Windows Analysis Report
injector V2.4.exe

Overview

General Information

Sample name: injector V2.4.exe
Analysis ID: 1561470
MD5: c1b5cae419a07b5bfeb4e958510f8637
SHA1: 80c99f320d7b74fb100b51cd98a2ff232e286e63
SHA256: 608864a20a91e6fcacefa06046a522a66dbfe45f3f94adfc32ed89ffcae29907
Tags: exeuser-4k95m
Infos:

Detection

LummaC Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Query firmware table information (likely to detect VMs)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for user specific document files
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection
barindex
Found malware configuration
Source: injector V2.4.exe.6564.4.memstrmin Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "yau6Na--1285025705"}
Multi AV Scanner detection for submitted file
Source: injector V2.4.exe ReversingLabs: Detection: 42%
Machine Learning detection for sample
Source: injector V2.4.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00418BE3 CryptUnprotectData, 4_2_00418BE3
Uses 32bit PE files
Source: injector V2.4.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: injector V2.4.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004DC72A FindFirstFileExW, 0_2_004DC72A
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004DC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_004DC7DB
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004DC72A FindFirstFileExW, 3_2_004DC72A
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004DC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose, 3_2_004DC7DB
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov edi, edx 4_2_0043D880
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx ebx, byte ptr [esp+eax-43h] 4_2_00420970
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx edi, byte ptr [ecx+esi-000000BEh] 4_2_0040A10E
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov word ptr [eax], cx 4_2_00418BE3
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx eax, byte ptr [ebp+edx+2EBA049Dh] 4_2_0040CE5A
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h 4_2_00440620
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov edi, esi 4_2_00440740
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then lea eax, dword ptr [esp+3Ch] 4_2_0040C7A5
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov ecx, ebx 4_2_00439040
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov byte ptr [ebx], al 4_2_0042C84A
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov edi, eax 4_2_0042CD62
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov word ptr [eax], cx 4_2_00429F62
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then cmp dword ptr [ebx+esi*8], 1B6183F2h 4_2_00429813
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov byte ptr [ebx], al 4_2_0042C8DC
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov byte ptr [edi], cl 4_2_0042D0F6
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov word ptr [eax], cx 4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then lea edx, dword ptr [ecx+01h] 4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then add eax, edx 4_2_00426959
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h 4_2_00426910
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov byte ptr [ebx], al 4_2_0042C918
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov byte ptr [ebx], al 4_2_0042C929
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov bx, 0008h 4_2_00404930
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then jmp ecx 4_2_00404930
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h 4_2_004231F0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then jmp dword ptr [00445ED4h] 4_2_0040B989
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then cmp al, 5Ch 4_2_00402190
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx eax, byte ptr [esp+esi-40D3E74Fh] 4_2_0042A1A2
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx edx, byte ptr [esp+eax+000000F0h] 4_2_0040DA43
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov edx, ecx 4_2_0040EA4F
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx ecx, byte ptr [esi+eax+6FB81553h] 4_2_0041D201
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 4_2_0042BA10
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h 4_2_00439290
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov ecx, edx 4_2_00428A9C
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h 4_2_00428A9C
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov edi, esi 4_2_00425344
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov word ptr [eax], cx 4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then lea edx, dword ptr [ecx+01h] 4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov byte ptr [edx], cl 4_2_0042D318
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov edx, ebp 4_2_004393D0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov byte ptr [edx], cl 4_2_0042D380
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx edi, byte ptr [eax] 4_2_0042E388
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov word ptr [eax], cx 4_2_00423450
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 4_2_0042B450
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov byte ptr [edi], al 4_2_0041AC64
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov ebx, eax 4_2_00405C20
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov ebp, eax 4_2_00405C20
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov edx, eax 4_2_00440CD0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov word ptr [eax], cx 4_2_004294BD
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov edi, eax 4_2_0042CD67
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx eax, word ptr [ecx] 4_2_004395E9
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then jmp ecx 4_2_0043DDF5
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then jmp dword ptr [00447FC4h] 4_2_00427580
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx ecx, byte ptr [esp+eax-59BD808Dh] 4_2_00427580
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov word ptr [eax], cx 4_2_00427580
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then jmp ecx 4_2_0043E5A6
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov edx, ecx 4_2_0042ADAB
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then cmp dword ptr [edi+esi*8], 1B6183F2h 4_2_0042ADAB
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov esi, ebx 4_2_00408E00
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 4_2_00435E10
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then jmp dword ptr [00445ED4h] 4_2_0040B626
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx edx, byte ptr [esi+eax-47412FB0h] 4_2_0041CED0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov byte ptr [edi], al 4_2_0041CED0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov ebx, edx 4_2_0040BEB1
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx+14h] 4_2_00428F5D
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov word ptr [eax], cx 4_2_00429F62
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov ecx, eax 4_2_00422776
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then jmp dword ptr [00447FC4h] 4_2_00427774
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov word ptr [eax], cx 4_2_00427774
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then movzx edx, byte ptr [edi+eax+7035CC0Ch] 4_2_0041DF00
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4x nop then mov esi, ecx 4_2_00421F10

