Edit tour

Windows Analysis Report
17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Overview

General Information

Sample name:	17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe
Analysis ID:	1525929
MD5:	f17bb17a8c7a8960d9cb35afa5a712f6
SHA1:	38939288774b4d5e03b008097510d5b500db5a8b
SHA256:	22f7f158df1f9cf06babc6e845806aa79d257fdef057bcbeb8a17647c8d8a04e
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

LummaC

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Found inlined nop instructions (likely shell or obfuscated code)

One or more processes crash

PE file does not import any functions

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe (PID: 5236 cmdline: "C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe" MD5: F17BB17A8C7A8960D9CB35AFA5A712F6)

WerFault.exe (PID: 3508 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 224 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["traineiwnqo.shop", "condedqpwqm.shop", "millyscroqwp.shop", "caffegclasiqwp.shop", "evoliutwoqm.shop", "locatedblsoqp.shop", "exmptiondixv.shop", "stagedchheiqwo.shop", "stamppreewntnq.shop"], "Build id": "eFtdO8--"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.binstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: locatedblsoqp.shop	URL Reputation: Label: phishing
Source: caffegclasiqwp.shop	URL Reputation: Label: malware
Source: condedqpwqm.shop	URL Reputation: Label: phishing
Source: millyscroqwp.shop	URL Reputation: Label: malware
Source: stamppreewntnq.shop	URL Reputation: Label: phishing
Source: stagedchheiqwo.shop	URL Reputation: Label: phishing
Source: traineiwnqo.shop	URL Reputation: Label: malware

Found malware configuration

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Malware Configuration Extractor: LummaC {"C2 url": ["traineiwnqo.shop", "condedqpwqm.shop", "millyscroqwp.shop", "caffegclasiqwp.shop", "evoliutwoqm.shop", "locatedblsoqp.shop", "exmptiondixv.shop", "stagedchheiqwo.shop", "stamppreewntnq.shop"], "Build id": "eFtdO8--"}

Multi AV Scanner detection for submitted file

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Machine Learning detection for sample

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: caffegclasiqwp.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: stamppreewntnq.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: stagedchheiqwo.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: millyscroqwp.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: evoliutwoqm.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: condedqpwqm.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: traineiwnqo.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: locatedblsoqp.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: exmptiondixv.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: lid=%s&j=%s&ver=4.0
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: TeslaBrowser/5.5
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: - Screen Resoluton:
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: - Physical Installed Memory:
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: Workgroup: -
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	String decryptor: eFtdO8--

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	Code function: 4x nop then cld		1_2_00401850
Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-14h]		1_2_00442C0A

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: traineiwnqo.shop
Source: Malware configuration extractor	URLs: condedqpwqm.shop
Source: Malware configuration extractor	URLs: millyscroqwp.shop
Source: Malware configuration extractor	URLs: caffegclasiqwp.shop
Source: Malware configuration extractor	URLs: evoliutwoqm.shop
Source: Malware configuration extractor	URLs: locatedblsoqp.shop
Source: Malware configuration extractor	URLs: exmptiondixv.shop
Source: Malware configuration extractor	URLs: stagedchheiqwo.shop
Source: Malware configuration extractor	URLs: stamppreewntnq.shop

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 224

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Static PE information: No import functions for PE file found

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal92.troj.evad.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5236

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\0525454c-7221-4edf-b87c-847520b51ce9

Jump to behavior

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe "C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe"
Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 224

Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Section loaded: apphelp.dll

Jump to behavior

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	Code function: 1_2_00401297 push esp; ret		1_2_00401298
Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	Code function: 1_2_00401369 pushfd ; ret		1_2_0040136A

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	Process queried: DebugPort			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: caffegclasiqwp.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: stamppreewntnq.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: stagedchheiqwo.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: millyscroqwp.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: evoliutwoqm.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: condedqpwqm.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: traineiwnqo.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: locatedblsoqp.shop
Source: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: exmptiondixv.shop

