Windows Analysis Report
Uqt8tDIQYk.exe

Overview

General Information

Sample name: Uqt8tDIQYk.exe
renamed because original name is a hash value
Original sample name: 26422abceca3d5ce14d064e290678221.exe
Analysis ID: 1430596
MD5: 26422abceca3d5ce14d064e290678221
SHA1: 9bde1cf1e554872705cc38c9591b77b59c3aa597
SHA256: 495a744f783348c8a6ef1c048ea3e62d3903b00c66e9be21bb374d59d18b682e
Tags: exeLummaStealer
Infos:

Detection

LummaC Stealer
Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
Found API chain indicative of sandbox detection
Machine Learning detection for sample
PE file contains section with special chars
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect sandboxes (mouse cursor move detection)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query network adapater information
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains sections with non-standard names
Program does not show much activity (idle)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Uqt8tDIQYk.exe Avira: detected
Antivirus detection for URL or domain
Source: blockbeerman.fun Avira URL Cloud: Label: malware
Found malware configuration
Source: Uqt8tDIQYk.exe Malware Configuration Extractor: LummaC {"C2 url": ["blockbeerman.fun"], "Build Id": "GRAKRA--SHELL"}
Multi AV Scanner detection for submitted file
Source: Uqt8tDIQYk.exe ReversingLabs: Detection: 84%
Machine Learning detection for sample
Source: Uqt8tDIQYk.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00439948 _strlen,CryptStringToBinaryA,CryptStringToBinaryA, 0_2_00439948
Uses 32bit PE files
Source: Uqt8tDIQYk.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Binary string: storagewmi_passthru.pdbGCTL source: Uqt8tDIQYk.exe
Source: Binary string: storagewmi_passthru.pdb source: Uqt8tDIQYk.exe
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00457BCC FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00457BCC

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: blockbeerman.fun
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0043A3A3 GetProcAddress,InternetQueryDataAvailable,GetProcAddress,GetProcAddress,InternetReadFile,GetModuleHandleW,GetProcAddress,GetProcAddress,_strlen,InternetQueryDataAvailable,GetProcAddress,GetProcAddress, 0_2_0043A3A3

System Summary
barindex
PE file contains section with special chars
Source: Uqt8tDIQYk.exe Static PE information: section name: .'w(
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040B3D2 LoadLibraryA,GetProcAddress,NtRaiseHardError,ExitProcess, 0_2_0040B3D2
Detected potential crypto function
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004258A1 0_2_004258A1
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040AAA8 0_2_0040AAA8
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040B3D2 0_2_0040B3D2
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00417059 0_2_00417059
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0045E000 0_2_0045E000
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0041980D 0_2_0041980D
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00411828 0_2_00411828
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0041B0E3 0_2_0041B0E3
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0041494F 0_2_0041494F
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0044E960 0_2_0044E960
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00414918 0_2_00414918
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0042313B 0_2_0042313B
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004351E0 0_2_004351E0
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004309FA 0_2_004309FA
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0043D195 0_2_0043D195
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00440A50 0_2_00440A50
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00431A18 0_2_00431A18
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004242CB 0_2_004242CB
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00421AEE 0_2_00421AEE
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004632E8 0_2_004632E8
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00403AEF 0_2_00403AEF
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00447293 0_2_00447293
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0044F2BB 0_2_0044F2BB
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0043EB69 0_2_0043EB69
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040C332 0_2_0040C332
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004063F8 0_2_004063F8
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00425383 0_2_00425383
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0043A3A3 0_2_0043A3A3
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040E3BC 0_2_0040E3BC
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00420C54 0_2_00420C54
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00444C74 0_2_00444C74
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00426C70 0_2_00426C70
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004284D0 0_2_004284D0
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00439CD6 0_2_00439CD6
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004044DC 0_2_004044DC
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00433C90 0_2_00433C90
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00418D43 0_2_00418D43
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040EDD3 0_2_0040EDD3
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004165A5 0_2_004165A5
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00454E54 0_2_00454E54
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0043DE6F 0_2_0043DE6F
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004466CF 0_2_004466CF
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004186EB 0_2_004186EB
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_004226F8 0_2_004226F8
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00411E8E 0_2_00411E8E
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0045BF5E 0_2_0045BF5E
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00413F74 0_2_00413F74
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00415F39 0_2_00415F39
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00419FE1 0_2_00419FE1
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040D78C 0_2_0040D78C
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00443FB4 0_2_00443FB4
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: String function: 00440310 appears 50 times
Uses 32bit PE files
Source: Uqt8tDIQYk.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal96.troj.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Command line argument: ~&E 0_2_004525D0
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Uqt8tDIQYk.exe ReversingLabs: Detection: 84%
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe File read: C:\Users\user\Desktop\Uqt8tDIQYk.exe Jump to behavior
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Section loaded: wininet.dll Jump to behavior
Source: Binary string: storagewmi_passthru.pdbGCTL source: Uqt8tDIQYk.exe
Source: Binary string: storagewmi_passthru.pdb source: Uqt8tDIQYk.exe
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040B3D2 LoadLibraryA,GetProcAddress,NtRaiseHardError,ExitProcess, 0_2_0040B3D2
PE file contains sections with non-standard names
Source: Uqt8tDIQYk.exe Static PE information: section name: .'w(
Source: Uqt8tDIQYk.exe Static PE information: section name: ucnttp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040192C push eax; mov dword ptr [esp], 00000000h 0_2_00401931
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00458378 push ecx; ret 0_2_0045838B
Source: Uqt8tDIQYk.exe Static PE information: section name: .text entropy: 6.8318134628828755
Source: Uqt8tDIQYk.exe Static PE information: section name: .'w( entropy: 7.197097448912549