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49725 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49707 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49711 -> 104.21.33.116:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://property-imper.sbs/api
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.33.116 104.21.33.116
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49725 -> 104.21.33.116:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 104.21.33.116:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: property-imper.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HFRS7G1FUA8REUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12810Host: property-imper.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=69CXXKCM4XW3VKJ8X0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: property-imper.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=TU3BSQD1V57Y1SYAPT6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20578Host: property-imper.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=OCZ8RMO9L20OK5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1251Host: property-imper.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Z4LE82AH15EL844SF6XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 551200Host: property-imper.sbs
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: property-imper.sbs
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: property-imper.sbs
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294509067.0000000002BFE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microx
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: injector V2.4.exe, 00000004.00000003.2177316206.00000000052D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: injector V2.4.exe, 00000004.00000003.2241245492.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2178099039.00000000052C4000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134375818.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2202521642.0000000002C08000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295771988.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2176641373.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2176971631.00000000052C3000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2273721386.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2273721386.0000000002C0D000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2223528130.00000000052C1000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2199575933.00000000052C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/
Source: injector V2.4.exe, 00000004.00000003.2202650699.0000000002C25000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2202612238.0000000002C1A000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2241187469.0000000002C21000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2202633746.0000000002C21000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2202499828.0000000002C15000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2176493627.0000000005352000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2272584249.0000000002C23000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/api
Source: injector V2.4.exe, 00000004.00000003.2176493627.0000000005352000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/api$I
Source: injector V2.4.exe, 00000004.00000003.2176493627.0000000005352000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apiII8
Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apiW
Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apie
Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/apisk
Source: injector V2.4.exe, 00000004.00000002.2295771988.0000000002C1C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://property-imper.sbs/m
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: injector V2.4.exe, 00000004.00000003.2178397811.000000000534E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: injector V2.4.exe, 00000004.00000003.2134677816.00000000052FB000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134796623.00000000052F8000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134731743.00000000052F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: injector V2.4.exe, 00000004.00000003.2178125921.00000000055DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.33.116:443 -> 192.168.2.5:49725 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00433550 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 4_2_00433550
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00433550 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 4_2_00433550
Contains functionality to record screenshots
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00433D60 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt, 4_2_00433D60
Detected potential crypto function
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004CF4D0 0_2_004CF4D0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D34D0 0_2_004D34D0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004CF980 0_2_004CF980
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D15A0 0_2_004D15A0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004CCE70 0_2_004CCE70
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004C86C0 0_2_004C86C0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004E1FD2 0_2_004E1FD2
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004CD7F0 0_2_004CD7F0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004CF4D0 3_2_004CF4D0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004D34D0 3_2_004D34D0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004CF980 3_2_004CF980
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004D15A0 3_2_004D15A0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004CCE70 3_2_004CCE70
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004C86C0 3_2_004C86C0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004E1FD2 3_2_004E1FD2
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004CD7F0 3_2_004CD7F0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004228A0 4_2_004228A0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00427140 4_2_00427140
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00420970 4_2_00420970
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0043B100 4_2_0043B100
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004389D0 4_2_004389D0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00408AE0 4_2_00408AE0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00418BE3 4_2_00418BE3
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00409BA0 4_2_00409BA0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00424470 4_2_00424470
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042E434 4_2_0042E434
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042DD55 4_2_0042DD55
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00438660 4_2_00438660
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00440740 4_2_00440740
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00440FB0 4_2_00440FB0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00406840 4_2_00406840
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042C84A 4_2_0042C84A
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00438000 4_2_00438000
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042C8DC 4_2_0042C8DC
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004298A8 4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004378AF 4_2_004378AF
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00426959 4_2_00426959
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00406170 4_2_00406170
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00429100 4_2_00429100
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00430112 4_2_00430112
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00426910 4_2_00426910
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042C918 4_2_0042C918
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042C929 4_2_0042C929
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00404930 4_2_00404930
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004241E8 4_2_004241E8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004409F0 4_2_004409F0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042A1A2 4_2_0042A1A2
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004281BC 4_2_004281BC
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0040DA43 4_2_0040DA43
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0043C250 4_2_0043C250
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041FAF0 4_2_0041FAF0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00425344 4_2_00425344
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004298A8 4_2_004298A8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00409300 4_2_00409300
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00431313 4_2_00431313
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042D318 4_2_0042D318
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00402B20 4_2_00402B20
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0043BB30 4_2_0043BB30
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0043F330 4_2_0043F330
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004283CA 4_2_004283CA
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00424BE2 4_2_00424BE2
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042D380 4_2_0042D380
