Edit tour

Windows Analysis Report
Yanto v1.2.exe

Overview

General Information

Sample name:	Yanto v1.2.exe
Analysis ID:	1629495
MD5:	a96437dbcc43f251b7fc23fa0649b25f
SHA1:	7a811aa9429fa05a326fae3f639c171ee3abfa49
SHA256:	ba5a20516de4e7659b70fb2c407700e530eb605120f57c9011b048182bf0f2ee
Tags:	exeuser-PC3463
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to modify clipboard data

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Yanto v1.2.exe (PID: 2072 cmdline: "C:\Users\user\Desktop\Yanto v1.2.exe" MD5: A96437DBCC43F251B7FC23FA0649B25F)

Yanto v1.2.exe (PID: 5700 cmdline: "C:\Users\user\Desktop\Yanto v1.2.exe" MD5: A96437DBCC43F251B7FC23FA0649B25F)

WerFault.exe (PID: 3876 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 792 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["sdfwfsdf.icu", "explorebieology.run", "gadgethgfub.icu", "moderzysics.top", "techmindzs.live", "codxefusion.top", "phygcsforum.life", "techspherxe.top"], "Build id": "LPnhqo--txfbcyyurkpw"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.3480754455.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Yanto v1.2.exe PID: 5700	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Yanto v1.2.exe PID: 5700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Yanto v1.2.exe PID: 5700	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.2.Yanto v1.2.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.Yanto v1.2.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0.2.Yanto v1.2.exe.36c9550.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T20:12:23.049139+0100	2028371	3	Unknown Traffic	192.168.2.5	49721	149.154.167.99	443	TCP
2025-03-04T20:12:23.867938+0100	2028371	3	Unknown Traffic	192.168.2.5	49728	188.114.97.3	443	TCP
2025-03-04T20:12:27.968333+0100	2028371	3	Unknown Traffic	192.168.2.5	49755	188.114.97.3	443	TCP
2025-03-04T20:12:48.593233+0100	2028371	3	Unknown Traffic	192.168.2.5	49882	188.114.97.3	443	TCP
2025-03-04T20:12:49.720590+0100	2028371	3	Unknown Traffic	192.168.2.5	49891	188.114.97.3	443	TCP
2025-03-04T20:12:50.850769+0100	2028371	3	Unknown Traffic	192.168.2.5	49898	188.114.97.3	443	TCP
2025-03-04T20:13:11.708536+0100	2028371	3	Unknown Traffic	192.168.2.5	50000	188.114.97.3	443	TCP
2025-03-04T20:13:13.086808+0100	2028371	3	Unknown Traffic	192.168.2.5	50001	188.114.97.3	443	TCP
2025-03-04T20:13:15.071481+0100	2028371	3	Unknown Traffic	192.168.2.5	50002	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T20:12:27.416593+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49728	188.114.97.3	443	TCP
2025-03-04T20:12:47.885558+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49755	188.114.97.3	443	TCP
2025-03-04T20:13:15.545924+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50002	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T20:12:27.416593+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49728	188.114.97.3	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-04T20:12:50.268136+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49891	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Yanto v1.2.exe

Avira: detected

Antivirus detection for URL or domain

Source: gadgethgfub.icu	Avira URL Cloud: Label: malware
Source: phygcsforum.life	Avira URL Cloud: Label: malware
Source: techmindzs.live	Avira URL Cloud: Label: malware
Source: techspherxe.top	Avira URL Cloud: Label: malware
Source: moderzysics.top	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["sdfwfsdf.icu", "explorebieology.run", "gadgethgfub.icu", "moderzysics.top", "techmindzs.live", "codxefusion.top", "phygcsforum.life", "techspherxe.top"], "Build id": "LPnhqo--txfbcyyurkpw"}

Multi AV Scanner detection for submitted file

Source: Yanto v1.2.exe	Virustotal: Detection: 56%			Perma Link
Source: Yanto v1.2.exe	ReversingLabs: Detection: 68%