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.binstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.binstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	1 Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	29%	ReversingLabs
17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
locatedblsoqp.shop	100%	URL Reputation	phishing
caffegclasiqwp.shop	100%	URL Reputation	malware
condedqpwqm.shop	100%	URL Reputation	phishing
millyscroqwp.shop	100%	URL Reputation	malware
stamppreewntnq.shop	100%	URL Reputation	phishing
evoliutwoqm.shop	0%	URL Reputation	safe
stagedchheiqwo.shop	100%	URL Reputation	phishing
traineiwnqo.shop	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
locatedblsoqp.shop	true	URL Reputation: phishing	unknown
caffegclasiqwp.shop	true	URL Reputation: malware	unknown
condedqpwqm.shop	true	URL Reputation: phishing	unknown
millyscroqwp.shop	true	URL Reputation: malware	unknown
stamppreewntnq.shop	true	URL Reputation: phishing	unknown
evoliutwoqm.shop	true	URL Reputation: safe	unknown
exmptiondixv.shop	true		unknown
stagedchheiqwo.shop	true	URL Reputation: phishing	unknown
traineiwnqo.shop	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525929
Start date and time:	2024-10-04 16:41:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@2/5@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe, PID 5236 because there are no executed function
VT rate limit hit for: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Simulations

Behavior and APIs

Time	Type	Description
10:44:08	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_17280510095e9673_3238bd9d8be125a3421114749f92e54b5e937e2_73825aa8_ca89b281-5e8a-498c-b381-8618a2d3477f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7156611694377596
Encrypted:	false
SSDEEP:	96:54DFxFQGYMyHkCZs8QhqY1yDf0QXIDcQzc6CmcE1cw3CF0R0j+HbHg6ZAX/d5FM6:5yLlY3pZ1v0NXfvjEzuiFVZ24IO8K
MD5:	54D6D8D4B011D50E45379B3F3B429444
SHA1:	6FD054DF8CD0AA0B100207228299344DADBD942F
SHA-256:	DCA35051C072FE33872FBBC94622669FACD4558F1EC8A3ED568A4EB64A120FEF
SHA-512:	D6C7C9024BB147227307B1ED594650B4F4CDCA2C24B4DF6D6023516718C86AA5F6165064BB8E532E373E6CCAA3CD6F29FC3FAE82FAE0C0AD03EFEC2E6940242F
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.5.2.6.6.3.2.6.9.3.8.6.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.5.2.6.6.3.3.4.9.0.7.3.8.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.a.8.9.b.2.8.1.-.5.e.8.a.-.4.9.8.c.-.b.3.8.1.-.8.6.1.8.a.2.d.3.4.7.7.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.8.a.b.6.7.6.5.-.d.8.7.9.-.4.a.6.c.-.a.4.f.e.-.7.f.8.c.e.5.3.9.c.8.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.1.7.2.8.0.5.1.0.0.9.5.e.9.6.7.3.8.2.9.7.4.d.0.5.3.2.6.1.6.0.5.6.5.7.b.3.4.7.1.f.0.3.c.a.a.1.c.9.a.4.b.d.5.7.9.0.3.4.0.c.e.2.b.5.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.7.4.-.0.0.0.1.-.0.0.1.4.-.9.f.6.2.-.6.5.d.3.6.b.1.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.1.0.2.7.9.c.1.6.a.1.b.2.2.8.d.2.0.a.c.c.2.6.3.b.d.4.9.6.b.c.e.0.0.0.0.f.f.f.f.!.0.0.0.0.3.8.9.3.9.2.8.8.7.7.4.b.4.d.5.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER57B5.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 4 14:43:52 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	19618
Entropy (8bit):	2.0493038123948244
Encrypted:	false
SSDEEP:	96:538wZ+nz9y4sEgqB4i7negNruFm+pWI/WItgIZvvUx:OwnR1q+OFNAm+JvMx
MD5:	3DF48CF113B0EB466586B28D4E13E1B6
SHA1:	76981FEE788A06C36EC1B9C8CF733CB673EF419D
SHA-256:	2D488A4CB36A610B09C3EC15CA5CC061F05C12A7D5DBA87933A9B6317E678402
SHA-512:	9657CFB718902418411043DB5EECA18EF242BF1FC6C9C315CDF9A264666D22863C36582EE5005CDC2B18ACF55A61DAD6D1FF48B0F53F1C93627D2AC7C180E395
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......(..f............4...............<.......d...<...........T.......8...........T...........H...ZC......................................................................................................eJ......L.......GenuineIntel............T.......t...&..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5881.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8552
Entropy (8bit):	3.702855768000882
Encrypted:	false
SSDEEP:	192:R6l7wVeJA56Ey6YNaSUggmfRJPWOApxI89bmisfKwCm:R6lXJe6Ey6YASUggmfRJPWOamhfKU
MD5:	3AAD00C64F9329DFF1234BF8BC709F46
SHA1:	C4FAB0599D6E4983B43F3A41C32C8D60AC519E12
SHA-256:	796B8C95F6250D8259D1D3A822578F07D6C885F24E591C22DAE71734829F5BBD
SHA-512:	2813726CF0E6225E3DC5ECCA2737517FDD3D08D51888CF6453ABAFDD63BCEB95955DD6E8D46FD4C32488686202E4A55927AD4671B38E72DC38992CD5A6D76173
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER58C0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4893
Entropy (8bit):	4.556570312003181