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00420BB0 4_2_00420BB0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00423450 4_2_00423450
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0043F450 4_2_0043F450
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041AC64 4_2_0041AC64
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0040546B 4_2_0040546B
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00430C7A 4_2_00430C7A
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00405C20 4_2_00405C20
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041CC20 4_2_0041CC20
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00406CD0 4_2_00406CD0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00440CD0 4_2_00440CD0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004304FB 4_2_004304FB
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00418490 4_2_00418490
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004294BD 4_2_004294BD
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00403550 4_2_00403550
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0043F550 4_2_0043F550
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042CD67 4_2_0042CD67
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041F510 4_2_0041F510
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004395E9 4_2_004395E9
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00427580 4_2_00427580
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00408590 4_2_00408590
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00437DA0 4_2_00437DA0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00424DB0 4_2_00424DB0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004365B8 4_2_004365B8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00409650 4_2_00409650
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042DD4E 4_2_0042DD4E
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00431670 4_2_00431670
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00426630 4_2_00426630
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041CED0 4_2_0041CED0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041B68E 4_2_0041B68E
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041EEA0 4_2_0041EEA0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00403F60 4_2_00403F60
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0042E765 4_2_0042E765
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00427774 4_2_00427774
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041DF00 4_2_0041DF00
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0043B700 4_2_0043B700
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0040AFE0 4_2_0040AFE0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004077E0 4_2_004077E0
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00419FED 4_2_00419FED
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: String function: 00408390 appears 48 times
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: String function: 00418480 appears 63 times
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: String function: 004D55C0 appears 66 times
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: String function: 004D8178 appears 36 times
Uses 32bit PE files
Source: injector V2.4.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: injector V2.4.exe Static PE information: Section: .coS ZLIB complexity 1.0003382863562091
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@6/0@1/1
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_004389D0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW, 4_2_004389D0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6428:120:WilError_03
Source: injector V2.4.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\injector V2.4.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: injector V2.4.exe, 00000004.00000003.2135024624.00000000052CA000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2156235794.0000000005362000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2134914235.00000000052E6000.00000004.00000800.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2155985287.00000000052CD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: injector V2.4.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\Desktop\injector V2.4.exe File read: C:\Users\user\Desktop\injector V2.4.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"
Source: C:\Users\user\Desktop\injector V2.4.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\injector V2.4.exe Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"
Source: C:\Users\user\Desktop\injector V2.4.exe Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe"
Source: C:\Users\user\Desktop\injector V2.4.exe Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe" Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe" Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: injector V2.4.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_ISOLATION, GUARD_CF, TERMINAL_SERVER_AWARE
PE file contains sections with non-standard names
Source: injector V2.4.exe Static PE information: section name: .00cfg
Source: injector V2.4.exe Static PE information: section name: .coS
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D4BC5 push ecx; ret 0_2_004D4BD8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004D4BC5 push ecx; ret 3_2_004D4BD8
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00415893 push ds; ret 4_2_00415894
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041432B pushad ; ret 4_2_00414334
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0041458B push ds; ret 4_2_00414594
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00414D98 push edx; retf 4_2_00414D9B
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_00417FEF push 0FF1762Bh; iretd 4_2_00417FF4
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D4CA2 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_004D4CA2
Source: C:\Users\user\Desktop\injector V2.4.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\injector V2.4.exe System information queried: FirmwareTableInformation Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\injector V2.4.exe TID: 4744 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe TID: 4744 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\injector V2.4.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004DC72A FindFirstFileExW, 0_2_004DC72A
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004DC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_004DC7DB
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004DC72A FindFirstFileExW, 3_2_004DC72A
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004DC7DB FindFirstFileExW,FindNextFileW,FindClose,FindClose, 3_2_004DC7DB
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696428655f
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005365000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696428655p
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000002.2295589364.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002BA9000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696428655s
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696428655o
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696428655j
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005365000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: YNVMware
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: injector V2.4.exe, 00000004.00000003.2155622066.0000000005360000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\Desktop\injector V2.4.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 4_2_0043D920 LdrInitializeThunk, 4_2_0043D920
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D5444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_004D5444
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004CCD10 mov eax, dword ptr fs:[00000030h] 0_2_004CCD10
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004EB18D mov edi, dword ptr fs:[00000030h] 0_2_004EB18D
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004CBD50 mov edi, dword ptr fs:[00000030h] 0_2_004CBD50
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004CBD50 mov edi, dword ptr fs:[00000030h] 3_2_004CBD50
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004CCD10 mov eax, dword ptr fs:[00000030h] 3_2_004CCD10
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D9F90 GetProcessHeap, 0_2_004D9F90
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D5444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_004D5444
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D5438 SetUnhandledExceptionFilter, 0_2_004D5438
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D7DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_004D7DCA
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D4AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_004D4AD9
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004D5444 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_004D5444
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004D5438 SetUnhandledExceptionFilter, 3_2_004D5438
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004D7DCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_004D7DCA
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 3_2_004D4AD9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 3_2_004D4AD9

