered.com/subscriber_agreement/

unknown

https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org

unknown

https://recaptcha.net/recaptcha/;

unknown

https://lev-tolstoi.com/uo

unknown

https://lev-tolstoi.com/apis

unknown

https://steamcommunity.com/discussions/

unknown

https://store.steampowered.com/stats/

unknown

https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am

unknown

https://medal.tv

unknown

https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png

unknown

https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a

unknown

https://store.steampowered.com/steam_refunds/

unknown

http://x1.c.lencr.org/0

unknown

http://x1.i.lencr.org/0

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a

unknown

https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900

unknown

https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016

unknown

crosshuaht.lat

https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e

unknown

https://steamcommunity.com/workshop/

unknown

https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb

unknown

https://support.mozilla.org/products/firefoxgro.all

unknown

https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c

unknown

https://store.steampowered.com/legal/

unknown

https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en

unknown

https://grannyejh.lat:443/api_f

unknown

https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng

unknown

https://lev-tolstoi.com/api=

unknown

https://lev-tolstoi.com/pS

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

https://lev-tolstoi.com/5

unknown

https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a

unknown

https://lev-tolstoi.com/3

unknown

https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl

unknown

https://lev-tolstoi.com/apiC

unknown

https://lev-tolstoi.com/api1

unknown

http://upx.sf.net

unknown

There are 90 hidden URLs, click here to show them.

Domains

Name

Malicious

sustainskelet.lat

unknown

crosshuaht.lat

unknown

energyaffai.lat

unknown

necklacebudi.lat

unknown

steamcommunity.com

23.55.153.106

lev-tolstoi.com

104.21.66.86

rapeflowwj.lat

unknown

grannyejh.lat

unknown

aspecteirs.lat

unknown

sweepyribs.lat

unknown

discokeyus.lat

unknown

There are 1 hidden domains, click here to show them.

IPs

Domain

Country

Malicious

104.21.66.86

lev-tolstoi.com

United States

Details

IP:	104.21.66.86
TargetID:	3
Current Path:	C:\Users\user\Desktop\Launcher.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	lev-tolstoi.com

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

23.55.153.106

steamcommunity.com

United States

Details

IP:	23.55.153.106
TargetID:	3
Current Path:	C:\Users\user\Desktop\Launcher.exe
Country:	United States
Countrycode:	USA
ASN number:	20940
ASN name:	AKAMAI-ASN1EU
Private:	false
Domain:	steamcommunity.com

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking