Windows Analysis Report
https://finalstepgo.com/uploads/il2.txt

Overview

General Information

Sample URL: https://finalstepgo.com/uploads/il2.txt
Analysis ID: 1519577
Infos:

Detection

LummaC
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
Downloads suspicious files via Chrome
LummaC encrypted strings found
Sample uses string decryption to hide its real strings
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: https://finalstepgo.com/uploads/il2.txt Avira URL Cloud: detection malicious, Label: malware
Antivirus detection for URL or domain
Source: https://finalstepgo.com/favicon.ico Avira URL Cloud: Label: malware
Source: pumpkinkwquo.shop Avira URL Cloud: Label: malware
Source: deallyharvenw.shop Avira URL Cloud: Label: malware
Source: covvercilverow.shop Avira URL Cloud: Label: malware
Source: https://finalstepgo.com/uploads/il222.zip Avira URL Cloud: Label: malware
Source: abortinoiwiam.shop Avira URL Cloud: Label: malware
Source: https://racedsuitreow.shop/apib Avira URL Cloud: Label: malware
Source: defenddsouneuw.shop Avira URL Cloud: Label: malware
Source: https://racedsuitreow.shop/w Avira URL Cloud: Label: malware
Source: priooozekw.shop Avira URL Cloud: Label: malware
Source: https://racedsuitreow.shop/ Avira URL Cloud: Label: malware
Source: surroundeocw.shop Avira URL Cloud: Label: malware
Source: https://racedsuitreow.shop/api Avira URL Cloud: Label: malware
Source: racedsuitreow.shop Avira URL Cloud: Label: malware
Source: https://racedsuitreow.shop/_ Avira URL Cloud: Label: malware
Source: candleduseiwo.shop Avira URL Cloud: Label: malware
Source: https://racedsuitreow.shop/api4 Avira URL Cloud: Label: malware
Source: https://racedsuitreow.shop/api6 Avira URL Cloud: Label: malware
Found malware configuration
Source: PrivacyDrive.exe.364.19.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["abortinoiwiam.shop", "racedsuitreow.shop", "covvercilverow.shop", "pumpkinkwquo.shop", "candleduseiwo.shop", "defenddsouneuw.shop", "priooozekw.shop", "deallyharvenw.shop", "surroundeocw.shop"], "Build id": "yJEcaG--rui1222"}
Sample uses string decryption to hide its real strings
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: covvercilverow.shop
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: surroundeocw.shop
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: abortinoiwiam.shop
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: pumpkinkwquo.shop
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: priooozekw.shop
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: deallyharvenw.shop
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: defenddsouneuw.shop
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: racedsuitreow.shop
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: candleduseiwo.shop
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: Workgroup: -
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp String decryptor: yJEcaG--rui1222
Source: https://finalstepgo.com/uploads/il2.txt HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.29.10:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.23.209.181:443 -> 192.168.2.17:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.221:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.221:443 -> 192.168.2.17:49739 version: TLS 1.2
Source: Binary string: F:\PD3\bin\Release\PrivacyDrive.pdb source: PrivacyDrive.exe, 00000013.00000000.1876072666.0000000000552000.00000002.00000001.01000000.00000006.sdmp, PrivacyDrive.exe, 00000013.00000003.1953924428.0000000005ABA000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: F:\PD3\bin\Release\PrivacyDrive.pdbN source: PrivacyDrive.exe, 00000013.00000000.1876072666.0000000000552000.00000002.00000001.01000000.00000006.sdmp, PrivacyDrive.exe, 00000013.00000003.1953924428.0000000005ABA000.00000004.00000800.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-54h] 19_2_01032132
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-18h] 19_2_0103D134
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-18h] 19_2_0103D0CE
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx edx, byte ptr [ecx+eax] 19_2_010211B2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_0102600C
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_01026013
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h 19_2_01038312
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_0102539E
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_0105B3B2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh 19_2_010563F2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_01044215
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_01044215
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh 19_2_01055272
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 19_2_0104C282
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_0104429B
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_0104429B
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_0105C2B2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_010582BB
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_010512FC
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h 19_2_010512FC
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_0103F577
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov word ptr [eax], cx 19_2_01038582
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-54h] 19_2_010325AE
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+00000744h] 19_2_010445CB
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_010445CB
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_010445CB
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-54h] 19_2_01032403
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx ebp, word ptr [edi] 19_2_01050432
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, 0000000Bh 19_2_010454B5
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+10h] 19_2_0101F4B2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp byte ptr [edi], 00000000h 19_2_010274E1
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx edx, byte ptr [esi+ebx] 19_2_01017712
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 19_2_0104076F
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 19_2_0104076F
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov word ptr [eax], cx 19_2_0105B612
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], CECD21FDh 19_2_0103D652
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh 19_2_0103D652
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_0103A692
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 19_2_010166B2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h 19_2_0102F6C4
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 19_2_01022911
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov dword ptr [esp], 00000000h 19_2_0102C952
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_010259AB
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+28h] 19_2_010259AB
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then push ebx 19_2_0102F835
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_01059832
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 54CA534Eh 19_2_01059832
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov edi, ecx 19_2_010258A8
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx eax, word ptr [esi+ecx] 19_2_01052B02
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_01044B4C
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then jmp ecx 19_2_01050B62
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov edi, eax 19_2_01018B72
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h 19_2_01030B95
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov word ptr [esi], ax 19_2_01030B95
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 19_2_0105BBE2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then jmp eax 19_2_01027BF4
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp byte ptr [edi], 00000000h 19_2_01027AF3
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_01058D52
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 19_2_0105BD62
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-34h] 19_2_01035D92
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 19_2_01039DA7
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 19_2_01041DB2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 19_2_01024DDD
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 19_2_01043F33
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 19_2_01043EB7
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_0105BFE2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 19_2_01040E11
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_01044E18
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_01054E22
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_01044E2D
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov edi, dword ptr [ebp-3Ch] 19_2_0103FEC1
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 19_2_01043ED2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah 19_2_0105BED2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, ebp 19_2_0101BEE2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, ebp 19_2_0101BEE2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 19_2_01050EF0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx edx, byte ptr [ecx+eax] 19_2_05A3F7B0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 19_2_05A7A1E0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 19_2_05A624B5
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_05A7A5E0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 19_2_05A62531
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, ebp 19_2_05A3A4E0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, ebp 19_2_05A3A4E0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+04h] 19_2_05A6F4EE
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov edi, dword ptr [ebp-3Ch] 19_2_05A5E4C2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 19_2_05A624D0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah 19_2_05A7A4D0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_05A73420
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_05A6342B
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 19_2_05A5F40F
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_05A63419
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-54h] 19_2_05A50730
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-18h] 19_2_05A5B732
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-18h] 19_2_05A5B6CC
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_05A4460A
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_05A44611
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h 19_2_05A4F193
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov word ptr [esi], ax 19_2_05A4F193
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then jmp eax 19_2_05A461F2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx eax, word ptr [esi+ecx] 19_2_05A71100
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then jmp ecx 19_2_05A6F160
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov edi, eax 19_2_05A37170
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_05A6314A
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp byte ptr [edi], 00000000h 19_2_05A460F1
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 19_2_05A583A5
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 19_2_05A603B0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-34h] 19_2_05A54390
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 19_2_05A433DB
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 19_2_05A7A360
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_05A77350
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx edx, byte ptr [esi+ebx] 19_2_05A35D10
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 19_2_05A5ED6D
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-14h] 19_2_05A5ED6D
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 19_2_05A34CB0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_05A58C90
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h 19_2_05A4DCC2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov word ptr [eax], cx 19_2_05A79C10
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], CECD21FDh 19_2_05A5BC50
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh 19_2_05A5BC50
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_05A43FA9
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+28h] 19_2_05A43FA9
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 19_2_05A40F0F
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov dword ptr [esp], 00000000h 19_2_05A4AF50
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov edi, ecx 19_2_05A43EA6
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_05A77E30
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 54CA534Eh 19_2_05A77E30
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then push ebx 19_2_05A4DE33
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_05A799B0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_05A4399C
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh 19_2_05A749F0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h 19_2_05A56910
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_05A7A8B0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 19_2_05A768B9
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 19_2_05A6A880
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_05A62899
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_05A62899
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_05A6F8FA
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h 19_2_05A6F8FA
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_05A62813
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_05A62813
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh 19_2_05A73870
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-54h] 19_2_05A50BAC
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov word ptr [eax], cx 19_2_05A56B80
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esi+00000744h] 19_2_05A62BC9
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_05A62BC9
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov byte ptr [ebx], al 19_2_05A62BC9
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp] 19_2_05A5DB75
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [esp+10h] 19_2_05A3DAB0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, 0000000Bh 19_2_05A63AB3
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then cmp byte ptr [edi], 00000000h 19_2_05A45ADF
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then movzx ebp, word ptr [edi] 19_2_05A6EA30
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 4x nop then mov eax, dword ptr [ebp-54h] 19_2_05A50A01

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2056078 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (racedsuitreow .shop) : 192.168.2.17:54889 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (racedsuitreow .shop in TLS SNI) : 192.168.2.17:49738 -> 172.67.206.221:443
Source: Network traffic Suricata IDS: 2056079 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (racedsuitreow .shop in TLS SNI) : 192.168.2.17:49739 -> 172.67.206.221:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.17:49738 -> 172.67.206.221:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.17:49738 -> 172.67.206.221:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.17:49739 -> 172.67.206.221:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.17:49739 -> 172.67.206.221:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: abortinoiwiam.shop
Source: Malware configuration extractor URLs: racedsuitreow.shop
Source: Malware configuration extractor URLs: covvercilverow.shop
Source: Malware configuration extractor URLs: pumpkinkwquo.shop
Source: Malware configuration extractor URLs: candleduseiwo.shop
Source: Malware configuration extractor URLs: defenddsouneuw.shop
Source: Malware configuration extractor URLs: priooozekw.shop
Source: Malware configuration extractor URLs: deallyharvenw.shop
Source: Malware configuration extractor URLs: surroundeocw.shop
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: global traffic HTTP traffic detected: GET /uploads/il2.txt HTTP/1.1Host: finalstepgo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: finalstepgo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://finalstepgo.com/uploads/il2.txtAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2bKyk+phhzcxLy4&MD=VEcd6h4b HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCNy9zQEIkcrNAQi5ys0BCLbLzQEI6dLNAQiK080BCMHUzQEIz9bNAQjj1s0BCI7XzQEIp9jNAQi62M0BCPnA1BUYuL/NARj2yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /uploads/il222.zip HTTP/1.1Host: finalstepgo.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2bKyk+phhzcxLy4&MD=VEcd6h4b HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAc3b2YHaGqVpvDt5fQD5WqyWe6yFx0NJba5UkXc18NyzzO727EJpRxajMi/a9VJGG3IbazdVCfGYDhgWix1bEZvF%2Bdi6BQDemUJPwGpTbVYCsJTXlSnyGJ9pvzXtUVpRc7a/IucKShQdkeIn8vjlkWQ7B633Nt88ruPHqsBG61WOzjNulLatGW7xuEYlrxV%2BAnUId2LPnjd3yXu39dIiVTHguri5j1XBxEHqhB/8RgSnKKM62AL1clVhb53mRWM362Q6dIqt85fZg5KeStaKPrIBled%2BkdJUzvKkym95jria/PiUdNMSRul6lJW3pVWndWcGee1xmuRa5Mb/7VE1NgkQZgAAEIjN2Vud26lqrpa0nLDGu7mwATElC8QCEnO8xLw8TUG3E9an0zcpJWgBIfsWEMqk4oxdn3M93RNPyGW1AjlXb6Gn06SvkSvESnWEl8Wy3kp9o6ejpwFdKJjdrk7hP6ZPSOLYmQiiYo1%2B1tZ5fAIOIIKQ44iMjdOSTkgtIdAxzwOu8gVhNL6PiW374UhLKIejrg9C1J/Pkmhmmiqj6pH/r/epLtFJWif%2BwQX13KWyyPTH7OXyukCnKh%2B/FnJjMl/%2B/KRwLRgllZnqiDw8TNu6i7WVri08tW6uWwioHgIeW6KGw7y3T/GADdXA0p1jxGHBBTIX1HgpKfBxb9XY6ZjIGxtXtUiDCkGR97GpPTGKxse8/Zhyul1ICKaK6Xxc3jXPpqlUivMvW6hV/TZTk7RXJEhnAlKYwqAHpQ7BO77iekqC5o1BgoDVu1sSh12WSziYoXkSEDemQjLyNIGzZsnoVDCfuP7EFUhDMUH5GmAdL7YqGiLffNCrogzj9okNNDGCflw7%2BG3/zT5pAGW11JKD3TdgQy0PuP/OfzJ5yAYJClx168oHYvHzegIaXl4V%2BwcCy5LQhl7RxmWmRyj4M4UARQg64NcB%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1727365298User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 2814152BF41F4137A196F50A19FC20E3X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic DNS traffic detected: DNS query: finalstepgo.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: apis.google.com
