Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
14OWDrfahJ.exe

Overview

General Information

Sample Name:14OWDrfahJ.exe
Original Sample Name:725dbfed269993cb9944c2e1f7bde652.exe
Analysis ID:1345577
MD5:725dbfed269993cb9944c2e1f7bde652
SHA1:7104f1350e38ec3c3ea49154f1bba976572cb271
SHA256:6db8fff48b37469101d280c3e60463c27ace26ea8076e94e358ae74e49fb46ac
Tags:exeLummaStealer
Infos:

Detection

PrivateLoader, RedLine, RisePro Stealer, SmokeLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected RedLine Stealer
Yara detected RisePro Stealer
Yara detected SmokeLoader
Antivirus detection for URL or domain
Antivirus detection for dropped file
Snort IDS alert for network traffic
Found malware configuration
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Yara detected PrivateLoader
Tries to steal Mail credentials (via file / registry access)
Found stalling execution ending in API Sleep call
PE file has a writeable .text section
Machine Learning detection for sample
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
.NET source code contains very large array initializations
Contains functionality to inject code into remote processes
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to inject threads in other processes
Found decision node followed by non-executed suspicious APIs
Drops PE files to the application program directory (C:\ProgramData)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
Uses the system / local time for branch decision (may execute only at specific dates)
Contains long sleeps (>= 3 min)
May check the online IP address of the machine
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Creates a start menu entry (Start Menu\Programs\Startup)
Installs a Chrome extension
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
Internet Provider seen in connection with other malware
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Enables debug privileges
Queries information about the installed CPU (vendor, model number etc)
AV process strings found (often used to terminate AV products)
Found inlined nop instructions (likely shell or obfuscated code)
PE file does not import any functions
Sample file is different than original file name gathered from version info
PE file contains an invalid checksum
Extensive use of GetProcAddress (often used to hide API calls)
Detected TCP or UDP traffic on non-standard ports
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Uses Microsoft's Enhanced Cryptographic Provider
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • 14OWDrfahJ.exe (PID: 7296 cmdline: C:\Users\user\Desktop\14OWDrfahJ.exe MD5: 725DBFED269993CB9944C2E1F7BDE652)
    • Ey3OF47.exe (PID: 7312 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Ey3OF47.exe MD5: A8089B11ACB5AEB2755B87605CC0365C)
      • BC5tT98.exe (PID: 7328 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\BC5tT98.exe MD5: CC54031BCC9F48998C7AE467ACF73422)
        • 2Iu7231.exe (PID: 7344 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\2Iu7231.exe MD5: EFBF47DBDF08AC3A28C0236D9C0A4C27)
          • conhost.exe (PID: 7352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • AppLaunch.exe (PID: 7984 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 89D41E1CF478A3D3C2C701A27A5692B2)
        • 3rB05VU.exe (PID: 8008 cmdline: C:\Users\user\AppData\Local\Temp\IXP002.TMP\3rB05VU.exe MD5: 5158C4F1C895E03E3157643FBA44BF15)
          • schtasks.exe (PID: 8044 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
            • conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • schtasks.exe (PID: 8092 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
            • conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • rundll32.exe (PID: 7468 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: EF3179D498793BF4234F708D3BE28633)
  • rundll32.exe (PID: 7600 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\ MD5: EF3179D498793BF4234F708D3BE28633)
  • rundll32.exe (PID: 7740 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP002.TMP\ MD5: EF3179D498793BF4234F708D3BE28633)
  • OfficeTrackerNMP131.exe (PID: 8156 cmdline: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe MD5: 5158C4F1C895E03E3157643FBA44BF15)
  • OfficeTrackerNMP131.exe (PID: 8172 cmdline: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe MD5: 5158C4F1C895E03E3157643FBA44BF15)
  • MaxLoonaFest131.exe (PID: 10520 cmdline: "C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe" MD5: 5158C4F1C895E03E3157643FBA44BF15)
  • MaxLoonaFest131.exe (PID: 10636 cmdline: "C:\Users\user\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe" MD5: 5158C4F1C895E03E3157643FBA44BF15)
  • FANBooster131.exe (PID: 10828 cmdline: "C:\Users\user\AppData\Local\Temp\FANBooster131\FANBooster131.exe" MD5: 5158C4F1C895E03E3157643FBA44BF15)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
PrivateLoaderAccording to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader
NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
NameDescriptionAttributionBlogpost URLsLink
SmokeLoaderThe SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER