Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1596738
MD5:	d72d18d95f5fef9487e66d67e01eab9d
SHA1:	f3f3f03b584586a9c3ae9cca68604792026d20ef
SHA256:	cb68cc8427e2cd42153c53aadab9f7ff8cd1550be2fef1e96f9e7f7cecc0baa5
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

LummaC Stealer, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

random.exe (PID: 6524 cmdline: "C:\Users\user\Desktop\random.exe" MD5: D72D18D95F5FEF9487E66D67E01EAB9D)

random.exe (PID: 6788 cmdline: "C:\Users\user\Desktop\random.exe" MD5: D72D18D95F5FEF9487E66D67E01EAB9D)

random.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\random.exe" MD5: D72D18D95F5FEF9487E66D67E01EAB9D)

WerFault.exe (PID: 6532 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 920 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": "https://impolitewearr.biz/api", "Build Version": "pqZnKP--S2FsYXNoMW"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
random.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2027197577.0000000000262000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2268346574.0000000003549000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: random.exe PID: 6756	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.0.random.exe.260000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.random.exe.3549550.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.random.exe.3549550.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T12:49:56.022547+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.16.1	443	TCP
2025-01-22T12:49:57.146277+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.16.1	443	TCP
2025-01-22T12:49:58.712751+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.16.1	443	TCP
2025-01-22T12:49:59.984318+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.16.1	443	TCP
2025-01-22T12:50:01.326591+0100	2028371	3	Unknown Traffic	192.168.2.5	49714	104.21.16.1	443	TCP
2025-01-22T12:50:02.975886+0100	2028371	3	Unknown Traffic	192.168.2.5	49715	104.21.16.1	443	TCP
2025-01-22T12:50:04.966013+0100	2028371	3	Unknown Traffic	192.168.2.5	49716	104.21.16.1	443	TCP
2025-01-22T12:50:07.171576+0100	2028371	3	Unknown Traffic	192.168.2.5	49717	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T12:49:56.656605+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.16.1	443	TCP
2025-01-22T12:49:58.050431+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.16.1	443	TCP
2025-01-22T12:50:07.651828+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49717	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T12:49:56.656605+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.16.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T12:49:58.050431+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.16.1	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (immolatechallen .bond)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T12:49:55.516692+0100	2059225	1	Domain Observed Used for C2 Detected	192.168.2.5	63705	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T12:50:03.426768+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49715	104.21.16.1	443	TCP

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: impolitewearr.biz

Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: random.exe, 00000002.00000002.2153495691.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000002.00000002.2153337035.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000002.00000002.2153495691.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impolitewearr.biz/
Source: random.exe, 00000002.00000002.2153495691.0000000000CC7000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000002.00000002.2153337035.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000002.00000002.2153495691.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000002.00000002.2153495691.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impolitewearr.biz/api
Source: random.exe, 00000002.00000002.2153495691.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impolitewearr.biz/e
Source: random.exe, 00000002.00000002.2153495691.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impolitewearr.biz:443/apiMicrosoft
Source: random.exe, 00000002.00000002.2153495691.0000000000CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://impolitewearr.biz:443/apitPK

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: C:\Users\user\Desktop\random.exe

Code function: 2_2_004383B0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_004383B0