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	String decryptor: sdfwfsdf.icu
Source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	String decryptor: explorebieology.run
Source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	String decryptor: gadgethgfub.icu
Source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	String decryptor: moderzysics.top
Source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	String decryptor: techmindzs.live
Source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	String decryptor: codxefusion.top
Source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	String decryptor: phygcsforum.life
Source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp	String decryptor: techspherxe.top

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Code function: 1_2_0041CD3B CryptUnprotectData,

1_2_0041CD3B

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50002 version: TLS 1.2

Source: Yanto v1.2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: mscorlib.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdbRSDS source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: Initial.pdbH source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: System.pdb) source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: Initial.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: C:\Users\Admin\source\repos\Initial\Initial\obj\Release\Initial.pdb source: Yanto v1.2.exe
Source:	Binary string: System.ni.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WERCB42.tmp.dmp.5.dr

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], CF91E6EAh	1_2_0044D092
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov dword ptr [esp+04h], eax	1_2_00447140
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp word ptr [edi+ebx], 0000h	1_2_0044F110
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	1_2_0044F110
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp word ptr [edi+eax], 0000h	1_2_0042A1D0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov word ptr [ecx], bx	1_2_00450220
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3BAFB92Ch]	1_2_00431BB0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov byte ptr [edi], bl	1_2_004124C8
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov byte ptr [edi], bl	1_2_004124C8
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	1_2_0041CD3B
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+00000178h]	1_2_0043A612
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then jmp ecx	1_2_0044AEE0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	1_2_0044AF60
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	1_2_0041BF30
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-02h]	1_2_00431040
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi-4E4A9AC8h]	1_2_0044E850
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+14h]	1_2_0044E850
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	1_2_0044B860
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax]	1_2_0044B860
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax-49AF8ABEh]	1_2_0044D007
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp word ptr [eax+edx+02h], 0000h	1_2_0040F0C0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi-4E4A9AC8h]	1_2_0044E8E0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+14h]	1_2_0044E8E0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ebp-000000A6h]	1_2_0040C8A0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov byte ptr [edx], bl	1_2_0040C8A0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov byte ptr [esp+ecx+0000015Ch], dl	1_2_0040E0B5
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi-4E4A9AC8h]	1_2_0044E970
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+14h]	1_2_0044E970
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6DFD4B04h]	1_2_00422930
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 7A542AABh	1_2_0044F990
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 7A542AABh	1_2_0044F990
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp byte ptr [ebx+esi], 00000000h	1_2_004329BE
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov ebx, eax	1_2_00408AF0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx+0000084Ah]	1_2_0042F2F0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 03E94F29h	1_2_0041D2B4
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then jmp eax	1_2_0042F34F
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	1_2_00414312
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h	1_2_00420332
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov dword ptr [esp+04h], ebx	1_2_0041DB3A
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx-51BF41D6h]	1_2_00439B91
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov dword ptr [esp], eax	1_2_00439B91
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax+0B86C702h]	1_2_00423BA0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov byte ptr [esi], cl	1_2_0043A3AC
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-02h]	1_2_00431421
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	1_2_0040A430
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	1_2_0040A430
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx-51BF41D6h]	1_2_00439C3F
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov dword ptr [esp], eax	1_2_00439C3F
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], B7070F87h	1_2_004144CB
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 93A82FD1h	1_2_004144CB
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx-51BF41D6h]	1_2_00439C82
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov dword ptr [esp], eax	1_2_00439C82
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov eax, ebx	1_2_00425C80
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then jmp eax	1_2_0044E489
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+10h]	1_2_0041148F
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_00435CA0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx-51BF41D6h]	1_2_00439D5A
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov dword ptr [esp], eax	1_2_00439D5A
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx-12h]	1_2_0043856B
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi-4E4A9AC8h]	1_2_0044E5C0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+14h]	1_2_0044E5C0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_004345F1
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+7E9EC506h]	1_2_0040DDFA
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	1_2_0042B580
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	1_2_0041CDB0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	1_2_0041BE50
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov byte ptr [eax], cl	1_2_00420E54
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-02h]	1_2_00431676
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov dword ptr [esp], ecx	1_2_00433E10
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00443E30
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 743EDB10h	1_2_0044F6D0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+115A8F32h]	1_2_0041EEF5
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edi, byte ptr [esp+esi-4E4A9AC8h]	1_2_0044E6B0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+14h]	1_2_0044E6B0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov ecx, edi	1_2_0041EEB6
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov dword ptr [esp+14h], eax	1_2_00448F2D
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edx-0000008Ah]	1_2_0044EF30
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then movzx eax, byte ptr [esp+esi-3E070A74h]	1_2_0044DFC0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], AEA6ACAEh	1_2_00434F90