Malware Analysis System Evasion
barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Sandbox detection routine: GetCursorPos, DecisionNode, Sleep
Contains functionality to detect sandboxes (mouse cursor move detection)
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: Sleep,Sleep,GetCursorPos,Sleep,GetCursorPos,GetCursorPos,GetCursorPos, 0_2_004258A1
Contains functionality to query network adapater information
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: GetAdaptersInfo,GetAdaptersInfo, 0_2_004226F8
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe API coverage: 2.7 %
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00457BCC FindFirstFileExW,FindNextFileW,FindClose,FindClose, 0_2_00457BCC
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe API call chain: ExitProcess graph end node
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00440135 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00440135
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0040B3D2 LoadLibraryA,GetProcAddress,NtRaiseHardError,ExitProcess, 0_2_0040B3D2
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0043EB69 mov eax, dword ptr fs:[00000030h] 0_2_0043EB69
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00449B9A mov ecx, dword ptr fs:[00000030h] 0_2_00449B9A
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00455725 mov eax, dword ptr fs:[00000030h] 0_2_00455725
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00431A18 GetProcessHeap,GetDIBits,ReleaseDC,GetProcessHeap,GetObjectW,GetProcessHeap,HeapAlloc,GetDC,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,HeapFree,HeapFree,GetProcessHeap,HeapFree, 0_2_00431A18
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00440129 SetUnhandledExceptionFilter, 0_2_00440129
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00440135 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00440135
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00440640 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00440640
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00453F4B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00453F4B
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00440358 cpuid 0_2_00440358
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_0044C351 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z, 0_2_0044C351
Source: C:\Users\user\Desktop\Uqt8tDIQYk.exe Code function: 0_2_00459824 GetTimeZoneInformation, 0_2_00459824

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Uqt8tDIQYk.exe, type: SAMPLE
Source: Yara match File source: 0.2.Uqt8tDIQYk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.Uqt8tDIQYk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2877797183.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Uqt8tDIQYk.exe, type: SAMPLE
Source: Yara match File source: 0.2.Uqt8tDIQYk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.Uqt8tDIQYk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.2877797183.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430596 Sample: Uqt8tDIQYk.exe Startdate: 23/04/2024 Architecture: WINDOWS Score: 96 8 Found malware configuration 2->8 10 Antivirus detection for URL or domain 2->10 12 Antivirus / Scanner detection for submitted sample 2->12 14 5 other signatures 2->14 5 Uqt8tDIQYk.exe 2->5         started        process3 signatures4 16 Found API chain indicative of sandbox detection 5->16
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
blockbeerman.fun true
  • Avira URL Cloud: malware
 unknown