Source: global traffic DNS traffic detected: DNS query: play.google.com
Source: global traffic DNS traffic detected: DNS query: candleduseiwo.shop
Source: global traffic DNS traffic detected: DNS query: racedsuitreow.shop
Source: unknown HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIkqHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 Sep 2024 15:40:39 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: chromecache_138.1.dr String found in binary or memory: http://www.broofa.com
Source: PrivacyDrive.exe, 00000013.00000000.1876072666.0000000000552000.00000002.00000001.01000000.00000006.sdmp, PrivacyDrive.exe, 00000013.00000003.1953924428.0000000005ABA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.privacy-drive.comx
Source: chromecache_141.1.dr String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_141.1.dr String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_138.1.dr, chromecache_141.1.dr String found in binary or memory: https://apis.google.com
Source: chromecache_141.1.dr String found in binary or memory: https://clients6.google.com
Source: chromecache_141.1.dr String found in binary or memory: https://content.googleapis.com
Source: chromecache_141.1.dr String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_141.1.dr String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_137.1.dr String found in binary or memory: https://finalstepgo.com/uploads/il222.zip
Source: chromecache_138.1.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_138.1.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_138.1.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_138.1.dr String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_138.1.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_141.1.dr String found in binary or memory: https://plus.google.com
Source: chromecache_141.1.dr String found in binary or memory: https://plus.googleapis.com
Source: PrivacyDrive.exe, 00000013.00000003.1972562223.000000000190A000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000002.2000991866.00000000018B0000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000002.2001459062.000000000190E000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000002.2000991866.0000000001896000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://racedsuitreow.shop/
Source: PrivacyDrive.exe, 00000013.00000003.1961859622.0000000001883000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://racedsuitreow.shop/_
Source: PrivacyDrive.exe, 00000013.00000003.1972562223.000000000190A000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000002.2000991866.00000000018DA000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000003.1961859622.00000000018AB000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000003.1961859622.0000000001883000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000002.2001459062.000000000190E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://racedsuitreow.shop/api
Source: PrivacyDrive.exe, 00000013.00000003.1961859622.0000000001883000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://racedsuitreow.shop/api4
Source: PrivacyDrive.exe, 00000013.00000002.2000991866.00000000018DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://racedsuitreow.shop/api6
Source: PrivacyDrive.exe, 00000013.00000002.2000991866.00000000018DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://racedsuitreow.shop/apib
Source: PrivacyDrive.exe, 00000013.00000003.1972562223.000000000190A000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000002.2001459062.000000000190E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://racedsuitreow.shop/w
Source: chromecache_141.1.dr String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: PrivacyDrive.exe, 00000013.00000002.2000991866.000000000187B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error
Source: PrivacyDrive.exe, 00000013.00000003.1961859622.00000000018AB000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000003.1961835609.00000000018FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: PrivacyDrive.exe, 00000013.00000003.1961859622.00000000018AB000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000003.1961835609.00000000018FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: chromecache_141.1.dr String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_141.1.dr String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_138.1.dr String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_138.1.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_138.1.dr String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.17:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.126.29.10:443 -> 192.168.2.17:49732 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 2.23.209.181:443 -> 192.168.2.17:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.221:443 -> 192.168.2.17:49738 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.206.221:443 -> 192.168.2.17:49739 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A682A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 19_2_05A682A0
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A682A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 19_2_05A682A0

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Downloads suspicious files via Chrome
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File dump: C:\Users\user\Downloads\il222.zip (copy) Jump to dropped file
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0106C583 LdrInitializeThunk,NtCreateSection,NtMapViewOfSection,LdrInitializeThunk,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,LdrInitializeThunk,LdrInitializeThunk, 19_2_0106C583
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101055F 19_2_0101055F
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0106C583 19_2_0106C583