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9tApXWpW8VYD5Ym8M4JqplKFKej+q8BSIg3R7J7Ed:uIjfvI7zApm7VsoJqpreja7Y7J7Ed
MD5:	8A67E0F0557D5B0B0653F72D5586EC4A
SHA1:	033424252125F1F336FAF7EC755D25051105BD8F
SHA-256:	FADDF6DC839550047E4DDD2654E3E4689D38F143EBE8EF8BB793AC3C34F0156B
SHA-512:	4C24D507FBB99F2486DA8CB6F0F8A8CB1DD325753845198FD8BA4C4570FB0554AD26663DA7724525EA80A5D5C61909495E4859396076EE3811828DC6D9E7747F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="528826" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417194556920807
Encrypted:	false
SSDEEP:	6144:gcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNf5+:Fi58oSWIZBk2MM6AFBho
MD5:	9286612F84670B3BB0E13F1C78751AF4
SHA1:	AF569A1B798CBAF142136DBD766DCDFDACA1AEAD
SHA-256:	6FC67B8EDB86370A37B3748AD78A99660760C1A0C6A4238D58591136FAEC3994
SHA-512:	D2ED83F4C2F9CB04D35E9DB6522BD1B168B1A28CE8E3F4987E37CAB33F3B2C5163FD429A0E1810D2B9E2A4096DED51977C1D813B53B0EED3CF809F6C8577A80C
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...k...............................................................................................................................................................................................................................................................................................................................................+...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.641274043479112
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe
File size:	340'189 bytes
MD5:	f17bb17a8c7a8960d9cb35afa5a712f6
SHA1:	38939288774b4d5e03b008097510d5b500db5a8b
SHA256:	22f7f158df1f9cf06babc6e845806aa79d257fdef057bcbeb8a17647c8d8a04e
SHA512:	6b4a556d3a2fc26bbca168f74cbe57afa19b8be39c576aed8c7a78a2e7f5dfc556e27d6ecc1305d7ba2c5a4de4d8dd473a77cb16b7cd0346d5697c18a29de578
SSDEEP:	6144:mS7fwwqwNxah6L13CeQANHwEd3FTzV6GP9nUhou6ztkf3j/wh+BOL1+mH0UOALLi:Jqox7HsLUh+ApJ70kZ/O
TLSH:	68745C0ADF53D191DC8F80B202B9E33FDA7663164B364D878B9CD6A07C927AB3079945
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......f................. ........................@.......................................@.................................qT..x..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40a1b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D58907 [Mon Sep 2 09:44:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
nop
nop
mov esi, ecx
and esi, 01h
lea edi, dword ptr [esi+edi*2]
shr ecx, 1
dec ebx
jne 00007F7700B456F2h
cmp byte ptr [ebx], dl
lodsd
jmp 00007F7700B45663h
add esp, 000015B0h
pop esi
pop edi
pop ebx
pop ebp
ret
dec dword ptr [esp+ebx*4+2Ch]
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp ecx, 02h
jl 00007F7700B4572Ah
mov edi, dword ptr [esp+ecx*4+28h]
dec ecx
test edi, edi
je 00007F7700B456F4h
dec edi
mov dword ptr [esp+ecx*4+2Ch], edi
mov edi, dword ptr [esp+ecx*4+30h]
mov dword ptr [esi], ecx
add al, EBh
jnp 00007F7700B45685h
jecxz 00007F7700B45704h
xor edi, 02h
lea edi, dword ptr [edi+ebx*2]
mov ebx, dword ptr [esp+000015C8h]
mov dword ptr [esp+ecx*4+30h], edi
dec eax
cmp eax, edx
jne 00007F7700B456BDh
jmp 00007F7700B45460h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
push ebx
push edi
push esi
mov eax, dword ptr [esp+14h]
mov ebx, dword ptr [edx+08h]
mov esi, 00000001h
cmp ebx, eax
jnc 00007F7700B4575Ah
mov edi, edx
cmp dword ptr [esp+18h], 00000000h
je 00007F7700B45733h
cmp ebx, 01h
adc ebx, 00000000h
cmp ebx, eax
jnc 00007F7700B4572Bh
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
cmp byte ptr [eax], 00000013h
lodsd
loop 00007F7700B45704h
mov ebp, ebx
or ebx, 02h
imul ebx, edx
xor edx, 02h
and ebp, FFFFFFFDh
shrd dword ptr [eax], edi, 00000013h
lodsd
jmp far 0000h : C339EB01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x45471	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x56000	0x44d8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x45594	0xa8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x41f81	0x42000	54f97a0ac983373ede008d738ff4cb08	False	0.46741462476325757	data	6.470554040589782	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x43000	0x289d	0x2a00	0ac8e9c4f6858c310916a3f3b312d442	False	0.5272507440476191	data	6.479522807675584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x46000	0xf0d4	0x5c00	8f771abcd869c98f00cbb3bd5a9a5e34	False	0.47469429347826086	data	6.631034213740547	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x56000	0x44d8	0x4600	caa4f667702671d01e2e6d4c65c07873	False	0.488671875	data	5.959371500802726	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Analysis Process: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exePID: 5236, Parent PID: 4056