Source: C:\Users\user\Desktop\random.exe

Code function: 2_2_004383B0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

2_2_004383B0

Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004450E0	2_2_004450E0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00432133	2_2_00432133
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00445AD0	2_2_00445AD0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0040E2E6	2_2_0040E2E6
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00408280	2_2_00408280
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043DC50	2_2_0043DC50
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00410E7D	2_2_00410E7D
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00415E38	2_2_00415E38
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00422EE0	2_2_00422EE0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00440EF0	2_2_00440EF0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042A730	2_2_0042A730
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00401040	2_2_00401040
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042F850	2_2_0042F850
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043505D	2_2_0043505D
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043E860	2_2_0043E860
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00416808	2_2_00416808
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00444810	2_2_00444810
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00404820	2_2_00404820
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043C0C8	2_2_0043C0C8
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041C8E0	2_2_0041C8E0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041E0FE	2_2_0041E0FE
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043D090	2_2_0043D090
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042C8A0	2_2_0042C8A0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004448B0	2_2_004448B0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041D950	2_2_0041D950
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00409170	2_2_00409170
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043F12E	2_2_0043F12E
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041F130	2_2_0041F130
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004059C0	2_2_004059C0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004299E0	2_2_004299E0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004061F0	2_2_004061F0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00427250	2_2_00427250
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00425264	2_2_00425264
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041227A	2_2_0041227A
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00430A2B	2_2_00430A2B
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004312C2	2_2_004312C2
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043D2F0	2_2_0043D2F0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00411A80	2_2_00411A80
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041C290	2_2_0041C290
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042DAA7	2_2_0042DAA7
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004162B3	2_2_004162B3
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00436300	2_2_00436300
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041732B	2_2_0041732B
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00402B30	2_2_00402B30
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00414B30	2_2_00414B30
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00441330	2_2_00441330
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041EB39	2_2_0041EB39
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042ABC0	2_2_0042ABC0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00432BE0	2_2_00432BE0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041E0FE	2_2_0041E0FE
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00445440	2_2_00445440
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0040BC52	2_2_0040BC52
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00416C08	2_2_00416C08
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00439C21	2_2_00439C21
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00434C3A	2_2_00434C3A
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004274E0	2_2_004274E0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042ACE1	2_2_0042ACE1
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004184E6	2_2_004184E6
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004424EE	2_2_004424EE
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041949D	2_2_0041949D
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00418CA0	2_2_00418CA0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00423CA0	2_2_00423CA0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00408CB0	2_2_00408CB0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043ECB0	2_2_0043ECB0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00403540	2_2_00403540
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00430541	2_2_00430541
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00444550	2_2_00444550
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00407D60	2_2_00407D60
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00405D60	2_2_00405D60
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00405500	2_2_00405500
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004345C1	2_2_004345C1
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041A5D0	2_2_0041A5D0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043E5D0	2_2_0043E5D0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0040A5F0	2_2_0040A5F0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00429D90	2_2_00429D90
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004365A0	2_2_004365A0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004225B0	2_2_004225B0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042BDBB	2_2_0042BDBB
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00444640	2_2_00444640
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042B652	2_2_0042B652
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041D655	2_2_0041D655
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042D660	2_2_0042D660
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00427661	2_2_00427661
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0040F66C	2_2_0040F66C
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00441670	2_2_00441670
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00412630	2_2_00412630
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00428E31	2_2_00428E31
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00420EE0	2_2_00420EE0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00403EF0	2_2_00403EF0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00415690	2_2_00415690
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043EE90	2_2_0043EE90
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00426F49	2_2_00426F49
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0040C760	2_2_0040C760
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00444760	2_2_00444760
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00402770	2_2_00402770
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041F700	2_2_0041F700
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00445710	2_2_00445710
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0043B719	2_2_0043B719
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00443F35	2_2_00443F35
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00406FD0	2_2_00406FD0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004237D0	2_2_004237D0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0041E7E0	2_2_0041E7E0
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_004177EA	2_2_004177EA
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0042C7F7	2_2_0042C7F7

Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00414B20 appears 94 times
Source: C:\Users\user\Desktop\random.exe	Code function: String function: 00407B60 appears 50 times

Source: C:\Users\user\Desktop\random.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 920

Source: random.exe

Static PE information: invalid certificate

Source: random.exe, 00000000.00000002.2266234032.00000000009DE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs random.exe