HIPS / PFW / Operating System Protection Evasion
barindex
Contains functionality to inject code into remote processes
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004EB18D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 0_2_004EB18D
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\injector V2.4.exe Memory written: C:\Users\user\Desktop\injector V2.4.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\injector V2.4.exe Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe" Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Process created: C:\Users\user\Desktop\injector V2.4.exe "C:\Users\user\Desktop\injector V2.4.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D5200 cpuid 0_2_004D5200
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\injector V2.4.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Code function: 0_2_004D58C5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_004D58C5
Source: C:\Users\user\Desktop\injector V2.4.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: injector V2.4.exe, 00000004.00000002.2295589364.0000000002B91000.00000004.00000020.00020000.00000000.sdmp, injector V2.4.exe, 00000004.00000003.2294286988.0000000002B91000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\injector V2.4.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: injector V2.4.exe PID: 6564, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\injector V2.4.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\injector V2.4.exe Directory queried: C:\Users\user\Documents Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: injector V2.4.exe PID: 6564, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: injector V2.4.exe PID: 6564, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1561470 Sample: injector V2.4.exe Startdate: 23/11/2024 Architecture: WINDOWS Score: 100 18 property-imper.sbs 2->18 22 Suricata IDS alerts for network traffic 2->22 24 Found malware configuration 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 4 other signatures 2->28 7 injector V2.4.exe 1 2->7         started        signatures3 process4 signatures5 30 Injects a PE file into a foreign processes 7->30 10 injector V2.4.exe 7->10         started        14 conhost.exe 7->14         started        16 injector V2.4.exe 7->16         started        process6 dnsIp7 20 property-imper.sbs 104.21.33.116, 443, 49704, 49705 CLOUDFLARENETUS United States 10->20 32 Query firmware table information (likely to detect VMs) 10->32 34 Tries to harvest and steal ftp login credentials 10->34 36 Tries to harvest and steal browser information (history, passwords, etc) 10->36 38 Tries to steal Crypto Currency Wallets 10->38 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.33.116
 property-imper.sbs United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
property-imper.sbs 104.21.33.116 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://property-imper.sbs/api false
    		high