Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1545304
MD5: e2f4a20bf1778ddb6396f48f6f4a9a32
SHA1: 75d402e0a8645b0a33f93ed6a66f76fe22496987
SHA256: a76920b863ff403f08436950963f30333e7b9297d36f2cec8e26bd94d66c8f1a
Tags: exeuser-Bitsight
Infos:

Detection

LummaC
Score: 84
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected LummaC Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
LummaC encrypted strings found
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Program does not show much activity (idle)
Uses 32bit PE files

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

AV Detection
barindex
Found malware configuration
Source: file.exe Malware Configuration Extractor: LummaC {"C2 url": ["contemteny.site", "goalyfeastz.site", "servicedny.site", "seallysl.site", "opposezmny.site", "authorisev.site", "dilemmadu.site", "faulteyotk.site"], "Build id": "2Zo0RN--PRIVATE"}
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 44%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 82.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: file.exe String decryptor: servicedny.site
Source: file.exe String decryptor: authorisev.site
Source: file.exe String decryptor: faulteyotk.site
Source: file.exe String decryptor: dilemmadu.site
Source: file.exe String decryptor: contemteny.site
Source: file.exe String decryptor: goalyfeastz.site
Source: file.exe String decryptor: opposezmny.site
Source: file.exe String decryptor: seallysl.site
Source: file.exe String decryptor: goalyfeastz.site
Source: file.exe String decryptor: lid=%s&j=%s&ver=4.0
Source: file.exe String decryptor: TeslaBrowser/5.5
Source: file.exe String decryptor: - Screen Resoluton:
Source: file.exe String decryptor: - Physical Installed Memory:
Source: file.exe String decryptor: Workgroup: -
Source: file.exe String decryptor: 2Zo0RN--PRIVATE
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx esi, byte ptr [eax] 0_2_005941F0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edx, ecx 0_2_0059137E
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edx, ecx 0_2_005913D5
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then add ebp, dword ptr [esp+0Ch] 0_2_0057E870
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ecx, byte ptr [edi+ebx] 0_2_00555820
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov ecx, eax 0_2_0055E8DE
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov word ptr [eax], cx 0_2_0056C8CE
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edx, eax 0_2_0058A97E
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then cmp dword ptr [eax+ebx*8], 7CDE1E50h 0_2_0058A97E
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], B62B8D10h 0_2_0058A97E
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then cmp dword ptr [ebx+edi*8], B62B8D10h 0_2_0058B170
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ebx, byte ptr [edx+esi] 0_2_0055C960
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h] 0_2_00560118
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov byte ptr [ebx], dl 0_2_00560118
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h] 0_2_00560118
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edx, ecx 0_2_00560118
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edx, ecx 0_2_00560118
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+5A603547h] 0_2_00560130
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov byte ptr [ebx], dl 0_2_00560130
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ecx, byte ptr [ecx+eax-24F86745h] 0_2_00560130
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edx, ecx 0_2_00560130
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edx, ecx 0_2_00560130
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp edx 0_2_005931D0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then xor byte ptr [ecx+ebx], bl 0_2_005931D0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax-7DC9E524h] 0_2_005741E0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov ecx, eax 0_2_0055E996
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp eax 0_2_0057AA40
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov word ptr [eax], cx 0_2_0057CA72
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov word ptr [eax], cx 0_2_0057CA72
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+1817620Ch] 0_2_0057AA60
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov byte ptr [eax+ebx], 00000030h 0_2_005512D5
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax+2BB126CDh] 0_2_0058FAD0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp edx 0_2_005932C0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then xor byte ptr [ecx+ebx], bl 0_2_005932C0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edi, edx 0_2_00571B40
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov byte ptr [ebx], cl 0_2_0057EB60
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov ecx, eax 0_2_0057EB60
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then lea edx, dword ptr [eax-80h] 0_2_0057EB60
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+0000009Ch] 0_2_0057EB60
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ecx, byte ptr [esi+eax+068F7B6Bh] 0_2_0057EB60
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov dword ptr [esi+04h], eax 0_2_0057EB60
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov byte ptr [ebx], al 0_2_0057EB60
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov ecx, ebx 0_2_00571333
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx esi, byte ptr [eax] 0_2_00594380
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp edx 0_2_005933B0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then xor byte ptr [ecx+ebx], bl 0_2_005933B0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then cmp al, 2Eh 0_2_0057AC04
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 0_2_0057E400
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edi, esi 0_2_0056ECDE
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 0_2_00587CA0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov word ptr [ebx], ax 0_2_0056F510
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov byte ptr [esi], cl 0_2_0056F510
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov ebx, eax 0_2_0055D500
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp eax 0_2_0056D5AF
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx-67BC38F0h] 0_2_00591648
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 0_2_0057DE70
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov dword ptr [esp+3Ch], 595A5B84h 0_2_00590E3A
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx eax, word ptr [esi+ecx] 0_2_0058C6D0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov edi, dword ptr [esp+54h] 0_2_0057CEDA
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then mov word ptr [eax], cx 0_2_0056C6E0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp edx 0_2_00592EB0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then xor byte ptr [ecx+ebx], bl 0_2_00592EB0
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h 0_2_00575F00
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx edi, word ptr [edx] 0_2_00578F00
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then xor byte ptr [ecx+ebx], bl 0_2_00593720
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+52B71DE2h] 0_2_00591720
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then movzx eax, byte ptr [esp+ebx-09A22FB6h] 0_2_0058F7E0

