Edit tour

Windows Analysis Report
XTN21MDFrg.exe

Overview

General Information

Sample name:	XTN21MDFrg.exe renamed because original name is a hash value
Original sample name:	962c5a8ed8af958eb0168b57c08cea04.exe
Analysis ID:	1561757
MD5:	962c5a8ed8af958eb0168b57c08cea04
SHA1:	33755435c11251f9ef63aabf3a81a80a89bd8844
SHA256:	249d5278ba7c7d8057bf3437cb5f36d63f8ee047ce8068e26e250ee4e3d776ed
Tags:	exeLummaStealeruser-abuse_ch
Infos:

Detection

LummaC

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

XTN21MDFrg.exe (PID: 2620 cmdline: "C:\Users\user\Desktop\XTN21MDFrg.exe" MD5: 962C5A8ED8AF958EB0168B57C08CEA04)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["3xc1aimbl0w.sbs", "300snails.sbs", "thicktoys.sbs", "faintbl0w.sbs"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.binstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: XTN21MDFrg.exe

Malware Configuration Extractor: LummaC {"C2 url": ["3xc1aimbl0w.sbs", "300snails.sbs", "thicktoys.sbs", "faintbl0w.sbs"]}

Multi AV Scanner detection for submitted file

Source: XTN21MDFrg.exe

ReversingLabs: Detection: 68%

Machine Learning detection for sample

Source: XTN21MDFrg.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: XTN21MDFrg.exe	String decryptor: faintbl0w.sbs
Source: XTN21MDFrg.exe	String decryptor: 300snails.sbs
Source: XTN21MDFrg.exe	String decryptor: 3xc1aimbl0w.sbs
Source: XTN21MDFrg.exe	String decryptor: thicktoys.sbs
Source: XTN21MDFrg.exe	String decryptor: lid=%s&j=%s&ver=4.0
Source: XTN21MDFrg.exe	String decryptor: TeslaBrowser/5.5
Source: XTN21MDFrg.exe	String decryptor: - Screen Resoluton:
Source: XTN21MDFrg.exe	String decryptor: - Physical Installed Memory:
Source: XTN21MDFrg.exe	String decryptor: Workgroup: -

Source: XTN21MDFrg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: XTN21MDFrg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 4C697C35h	0_2_00AE1050
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov word ptr [ebx], dx	0_2_00AB8890
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	0_2_00AC68D0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	0_2_00ACE03F
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-2FEE79D7h]	0_2_00AAD80D
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov byte ptr [edi], cl	0_2_00ACC81E
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+esi+04h]	0_2_00AC3850
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov byte ptr [edi], bl	0_2_00AA91B0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 4C697C35h	0_2_00AE11E0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ecx+5F30FA22h]	0_2_00AAB1D0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then jmp eax	0_2_00AC51D0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+000001ADh]	0_2_00AB990C
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movsx eax, byte ptr [esi]	0_2_00AE02F0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov ebx, edx	0_2_00ABC225
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movsx eax, byte ptr [esi]	0_2_00AE0210
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov byte ptr [edx], al	0_2_00ACE3BE
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov ecx, eax	0_2_00ABEB80
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00ABEB80
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00ABEB80
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-42FFC5DBh]	0_2_00AAD392
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx eax, byte ptr [esi+edx+00000420h]	0_2_00ACC3D0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov byte ptr [ebx], dl	0_2_00ACC3D0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-5B418B08h]	0_2_00ADC3D0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 98D5A07Fh	0_2_00ADC3D0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov ecx, eax	0_2_00ABD330
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+000000E8h]	0_2_00AAE4AF
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	0_2_00AE1480
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov ecx, eax	0_2_00AC6C90
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_00ACB4E0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00AD5CC0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then jmp eax	0_2_00AC5440
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx ebx, bx	0_2_00AC55A4
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov dword ptr [ebp-10h], edx	0_2_00AC4DA1
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-0CA2BA0Eh]	0_2_00AACDB0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx eax, byte ptr [edi]	0_2_00ADFDE0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movsx eax, byte ptr [esi]	0_2_00ADFDE0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00AC35F0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	0_2_00ACEDCA
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then jmp eax	0_2_00AC55D0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx edx, byte ptr [eax+ecx]	0_2_00AAAD20
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	0_2_00ACED09
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-7269D38Fh]	0_2_00AB8E83
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 32F24C0Bh	0_2_00ADBE60
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 1B6183F2h	0_2_00ADBFA0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_00ABFF90
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov edx, ecx	0_2_00AAC795
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov ebx, ecx	0_2_00AA77D0
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then movzx edx, word ptr [eax]	0_2_00AE1720
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then mov dword ptr [ecx], edi	0_2_00AAB769
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 9C142CDAh	0_2_00AE0F70
Source: C:\Users\user\Desktop\XTN21MDFrg.exe	Code function: 4x nop then jmp dword ptr [00AE6898h]	0_2_00AB9744

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 3xc1aimbl0w.sbs
Source: Malware configuration extractor	URLs: 300snails.sbs
Source: Malware configuration extractor	URLs: thicktoys.sbs
Source: Malware configuration extractor	URLs: faintbl0w.sbs