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: random.exe

Static PE information: Section: .bsS ZLIB complexity 1.0003350801777435

Source: random.exe, G3EBK1rdW8n7xuLhGg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: random.exe, G3EBK1rdW8n7xuLhGg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.random.exe.3549550.0.raw.unpack, G3EBK1rdW8n7xuLhGg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.random.exe.3549550.0.raw.unpack, G3EBK1rdW8n7xuLhGg.cs	Cryptographic APIs: 'CreateDecryptor'

Source: random.exe, Program.cs	Base64 encoded string: 'YzMyMTVmZTM3MmQwNWZjMDkxNzY2NTRiZGEyYzhhMDIyZjY2ZTg1MDBkN2U4OWNmYTliM2NmNTkzYjY5MjVmZQ=='
Source: 0.2.random.exe.3549550.0.raw.unpack, Program.cs	Base64 encoded string: 'YzMyMTVmZTM3MmQwNWZjMDkxNzY2NTRiZGEyYzhhMDIyZjY2ZTg1MDBkN2U4OWNmYTliM2NmNTkzYjY5MjVmZQ=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/5@2/1

Source: C:\Users\user\Desktop\random.exe

Code function: 2_2_0043DC50 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

2_2_0043DC50

Source: C:\Users\user\Desktop\random.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6524

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\07e5ef70-4390-4990-b3fb-9fb2abfa0935

Jump to behavior

Source: random.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: random.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: random.exe	Virustotal: Detection: 48%
Source: random.exe	ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\random.exe

File read: C:\Users\user\Desktop\random.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6524 -s 920
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: random.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: random.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: random.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Windows.Forms.pdb source: WERF021.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WERF021.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdbRSDS source: WERF021.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WERF021.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdb source: WERF021.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERF021.tmp.dmp.6.dr
Source:	Binary string: Abacost.pdb source: random.exe, WERF021.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdb source: WERF021.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WERF021.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERF021.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WERF021.tmp.dmp.6.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: random.exe, G3EBK1rdW8n7xuLhGg.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),ClGAa1LAa5jeh1symTo(typeof(Type).TypeHandle)})
Source: 0.2.random.exe.3549550.0.raw.unpack, G3EBK1rdW8n7xuLhGg.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),ClGAa1LAa5jeh1symTo(typeof(Type).TypeHandle)})

Source: random.exe

Static PE information: 0x84DB26BC [Sun Aug 19 02:06:52 2040 UTC]

Source: random.exe

Static PE information: real checksum: 0x671bc should be: 0x71d0f

Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0044A8CE push ebp; iretd	2_2_0044A8D2
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_00444500 push eax; mov dword ptr [esp], FCFFFED1h	2_2_00444501
Source: C:\Users\user\Desktop\random.exe	Code function: 2_2_0044B660 push cs; retf	2_2_0044B661

Source: random.exe, zIpx4jg4rK8h8VLKg8p.cs	High entropy of concatenated method names: 'qr0gBkBYOl', 's3mgtIyxM5', 'A77g90gj4d', 'osVgpliDCf', 'q1sgkRD4Ek', 'JOWgFWSpSj', 'NScg2CrOq1', 'mg1gbiWgdl', 'u3bgopPfsW', 'IQQgq5NBjI'
Source: random.exe, G3EBK1rdW8n7xuLhGg.cs	High entropy of concatenated method names: 'Jx9y5ByhvYSEmJFh5aM', 'tlpEKnyQHffSFMxLGQm', 'JFQsUkcwgw', 'sdQX61y4nO5wlCxMCEs', 'elTxMyyDhS9RbVVfIE7', 'Kh8mdmyKf69ZWs1o1Wh', 'vQvBUgycd7qTRPnDKc2', 'nW4lBacjpc', 'q0Ggwr9pio', 'r6Ygsbq6N1'
Source: 0.2.random.exe.3549550.0.raw.unpack, zIpx4jg4rK8h8VLKg8p.cs	High entropy of concatenated method names: 'qr0gBkBYOl', 's3mgtIyxM5', 'A77g90gj4d', 'osVgpliDCf', 'q1sgkRD4Ek', 'JOWgFWSpSj', 'NScg2CrOq1', 'mg1gbiWgdl', 'u3bgopPfsW', 'IQQgq5NBjI'
Source: 0.2.random.exe.3549550.0.raw.unpack, G3EBK1rdW8n7xuLhGg.cs	High entropy of concatenated method names: 'Jx9y5ByhvYSEmJFh5aM', 'tlpEKnyQHffSFMxLGQm', 'JFQsUkcwgw', 'sdQX61y4nO5wlCxMCEs', 'elTxMyyDhS9RbVVfIE7', 'Kh8mdmyKf69ZWs1o1Wh', 'vQvBUgycd7qTRPnDKc2', 'nW4lBacjpc', 'q0Ggwr9pio', 'r6Ygsbq6N1'