General

Target ID:	1
Start time:	10:43:50
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe"
Imagebase:	0x400000
File size:	340'189 bytes
MD5 hash:	F17BB17A8C7A8960D9CB35AFA5A712F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:43:52
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 224
Imagebase:	0x240000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exePID: 5236, Parent PID: 4056COMMON

Non-executed Functions

Function 00442C0A Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3320519404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320482983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320581747.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320623805.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320711301.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e73f918356e25b15b54e73fd807790df9000e8daff1fb412c7a8a8672a19ab6
Instruction ID: 7b567a9f7744926620284cb367d8da18d4b22600e5725fd882bfbed5cdc79d21
Opcode Fuzzy Hash: 7e73f918356e25b15b54e73fd807790df9000e8daff1fb412c7a8a8672a19ab6
Instruction Fuzzy Hash: CC319CB06182968FF7058F74CD847EE7BA1AF27300F2801ADC583AB352D2A4D403C75A

Function 00401850 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3320519404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320482983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320581747.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320623805.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320711301.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622076103962422749f4ab7dde334e203eb65c4f5d1097328a749fabac25ca1b
Instruction ID: e5a0d43e5d050eab764b7debfc0a9e6eba6fca5b2525805d8162cce790201a97
Opcode Fuzzy Hash: 622076103962422749f4ab7dde334e203eb65c4f5d1097328a749fabac25ca1b
Instruction Fuzzy Hash: 38F0C81973A5D48EF7615A34CD4D3917A685B03208F8C51E9CB818B3F1D299814B964E

Function 004014D5 Relevance: 8.9, Strings: 7, Instructions: 134COMMON

Download Yara Rule

Strings

Vlqi, xrefs: 004015FD
JSCL, xrefs: 004015F6
I<YV, xrefs: 004015DB
MFPG, xrefs: 004015EF
r, xrefs: 00401631
dgfg, xrefs: 004016C1
DID], xrefs: 004015E5

Memory Dump Source

Source File: 00000001.00000002.3320519404.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320482983.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320581747.0000000000443000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320623805.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320659433.0000000000446000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.3320711301.0000000000456000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7.jbxd

Similarity

API ID:
String ID: DID]$I<YV$JSCL$MFPG$Vlqi$dgfg$r
API String ID: 0-978875513
Opcode ID: 9135d8a495ccbbad73c31f7c6c1a5d3925ad1e070359c5c8bc3e05f2838c40b1
Instruction ID: 6bcc6d2a0fc3890f2278ac13519fa69f4bdf9884d9437078113e63a31147d648
Opcode Fuzzy Hash: 9135d8a495ccbbad73c31f7c6c1a5d3925ad1e070359c5c8bc3e05f2838c40b1
Instruction Fuzzy Hash: 7951BDB4900249CFEB10CFA4C995BAEBBB1FF01314F14456DD0A56B792D339A981CF95

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_17280510095e9673_3238bd9d8be125a3421114749f92e54b5e937e2_73825aa8_ca89b281-5e8a-498c-b381-8618a2d3477f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER57B5.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5881.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER58C0.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
17280510095e967382974d053261605657b3471f03caa1c9a4bd5790340ce2b59ddaa7f2bf582.dat-decoded.exe