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_010231C2 19_2_010231C2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_010480E2 19_2_010480E2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01048372 19_2_01048372
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101A252 19_2_0101A252
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01015292 19_2_01015292
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0105C2B2 19_2_0105C2B2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0106D5C4 19_2_0106D5C4
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101C402 19_2_0101C402
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01049792 19_2_01049792
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0103D652 19_2_0103D652
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0103B99B 19_2_0103B99B
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101E802 19_2_0101E802
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_010198B2 19_2_010198B2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01030B95 19_2_01030B95
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01013A08 19_2_01013A08
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01049A42 19_2_01049A42
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101DA82 19_2_0101DA82
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101CAE2 19_2_0101CAE2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01012D5B 19_2_01012D5B
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01059DB2 19_2_01059DB2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0104FCA2 19_2_0104FCA2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01012CB5 19_2_01012CB5
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101CF72 19_2_0101CF72
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01012FB3 19_2_01012FB3
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01012E1A 19_2_01012E1A
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01012E8E 19_2_01012E8E
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01016EB2 19_2_01016EB2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01018EB2 19_2_01018EB2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101BEE2 19_2_0101BEE2
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01016EFD 19_2_01016EFD
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A315B1 19_2_05A315B1
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A3B570 19_2_05A3B570
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A354B0 19_2_05A354B0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A374B0 19_2_05A374B0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A3148C 19_2_05A3148C
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A3A4E0 19_2_05A3A4E0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A354FB 19_2_05A354FB
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A31418 19_2_05A31418
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A417C0 19_2_05A417C0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A666E0 19_2_05A666E0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A4F193 19_2_05A4F193
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A3C080 19_2_05A3C080
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A3B0E0 19_2_05A3B0E0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A32006 19_2_05A32006
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A68040 19_2_05A68040
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A783B0 19_2_05A783B0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A31359 19_2_05A31359
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A6E2A0 19_2_05A6E2A0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A312B3 19_2_05A312B3
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A67D90 19_2_05A67D90
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A5BC50 19_2_05A5BC50
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A59F99 19_2_05A59F99
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A37EB0 19_2_05A37EB0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A3CE00 19_2_05A3CE00
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A66970 19_2_05A66970
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A7A8B0 19_2_05A7A8B0
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A33890 19_2_05A33890
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A38850 19_2_05A38850
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A3AA00 19_2_05A3AA00
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: String function: 05A3EE60 appears 145 times
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: String function: 01020862 appears 145 times
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: String function: 05A3CBE0 appears 95 times
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: String function: 0101E5E2 appears 90 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 1712
Yara signature match
Source: 00000013.00000002.2000589436.0000000001010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: classification engine Classification label: mal100.troj.evad.win@27/35@10/9
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01010C6F CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle, 19_2_01010C6F
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A6F006 CoCreateInstance, 19_2_05A6F006
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess364
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\01bb0c2f-2807-4565-8df3-5043d858360a Jump to behavior
Source: C:\Windows\System32\rundll32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1988,i,15395324966863303034,10377143304438437007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://finalstepgo.com/uploads/il2.txt"
Source: unknown Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe "C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe"
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 1712