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49728 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49728 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49755 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49891 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50002 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: sdfwfsdf.icu
Source: Malware configuration extractor	URLs: explorebieology.run
Source: Malware configuration extractor	URLs: gadgethgfub.icu
Source: Malware configuration extractor	URLs: moderzysics.top
Source: Malware configuration extractor	URLs: techmindzs.live
Source: Malware configuration extractor	URLs: codxefusion.top
Source: Malware configuration extractor	URLs: phygcsforum.life
Source: Malware configuration extractor	URLs: techspherxe.top

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49728 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49721 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49755 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49898 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49882 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50000 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50001 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50002 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49891 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /kz_prokla1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sdfwfsdf.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 55Host: sdfwfsdf.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CT1EF82YMEOEOJ6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12826Host: sdfwfsdf.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WEK103GUJ9MDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15050Host: sdfwfsdf.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZDTR4R0ARRMLAYVNVDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20576Host: sdfwfsdf.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WO9O4BXNMFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2417Host: sdfwfsdf.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PS8QPJO0H0DC1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570436Host: sdfwfsdf.icu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 89Host: sdfwfsdf.icu

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /kz_prokla1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: sdfwfsdf.icu

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sdfwfsdf.icu

Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: Yanto v1.2.exe, 00000001.00000002.3481463980.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sdfwfsdf.icu/
Source: Yanto v1.2.exe, 00000001.00000002.3481463980.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sdfwfsdf.icu/4os
Source: Yanto v1.2.exe, 00000001.00000002.3481224006.0000000000F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sdfwfsdf.icu/api
Source: Yanto v1.2.exe, 00000001.00000002.3481224006.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sdfwfsdf.icu/apiM6
Source: Yanto v1.2.exe, 00000001.00000002.3481463980.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sdfwfsdf.icu/apiore
Source: Yanto v1.2.exe, 00000001.00000002.3481463980.0000000000FD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sdfwfsdf.icu/ds

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:50002 version: TLS 1.2

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Code function: 1_2_00441570 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

1_2_00441570

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Code function: 1_2_03391000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

1_2_03391000

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Code function: 1_2_00441570 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,

1_2_00441570

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Code function: 1_2_00441D75 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