Source: C:\Users\user\Desktop\random.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\random.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\random.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Memory allocated: 23B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory allocated: 2540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Memory allocated: 4540000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\random.exe TID: 5968

Thread sleep time: -150000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: random.exe, 00000002.00000002.2153337035.0000000000C76000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000002.00000002.2153337035.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Code function: 2_2_00442B70 LdrInitializeThunk,

2_2_00442B70

Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_02545411 mov edi, dword ptr fs:[00000030h]		0_2_02545411
Source: C:\Users\user\Desktop\random.exe	Code function: 0_2_0254558E mov edi, dword ptr fs:[00000030h]		0_2_0254558E

Source: C:\Users\user\Desktop\random.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\random.exe

Code function: 0_2_02545411 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02545411

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\random.exe

Memory written: C:\Users\user\Desktop\random.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"			Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"			Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\Users\user\Desktop\random.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: random.exe, 00000002.00000002.2153495691.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\random.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: random.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected PureLog Stealer

Source: Yara match	File source: random.exe, type: SAMPLE
Source: Yara match	File source: 0.0.random.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.random.exe.3549550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.random.exe.3549550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2027197577.0000000000262000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2268346574.0000000003549000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: random.exe, 00000002.00000002.2153337035.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: random.exe, 00000002.00000002.2153337035.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: random.exe, 00000002.00000002.2153337035.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: random.exe, 00000002.00000002.2153337035.0000000000C8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: random.exe, 00000000.00000002.2268346574.0000000003549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: random.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected PureLog Stealer

Source: Yara match	File source: random.exe, type: SAMPLE
Source: Yara match	File source: 0.0.random.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.random.exe.3549550.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.random.exe.3549550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2027197577.0000000000262000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2268346574.0000000003549000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	23 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	Security Account Manager	23 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: https://impolitewearr.biz/	Avira URL Cloud: Label: malware
Source: https://impolitewearr.biz:443/apiMicrosoft	Avira URL Cloud: Label: malware
Source: https://impolitewearr.biz/api	Avira URL Cloud: Label: malware
Source: https://impolitewearr.biz/e	Avira URL Cloud: Label: malware
Source: https://impolitewearr.biz:443/apitPK	Avira URL Cloud: Label: malware

Source: Network traffic	Suricata IDS: 2059225 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (immolatechallen .bond) : 192.168.2.5:63705 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49715 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49717 -> 104.21.16.1:443

Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49715 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49714 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49716 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49717 -> 104.21.16.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: impolitewearr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: impolitewearr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K9WWMM3R4R3D9ITSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12828Host: impolitewearr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NWYAPCLTULTXU6B8USUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: impolitewearr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=U3HC5E39GC8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20530Host: impolitewearr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9HPE3XT87OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2412Host: impolitewearr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5QCB5QKI2VUDF0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585844Host: impolitewearr.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: impolitewearr.biz