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1988,i,15395324966863303034,10377143304438437007,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: F:\PD3\bin\Release\PrivacyDrive.pdb source: PrivacyDrive.exe, 00000013.00000000.1876072666.0000000000552000.00000002.00000001.01000000.00000006.sdmp, PrivacyDrive.exe, 00000013.00000003.1953924428.0000000005ABA000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: F:\PD3\bin\Release\PrivacyDrive.pdbN source: PrivacyDrive.exe, 00000013.00000000.1876072666.0000000000552000.00000002.00000001.01000000.00000006.sdmp, PrivacyDrive.exe, 00000013.00000003.1953924428.0000000005ABA000.00000004.00000800.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01052307 push ecx; retf 19_2_01052308
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_05A70905 push ecx; retf 19_2_05A70906
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe TID: 2152 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: PrivacyDrive.exe, 00000013.00000002.2001544808.0000000001978000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000003.1961859622.00000000018AB000.00000004.00000020.00020000.00000000.sdmp, PrivacyDrive.exe, 00000013.00000002.2000991866.00000000018BC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0106C583 LdrInitializeThunk,NtCreateSection,NtMapViewOfSection,LdrInitializeThunk,VirtualAlloc,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,LdrInitializeThunk,LdrInitializeThunk, 19_2_0106C583
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101055F mov edx, dword ptr fs:[00000030h] 19_2_0101055F
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01010B1F mov eax, dword ptr fs:[00000030h] 19_2_01010B1F
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101116F mov eax, dword ptr fs:[00000030h] 19_2_0101116F
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_0101116E mov eax, dword ptr fs:[00000030h] 19_2_0101116E
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Code function: 19_2_01010ECF mov eax, dword ptr fs:[00000030h] 19_2_01010ECF

HIPS / PFW / Operating System Protection Evasion
barindex
LummaC encrypted strings found
Source: PrivacyDrive.exe String found in binary or memory: abortinoiwiam.shop
Source: PrivacyDrive.exe String found in binary or memory: pumpkinkwquo.shop
Source: PrivacyDrive.exe String found in binary or memory: covvercilverow.shop
Source: PrivacyDrive.exe String found in binary or memory: surroundeocw.shop
Source: PrivacyDrive.exe String found in binary or memory: defenddsouneuw.shop
Source: PrivacyDrive.exe String found in binary or memory: racedsuitreow.shop
Source: PrivacyDrive.exe String found in binary or memory: priooozekw.shop
Source: PrivacyDrive.exe String found in binary or memory: deallyharvenw.shop
Source: PrivacyDrive.exe String found in binary or memory: candleduseiwo.shop
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Temp1_il222.zip\PrivacyDrive.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1519577 URL: https://finalstepgo.com/upl... Startdate: 26/09/2024 Architecture: WINDOWS Score: 100 33 racedsuitreow.shop 2->33 35 candleduseiwo.shop 2->35 45 Suricata IDS alerts for network traffic 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 7 other signatures 2->51 7 chrome.exe 20 2->7         started        11 PrivacyDrive.exe 2->11         started        13 rundll32.exe 2->13         started        15 chrome.exe 2->15         started        signatures3 process4 dnsIp5 37 192.168.2.17, 138, 443, 49429 unknown unknown 7->37 39 192.168.2.4 unknown unknown 7->39 43 2 other IPs or domains 7->43 25 C:\Users\user\Downloads\il222.zip (copy), Zip 7->25 dropped 17 chrome.exe 7->17         started        41 racedsuitreow.shop 172.67.206.221, 443, 49738, 49739 CLOUDFLARENETUS United States 11->41 20 WerFault.exe 21 11->20         started        file6 process7 dnsIp8 27 apis.google.com 17->27 29 finalstepgo.com 185.255.122.133, 443, 49706, 49707 ICMESE Netherlands 17->29 31 3 other IPs or domains 17->31 23 C:\ProgramData\Microsoft\...\Report.wer, data 20->23 dropped file9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.185.132
 www.google.com United States
15169 GOOGLEUS false
172.67.206.221
 racedsuitreow.shop United States
13335 CLOUDFLARENETUS true
185.255.122.133
 finalstepgo.com Netherlands
42237 ICMESE false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.186.110
 play.google.com United States
15169 GOOGLEUS false
142.250.184.238
 plus.l.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.17
192.168.2.4
192.168.2.5

Contacted Domains

Name IP Active
plus.l.google.com 142.250.184.238 true
play.google.com 142.250.186.110 true
www.google.com 142.250.185.132 true
racedsuitreow.shop 172.67.206.221 true
finalstepgo.com 185.255.122.133 true
apis.google.com unknown unknown
candleduseiwo.shop unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://finalstepgo.com/favicon.ico false
  • Avira URL Cloud: malware
 unknown
https://finalstepgo.com/uploads/il222.zip false
  • Avira URL Cloud: malware
 unknown
covvercilverow.shop true
  • Avira URL Cloud: malware
 unknown
pumpkinkwquo.shop true
  • Avira URL Cloud: malware
 unknown
https://www.google.com/async/newtab_promos false
  • Avira URL Cloud: safe
 unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_0 false
  • Avira URL Cloud: safe
 unknown
abortinoiwiam.shop true
  • Avira URL Cloud: malware
 unknown
deallyharvenw.shop true
  • Avira URL Cloud: malware
 unknown
defenddsouneuw.shop true
  • Avira URL Cloud: malware
 unknown
priooozekw.shop true
  • Avira URL Cloud: malware
 unknown
https://www.google.com/async/ddljson?async=ntp:2 false
  • Avira URL Cloud: safe
 unknown
https://play.google.com/log?format=json&hasfast=true false
  • Avira URL Cloud: safe
 unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw false
  • Avira URL Cloud: safe
 unknown
https://racedsuitreow.shop/api true
  • Avira URL Cloud: malware
 unknown
surroundeocw.shop true
  • Avira URL Cloud: malware
 unknown
racedsuitreow.shop true
  • Avira URL Cloud: malware
 unknown
candleduseiwo.shop true
  • Avira URL Cloud: malware
 unknown
https://finalstepgo.com/uploads/il2.txt true
    		unknown
    https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0 false
    • Avira URL Cloud: safe
    		 unknown