1_2_00441D75

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 0_2_00CF25E0	0_2_00CF25E0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004398EC	1_2_004398EC
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00447140	1_2_00447140
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044D1BF	1_2_0044D1BF
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044F220	1_2_0044F220
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00431BB0	1_2_00431BB0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004124C8	1_2_004124C8
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0040BC80	1_2_0040BC80
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044FCA0	1_2_0044FCA0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00438D46	1_2_00438D46
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041FD79	1_2_0041FD79
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041CD3B	1_2_0041CD3B
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00446DE0	1_2_00446DE0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00416DA8	1_2_00416DA8
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00418700	1_2_00418700
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041BF30	1_2_0041BF30
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0042E7D6	1_2_0042E7D6
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00413FD6	1_2_00413FD6
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00401040	1_2_00401040
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00431040	1_2_00431040
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00421851	1_2_00421851
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044E850	1_2_0044E850
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044B860	1_2_0044B860
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00407006	1_2_00407006
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00404812	1_2_00404812
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00425020	1_2_00425020
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00426030	1_2_00426030
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00444839	1_2_00444839
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004090D0	1_2_004090D0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004298D0	1_2_004298D0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044E8E0	1_2_0044E8E0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004390E7	1_2_004390E7
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0040C8A0	1_2_0040C8A0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004268A0	1_2_004268A0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004498B3	1_2_004498B3
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00428140	1_2_00428140
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044515F	1_2_0044515F
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0043E960	1_2_0043E960
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044E970	1_2_0044E970
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00422930	1_2_00422930
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0042F130	1_2_0042F130
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044F990	1_2_0044F990
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004259A0	1_2_004259A0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0043F1A5	1_2_0043F1A5
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004179B5	1_2_004179B5
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004329BE	1_2_004329BE
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044CA6D	1_2_0044CA6D
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00418219	1_2_00418219
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00445AE5	1_2_00445AE5
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00408AF0	1_2_00408AF0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0042F2F0	1_2_0042F2F0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00448AF0	1_2_00448AF0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041D2B4	1_2_0041D2B4
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00448340	1_2_00448340
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00402B50	1_2_00402B50
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00432379	1_2_00432379
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00439317	1_2_00439317
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0040FB20	1_2_0040FB20
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00441320	1_2_00441320
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00420332	1_2_00420332
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041DB3A	1_2_0041DB3A
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00415BC4	1_2_00415BC4
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041E3CF	1_2_0041E3CF
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004313D7	1_2_004313D7
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00438D46	1_2_00438D46
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00439B91	1_2_00439B91
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00422396	1_2_00422396
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0042139D	1_2_0042139D
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00430C50	1_2_00430C50
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00446460	1_2_00446460
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0043C468	1_2_0043C468
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00431421	1_2_00431421
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0040A430	1_2_0040A430
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00439C3F	1_2_00439C3F
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00439C82	1_2_00439C82
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00425C80	1_2_00425C80
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044B4B0	1_2_0044B4B0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00414D50	1_2_00414D50
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00439D5A	1_2_00439D5A
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00438503	1_2_00438503
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041F532	1_2_0041F532
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044E5C0	1_2_0044E5C0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004375E0	1_2_004375E0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00432DEA	1_2_00432DEA
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0042EDF0	1_2_0042EDF0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004345F1	1_2_004345F1
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0042B580	1_2_0042B580
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00403590	1_2_00403590
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00407DB0	1_2_00407DB0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0040CDB0	1_2_0040CDB0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041CDB0	1_2_0041CDB0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00409650	1_2_00409650
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00431676	1_2_00431676
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0043D60F	1_2_0043D60F
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0042E610	1_2_0042E610
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00433E10	1_2_00433E10
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0040AE30	1_2_0040AE30
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041D639	1_2_0041D639
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004466C0	1_2_004466C0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00411ED0	1_2_00411ED0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0043B6D1	1_2_0043B6D1
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044F6D0	1_2_0044F6D0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0041EEF5	1_2_0041EEF5
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044E6B0	1_2_0044E6B0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0042AF20	1_2_0042AF20
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00448F2D	1_2_00448F2D
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00403F30	1_2_00403F30
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00447F30	1_2_00447F30
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0040BFC0	1_2_0040BFC0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0044DFC0	1_2_0044DFC0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_0043DFFE	1_2_0043DFFE
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00421F80	1_2_00421F80
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00434F90	1_2_00434F90
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004027A0	1_2_004027A0
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_004117A0	1_2_004117A0

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: String function: 0041BF20 appears 127 times
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: String function: 0040B440 appears 42 times

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 792

Source: Yanto v1.2.exe, 00000000.00000002.2265640627.000000000089E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs Yanto v1.2.exe

Source: Yanto v1.2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Yanto v1.2.exe

Static PE information: Section: .CSS ZLIB complexity 1.0003246265453296

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/5@2/2

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Code function: 1_2_00447140 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

1_2_00447140

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2072

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\f651ca3d-f34a-4c58-9159-63b22b42c60d