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: contemteny.site
Source: Malware configuration extractor URLs: goalyfeastz.site
Source: Malware configuration extractor URLs: servicedny.site
Source: Malware configuration extractor URLs: seallysl.site
Source: Malware configuration extractor URLs: opposezmny.site
Source: Malware configuration extractor URLs: authorisev.site
Source: Malware configuration extractor URLs: dilemmadu.site
Source: Malware configuration extractor URLs: faulteyotk.site
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00585210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 0_2_00585210
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00585210 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 0_2_00585210
Contains functionality to record screenshots
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005859B7 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt, 0_2_005859B7
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005886FE 0_2_005886FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00592850 0_2_00592850
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00551000 0_2_00551000
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00576800 0_2_00576800
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0056482A 0_2_0056482A
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005600C5 0_2_005600C5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005538E0 0_2_005538E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057509D 0_2_0057509D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00589940 0_2_00589940
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055F970 0_2_0055F970
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0058A97E 0_2_0058A97E
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00557960 0_2_00557960
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00560118 0_2_00560118
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00560130 0_2_00560130
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00594920 0_2_00594920
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005831DE 0_2_005831DE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005931D0 0_2_005931D0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005741E0 0_2_005741E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005791E0 0_2_005791E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00581980 0_2_00581980
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055F250 0_2_0055F250
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057AA40 0_2_0057AA40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055A270 0_2_0055A270
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057CA72 0_2_0057CA72
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055B260 0_2_0055B260
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0058E230 0_2_0058E230
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00570A24 0_2_00570A24
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005512D5 0_2_005512D5
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005932C0 0_2_005932C0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0058A2E0 0_2_0058A2E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0056E298 0_2_0056E298
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00571B40 0_2_00571B40
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057EB60 0_2_0057EB60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055DB20 0_2_0055DB20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055132D 0_2_0055132D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00565BD8 0_2_00565BD8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057C3E0 0_2_0057C3E0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00592380 0_2_00592380
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005933B0 0_2_005933B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00589BA0 0_2_00589BA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00594C50 0_2_00594C50
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00584C60 0_2_00584C60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057AC04 0_2_0057AC04
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0058EC20 0_2_0058EC20
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00577CD2 0_2_00577CD2
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0056ECDE 0_2_0056ECDE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055ECC0 0_2_0055ECC0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00579494 0_2_00579494
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005594BF 0_2_005594BF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055BD70 0_2_0055BD70
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0056F510 0_2_0056F510
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00579D00 0_2_00579D00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055ADD0 0_2_0055ADD0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00582D80 0_2_00582D80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005835B0 0_2_005835B0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005755A4 0_2_005755A4
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00558DA0 0_2_00558DA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0056D5AF 0_2_0056D5AF
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00572E50 0_2_00572E50
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057D642 0_2_0057D642
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057BE10 0_2_0057BE10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00594620 0_2_00594620
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057762D 0_2_0057762D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057A6D0 0_2_0057A6D0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00592EB0 0_2_00592EB0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_005726A0 0_2_005726A0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057762D 0_2_0057762D
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0055D760 0_2_0055D760
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00556F60 0_2_00556F60
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00578F00 0_2_00578F00
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00579494 0_2_00579494
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00593720 0_2_00593720
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00591720 0_2_00591720
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00558DA0 0_2_00558DA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057B7D9 0_2_0057B7D9
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0057B7FE 0_2_0057B7FE
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00559F9C 0_2_00559F9C
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00576F82 0_2_00576F82
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00584F80 0_2_00584F80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00591F80 0_2_00591F80
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00554FA0 0_2_00554FA0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00559FA8 0_2_00559FA8
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\file.exe Code function: String function: 0056C2A0 appears 176 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 0055C8C0 appears 71 times
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal84.troj.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00582088 CoCreateInstance, 0_2_00582088
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: file.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\file.exe API coverage: 4.9 %
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\file.exe API call chain: ExitProcess graph end node
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00590D90 LdrInitializeThunk, 0_2_00590D90
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion
barindex
LummaC encrypted strings found
Source: file.exe, 00000000.00000002.2929391953.0000000000596000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: servicedny.site
Source: file.exe, 00000000.00000002.2929391953.0000000000596000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: authorisev.site
Source: file.exe, 00000000.00000002.2929391953.0000000000596000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: faulteyotk.site
Source: file.exe, 00000000.00000002.2929391953.0000000000596000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: dilemmadu.site
Source: file.exe, 00000000.00000002.2929391953.0000000000596000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: contemteny.site
Source: file.exe, 00000000.00000002.2929391953.0000000000596000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: goalyfeastz.site
Source: file.exe, 00000000.00000002.2929391953.0000000000596000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: opposezmny.site
Source: file.exe, 00000000.00000002.2929391953.0000000000596000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: seallysl.site

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.binstr, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.binstr, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1545304 Sample: file.exe Startdate: 30/10/2024 Architecture: WINDOWS Score: 84 8 Found malware configuration 2->8 10 Multi AV Scanner detection for submitted file 2->10 12 Yara detected LummaC Stealer 2->12 14 4 other signatures 2->14 5 file.exe 2->5         started        process3 signatures4 16 LummaC encrypted strings found 5->16
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
goalyfeastz.site true
    		unknown
    servicedny.site true
      		unknown
      contemteny.site true
        		unknown
        faulteyotk.site true
          		unknown
          opposezmny.site true
            		unknown
            seallysl.site true
              		unknown
              dilemmadu.site true
                		unknown
                authorisev.site true
                  		unknown