Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe
Analysis ID: 1500505
MD5: f4d6d6ea62cb666b6fee9d00bdb77350
SHA1: 7e02b9be8a9ab7f3c6f371d2ff930a7de43fa272
SHA256: f1afd0fa63ba265a10d59a7407b0341f7d93ca6a903ad861efb02cfbc6c0d67e
Tags: exe
Infos:

Detection

LummaC
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Yara detected LummaC Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
LummaC encrypted strings found
Sample uses string decryption to hide its real strings
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to read the clipboard data
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Program does not show much activity (idle)
Uses 32bit PE files

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Avira: detected
Antivirus detection for URL or domain
Source: locatedblsoqp.shop Avira URL Cloud: Label: phishing
Source: millyscroqwp.shop Avira URL Cloud: Label: malware
Source: condedqpwqm.shop Avira URL Cloud: Label: phishing
Source: traineiwnqo.shop Avira URL Cloud: Label: malware
Source: caffegclasiqwp.shop Avira URL Cloud: Label: malware
Source: miracledzmnqwui.shop Avira URL Cloud: Label: phishing
Source: stamppreewntnq.shop Avira URL Cloud: Label: phishing
Source: stagedchheiqwo.shop Avira URL Cloud: Label: phishing
Found malware configuration
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Malware Configuration Extractor: LummaC {"C2 url": ["miracledzmnqwui.shop", "millyscroqwp.shop", "evoliutwoqm.shop", "caffegclasiqwp.shop", "traineiwnqo.shop", "locatedblsoqp.shop", "stagedchheiqwo.shop", "stamppreewntnq.shop", "condedqpwqm.shop"], "Build id": "WpM2Co--SUSELL"}
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 96.7% probability
Sample uses string decryption to hide its real strings
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: caffegclasiqwp.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: stamppreewntnq.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: stagedchheiqwo.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: millyscroqwp.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: evoliutwoqm.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: condedqpwqm.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: traineiwnqo.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: locatedblsoqp.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: miracledzmnqwui.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: lid=%s&j=%s&ver=4.0
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: TeslaBrowser/5.5
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: - Screen Resoluton:
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: - Physical Installed Memory:
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: Workgroup: -
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe String decryptor: WpM2Co--SUSELL
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov word ptr [esi], ax 0_2_006B4066
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 0_2_006B4066
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [esp] 0_2_0068B000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [esp] 0_2_006900CB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov byte ptr [eax+02h], 00000000h 0_2_006B2080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [esp] 0_2_00694160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov byte ptr [ecx], al 0_2_00694160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then push 00000000h 0_2_00694160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 0_2_006A0120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then cmp dword ptr [ebx+esi*8], 625B6034h 0_2_0069C1E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then movzx eax, word ptr [esi+ecx] 0_2_006B09A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov word ptr [eax], cx 0_2_0069FA7F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 0_2_006B6250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then jmp edx 0_2_00699A55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov ecx, dword ptr [esp] 0_2_00699A55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 0_2_006A9A30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [esp] 0_2_0069C219
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov ecx, dword ptr [esp+04h] 0_2_0068A2A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov edx, dword ptr [ebp-10h] 0_2_0069EB5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov dword ptr [esi+04h], ecx 0_2_006A3300
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov byte ptr [ebx], al 0_2_006A3300
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov byte ptr [eax], cl 0_2_006A3300
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov byte ptr [edi], al 0_2_006A3BC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov dword ptr [esp], 00000000h 0_2_00692BC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [esi] 0_2_006923AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, ebp 0_2_00686B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, ebp 0_2_00686B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov byte ptr [ecx], al 0_2_006A3C24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [esp+18h] 0_2_00693555
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then cmp byte ptr [edi], 00000000h 0_2_0068EDDF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h 0_2_00698580
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov byte ptr [ecx], al 0_2_006A4D86
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov word ptr [ebx], cx 0_2_00692D9D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov ecx, dword ptr [esp+08h] 0_2_0069E594
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then lea eax, dword ptr [esp+20h] 0_2_0069CE70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then movzx eax, word ptr [ebx] 0_2_006B6E10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov byte ptr [edi], dl 0_2_006A3E16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 0_2_0069AEBD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h 0_2_006B66B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 0_2_006A0710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then cmp byte ptr [esi], 00000000h 0_2_0068EFE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [esp+48h] 0_2_0068EFE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov word ptr [eax], cx 0_2_006987E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov word ptr [esi], cx 0_2_0069A7D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 0_2_0069A7D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov eax, dword ptr [esp] 0_2_00698F9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then cmp byte ptr [edi], 00000000h 0_2_00698F9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then jmp edx 0_2_00698F9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 4x nop then mov ecx, dword ptr [esp] 0_2_00698F9A