Jump to behavior

Source: Yanto v1.2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Yanto v1.2.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Yanto v1.2.exe	Virustotal: Detection: 56%
Source: Yanto v1.2.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\Yanto v1.2.exe

File read: C:\Users\user\Desktop\Yanto v1.2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Yanto v1.2.exe "C:\Users\user\Desktop\Yanto v1.2.exe"
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process created: C:\Users\user\Desktop\Yanto v1.2.exe "C:\Users\user\Desktop\Yanto v1.2.exe"
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 792
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process created: C:\Users\user\Desktop\Yanto v1.2.exe "C:\Users\user\Desktop\Yanto v1.2.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Yanto v1.2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Yanto v1.2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Yanto v1.2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Windows.Forms.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: mscorlib.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdbRSDS source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: Initial.pdbH source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: System.pdb) source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: Initial.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: C:\Users\Admin\source\repos\Initial\Initial\obj\Release\Initial.pdb source: Yanto v1.2.exe
Source:	Binary string: System.ni.pdb source: WERCB42.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WERCB42.tmp.dmp.5.dr

Source: Yanto v1.2.exe

Static PE information: 0xE13E9B06 [Sat Oct 1 03:41:58 2089 UTC]

Source: Yanto v1.2.exe

Static PE information: section name: .CSS

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00400000 push ss; retf	1_2_00400081
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00454885 push ds; iretd	1_2_00454887
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 1_2_00452401 push edi; ret	1_2_00452414

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Yanto v1.2.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Yanto v1.2.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Memory allocated: CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Memory allocated: 26C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Memory allocated: 24D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Window / User API: threadDelayed 4301

Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe TID: 5552	Thread sleep time: -150000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe TID: 5284	Thread sleep count: 4301 > 30			Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Last function: Thread delayed

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Yanto v1.2.exe, 00000001.00000002.3481224006.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp, Yanto v1.2.exe, 00000001.00000002.3481145169.0000000000F3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\Yanto v1.2.exe

API call chain: ExitProcess graph end node

graph_1-23361

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Code function: 1_2_0044CF20 LdrInitializeThunk,

1_2_0044CF20

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 0_2_026C212D mov edi, dword ptr fs:[00000030h]		0_2_026C212D
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Code function: 0_2_026C22AA mov edi, dword ptr fs:[00000030h]		0_2_026C22AA

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Code function: 0_2_026C212D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_026C212D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Memory written: C:\Users\user\Desktop\Yanto v1.2.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Process created: C:\Users\user\Desktop\Yanto v1.2.exe "C:\Users\user\Desktop\Yanto v1.2.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Queries volume information: C:\Users\user\Desktop\Yanto v1.2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\Yanto v1.2.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Yanto v1.2.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: 1.2.Yanto v1.2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Yanto v1.2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Yanto v1.2.exe.36c9550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3480754455.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Yanto v1.2.exe, 00000001.00000002.3481224006.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: Yanto v1.2.exe, 00000001.00000002.3481224006.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Yanto v1.2.exe, 00000001.00000002.3481224006.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: Yanto v1.2.exe, 00000001.00000002.3481224006.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Yanto v1.2.exe, 00000001.00000002.3481145169.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Yanto v1.2.exe, 00000001.00000002.3481145169.0000000000F20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Yanto v1.2.exe, 00000001.00000002.3481224006.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Yanto v1.2.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY			Jump to behavior
Source: C:\Users\user\Desktop\Yanto v1.2.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY			Jump to behavior

Source: Yara match

File source: Process Memory Space: Yanto v1.2.exe PID: 5700, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Yanto v1.2.exe PID: 5700, type: MEMORYSTR
Source: Yara match	File source: 1.2.Yanto v1.2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Yanto v1.2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Yanto v1.2.exe.36c9550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2270486915.00000000036C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3480754455.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	23 Virtualization/Sandbox Evasion	2 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	23 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	3 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Yanto v1.2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Yanto v1.2.exe