Source: random.exe	Virustotal: Detection: 48%			Perma Link
Source: random.exe	ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 07CFF38Ch	2_2_00446180
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [edi+ebx*8], CD5A394Bh	2_2_00445AD0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx]	2_2_00445AD0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], CD5A394Bh	2_2_00445AD0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ecx, eax	2_2_00431C8F
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 0BF86EC6h	2_2_0040E559
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-63h]	2_2_0042A730
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], C8B478E8h	2_2_0042A730
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ecx, eax	2_2_0042A730
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	2_2_00444FD0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2C331E1Fh	2_2_00443791
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov edi, dword ptr [ebp+3Ch]	2_2_00444810
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	2_2_00444810
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-18h]	2_2_0040983A
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov edi, ecx	2_2_0041C8E0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_0041C8E0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov esi, ecx	2_2_0041C8E0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0041D0FE
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov byte ptr [edi], cl	2_2_0041D0FE
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx eax, byte ptr [eax+edx]	2_2_0042C8A0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004190A6
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	2_2_0043F8B0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx]	2_2_0043F8B0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov edi, dword ptr [ebp+3Ch]	2_2_004448B0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	2_2_004448B0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], C6BF57D2h	2_2_00441140
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ecx, eax	2_2_00441140
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0041D950
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2C331E1Fh	2_2_0040E157
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	2_2_0043F12E
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx]	2_2_0043F12E
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx]	2_2_0043F12E
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+6925FFC5h]	2_2_0040C1BA
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov byte ptr [edi], bl	2_2_00408A40
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0043AA40
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then jmp eax	2_2_00442A77
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov byte ptr [esi], cl	2_2_00430A2B
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then jmp eax	2_2_00442AC7
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp byte ptr [edx+edi+23h], 00000000h	2_2_00409AC7
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ebx, eax	2_2_0041C290
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-4EA63BC3h]	2_2_0040C2B9
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_0042E360
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then lea ecx, dword ptr [esp+00000098h]	2_2_0041732B
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+02h]	2_2_0041F3C0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ebx, ecx	2_2_0042ABC0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then push eax	2_2_00442BCF
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+2Fh]	2_2_0042ABE0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 089E115Eh	2_2_00445440
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ecx, eax	2_2_00445440
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	2_2_00420C70
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov eax, dword ptr [004499C4h]	2_2_0040C47F
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+7CD13928h]	2_2_00442CC8
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ebx, ecx	2_2_0042ACE1
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	2_2_00444C80
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+21138DFFh]	2_2_0041949D
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+482B3730h]	2_2_00408CB0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ebx, edx	2_2_00444550
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov edi, dword ptr [ebp+3Ch]	2_2_00444550
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	2_2_00444550
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-00000092h]	2_2_0041A5D0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 4802CC78h	2_2_0041A5D0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov edx, ecx	2_2_0041A5D0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov edx, ecx	2_2_0041A5D0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 215672F7h	2_2_0041A5D0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+21138D9Fh]	2_2_0041A5D0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ecx, eax	2_2_0041CDDC
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-2E766E11h]	2_2_00409DE7
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ecx, edx	2_2_0040A5F0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp word ptr [edi+esi+02h], 0000h	2_2_004225B0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ebx, edx	2_2_00444640
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov edi, dword ptr [ebp+3Ch]	2_2_00444640
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	2_2_00444640
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 2C1F0655h	2_2_00441670
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov ebx, edx	2_2_00441670
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-07A97D4Ah]	2_2_00428E31
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov edi, dword ptr [ebp+3Ch]	2_2_00444760
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	2_2_00444760
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], A0C7EB40h	2_2_0040E72D
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	2_2_00406FD0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	2_2_00406FD0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004237D0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_004237D0
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then lea ecx, dword ptr [esp+00000098h]	2_2_004177EA
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000138h]	2_2_004177EA
Source: C:\Users\user\Desktop\random.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+28h]	2_2_004177EA

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: immolatechallen.bond
Source: global traffic	DNS traffic detected: DNS query: impolitewearr.biz

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
random.exe