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: miracledzmnqwui.shop
Source: Malware configuration extractor URLs: millyscroqwp.shop
Source: Malware configuration extractor URLs: evoliutwoqm.shop
Source: Malware configuration extractor URLs: caffegclasiqwp.shop
Source: Malware configuration extractor URLs: traineiwnqo.shop
Source: Malware configuration extractor URLs: locatedblsoqp.shop
Source: Malware configuration extractor URLs: stagedchheiqwo.shop
Source: Malware configuration extractor URLs: stamppreewntnq.shop
Source: Malware configuration extractor URLs: condedqpwqm.shop
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006A97F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 0_2_006A97F0
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006A97F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 0_2_006A97F0
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B4066 0_2_006B4066
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B5830 0_2_006B5830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00681000 0_2_00681000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0068181C 0_2_0068181C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00694160 0_2_00694160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B5110 0_2_006B5110
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0069C1E0 0_2_0069C1E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006A01C0 0_2_006A01C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00690A4B 0_2_00690A4B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0069CA40 0_2_0069CA40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00699A55 0_2_00699A55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00691220 0_2_00691220
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B2A30 0_2_006B2A30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00684A10 0_2_00684A10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00690B4D 0_2_00690B4D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006A5342 0_2_006A5342
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0069EB5F 0_2_0069EB5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006AEB21 0_2_006AEB21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006A3300 0_2_006A3300
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B6B00 0_2_006B6B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00687BE0 0_2_00687BE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0069DBA2 0_2_0069DBA2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006853B0 0_2_006853B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00686B80 0_2_00686B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006ADB80 0_2_006ADB80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006A3C24 0_2_006A3C24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00683C30 0_2_00683C30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B54E0 0_2_006B54E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0068CC80 0_2_0068CC80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00682480 0_2_00682480
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B5492 0_2_006B5492
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00691D50 0_2_00691D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00693555 0_2_00693555
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0068C510 0_2_0068C510
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0068B5E0 0_2_0068B5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0069CE70 0_2_0069CE70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00685E40 0_2_00685E40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B6E10 0_2_006B6E10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006886F0 0_2_006886F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0069DF69 0_2_0069DF69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0069CF42 0_2_0069CF42
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00687750 0_2_00687750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006A0710 0_2_006A0710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0068EFE0 0_2_0068EFE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0068BFE1 0_2_0068BFE1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_0069A7D8 0_2_0069A7D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B4FB0 0_2_006B4FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00681F98 0_2_00681F98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_00698F9A 0_2_00698F9A
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: String function: 006899A0 appears 105 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: String function: 006891D0 appears 44 times
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal88.troj.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006A8918 CoCreateInstance, 0_2_006A8918
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Section loaded: apphelp.dll Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe API coverage: 7.1 %
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe API call chain: ExitProcess graph end node
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe Code function: 0_2_006B3FA0 LdrInitializeThunk, 0_2_006B3FA0
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion
barindex
LummaC encrypted strings found
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe, 00000000.00000002.2918339800.0000000000D48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: caffegclasiqwp.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe, 00000000.00000002.2918339800.0000000000D48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: stamppreewntnq.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe, 00000000.00000002.2918339800.0000000000D48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: stagedchheiqwo.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe, 00000000.00000002.2918339800.0000000000D48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: millyscroqwp.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe, 00000000.00000002.2918339800.0000000000D48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: evoliutwoqm.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe, 00000000.00000002.2918339800.0000000000D48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: condedqpwqm.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe, 00000000.00000002.2918339800.0000000000D48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: traineiwnqo.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe, 00000000.00000002.2918339800.0000000000D48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: locatedblsoqp.shop
Source: SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe, 00000000.00000002.2918339800.0000000000D48000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: miracledzmnqwui.shop

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.binstr, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.binstr, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1500505 Sample: SecuriteInfo.com.Win32.PWSX... Startdate: 28/08/2024 Architecture: WINDOWS Score: 88 8 Found malware configuration 2->8 10 Antivirus detection for URL or domain 2->10 12 Antivirus / Scanner detection for submitted sample 2->12 14 4 other signatures 2->14 5 SecuriteInfo.com.Win32.PWSX-gen.30515.23037.exe 2->5         started        process3 signatures4 16 LummaC encrypted strings found 5->16
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
miracledzmnqwui.shop true
  • Avira URL Cloud: phishing
 unknown
locatedblsoqp.shop true
  • Avira URL Cloud: phishing
 unknown
caffegclasiqwp.shop true
  • Avira URL Cloud: malware
 unknown
millyscroqwp.shop true
  • Avira URL Cloud: malware
 unknown
stamppreewntnq.shop true
  • Avira URL Cloud: phishing
 unknown
condedqpwqm.shop true
  • Avira URL Cloud: phishing
 unknown
evoliutwoqm.shop true
  • Avira URL Cloud: safe
 unknown
stagedchheiqwo.shop true
  • Avira URL Cloud: phishing
 unknown
traineiwnqo.shop true
  • Avira URL Cloud: malware
 unknown