Windows Analysis Report
je9t0bDEVN.exe

Overview

General Information

Sample name: je9t0bDEVN.exe
(renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name: 4dc3d7a6e1bef7cabd6e5e6681f3640628887a6beea0e096416baff784df7a3b
Analysis ID: 1436381
MD5: 0df8abbbbc63aa2e171466a6cf93b172
SHA1: fb8e1da97308f5466ce438222a0ea1c28efaaf01
SHA256: 4dc3d7a6e1bef7cabd6e5e6681f3640628887a6beea0e096416baff784df7a3b
Infos:

Detection

LummaC
Score: 96
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
LummaC encrypted strings found
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
AV process strings found (often used to terminate AV products)
Contains functionality to read the PEB
Detected potential crypto function
Entry point lies outside standard sections
Found potential string decryption / allocating functions
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

AV Detection
barindex
Antivirus detection for URL or domain
Source: revivalsecularas.pw Avira URL Cloud: Label: malware
Source: bloockflad.pw Avira URL Cloud: Label: malware
Source: barbecueappledos.pw Avira URL Cloud: Label: malware
Source: keewoolas.pw Avira URL Cloud: Label: malware
Source: killredls.pw Avira URL Cloud: Label: malware
Source: steycools.pw Avira URL Cloud: Label: malware
Source: bookgames.pw Avira URL Cloud: Label: malware
Source: moskhoods.pw Avira URL Cloud: Label: malware
Source: dayzilons.pw Avira URL Cloud: Label: malware
Found malware configuration
Source: je9t0bDEVN.exe Malware Configuration Extractor: LummaC {"C2 url": ["barbecueappledos.pw", "killredls.pw", "keewoolas.pw", "moskhoods.pw", "dayzilons.pw", "revivalsecularas.pw", "steycools.pw", "bloockflad.pw", "bookgames.pw"], "Build id": "KjGtqi--Zinfandel"}
Multi AV Scanner detection for domain / URL
Source: bookgames.pw Virustotal: Detection: 15% Perma Link
Source: bloockflad.pw Virustotal: Detection: 14% Perma Link
Source: barbecueappledos.pw Virustotal: Detection: 11% Perma Link
Source: revivalsecularas.pw Virustotal: Detection: 15% Perma Link
Source: killredls.pw Virustotal: Detection: 15% Perma Link
Source: keewoolas.pw Virustotal: Detection: 15% Perma Link
Source: moskhoods.pw Virustotal: Detection: 16% Perma Link
Source: steycools.pw Virustotal: Detection: 14% Perma Link
Source: dayzilons.pw Virustotal: Detection: 12% Perma Link
Multi AV Scanner detection for submitted file
Source: je9t0bDEVN.exe ReversingLabs: Detection: 70%
Source: je9t0bDEVN.exe Virustotal: Detection: 48% Perma Link
Machine Learning detection for sample
Source: je9t0bDEVN.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: je9t0bDEVN.exe String decryptor: barbecueappledos.pw
Source: je9t0bDEVN.exe String decryptor: killredls.pw
Source: je9t0bDEVN.exe String decryptor: keewoolas.pw
Source: je9t0bDEVN.exe String decryptor: moskhoods.pw
Source: je9t0bDEVN.exe String decryptor: dayzilons.pw
Source: je9t0bDEVN.exe String decryptor: revivalsecularas.pw
Source: je9t0bDEVN.exe String decryptor: steycools.pw
Source: je9t0bDEVN.exe String decryptor: bloockflad.pw
Source: je9t0bDEVN.exe String decryptor: bookgames.pw
Source: je9t0bDEVN.exe String decryptor: lid=%s&j=%s&ver=4.0
Source: je9t0bDEVN.exe String decryptor: TeslaBrowser/5.5
Source: je9t0bDEVN.exe String decryptor: - Screen Resoluton:
Source: je9t0bDEVN.exe String decryptor: - Physical Installed Memory:
Source: je9t0bDEVN.exe String decryptor: Workgroup: -
Source: je9t0bDEVN.exe String decryptor: KjGtqi--Zinfandel
Uses 32bit PE files
Source: je9t0bDEVN.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: barbecueappledos.pw
Source: Malware configuration extractor URLs: killredls.pw
Source: Malware configuration extractor URLs: keewoolas.pw
Source: Malware configuration extractor URLs: moskhoods.pw
Source: Malware configuration extractor URLs: dayzilons.pw
Source: Malware configuration extractor URLs: revivalsecularas.pw
Source: Malware configuration extractor URLs: steycools.pw
Source: Malware configuration extractor URLs: bloockflad.pw
Source: Malware configuration extractor URLs: bookgames.pw
Source: Amcache.hve.4.dr String found in binary or memory: http://upx.sf.net
Detected potential crypto function
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0041C04D 0_2_0041C04D
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00451804 0_2_00451804
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_004188AD 0_2_004188AD
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00428172 0_2_00428172
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0041D97A 0_2_0041D97A
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_004272D8 0_2_004272D8
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00409B60 0_2_00409B60
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0040F3C4 0_2_0040F3C4
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0041DB99 0_2_0041DB99
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00404BAE 0_2_00404BAE
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0044A439 0_2_0044A439
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0044DDD0 0_2_0044DDD0
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0040C5DC 0_2_0040C5DC
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0041F5E4 0_2_0041F5E4
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0040CF58 0_2_0040CF58
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0040DF6A 0_2_0040DF6A
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00413777 0_2_00413777
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0041BF07 0_2_0041BF07
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00418F19 0_2_00418F19
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: String function: 0044D690 appears 34 times
One or more processes crash
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 356
Sample file is different than original file name gathered from version info
Source: je9t0bDEVN.exe, 00000000.00000000.1177490614.00000000007D7000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameQvConnect32.EXEZ vs je9t0bDEVN.exe
Source: je9t0bDEVN.exe Binary or memory string: OriginalFilenameQvConnect32.EXEZ vs je9t0bDEVN.exe
Uses 32bit PE files
Source: je9t0bDEVN.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal96.troj.evad.winEXE@2/5@0/0
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5992
Source: C:\Windows\SysWOW64\WerFault.exe File created: C:\ProgramData\Microsoft\Windows\WER\Temp\3e0d1180-cd5c-4327-90da-ccd17a8cd4f7 Jump to behavior
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: je9t0bDEVN.exe ReversingLabs: Detection: 70%
Source: je9t0bDEVN.exe Virustotal: Detection: 48%
Source: unknown Process created: C:\Users\user\Desktop\je9t0bDEVN.exe "C:\Users\user\Desktop\je9t0bDEVN.exe"
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 356
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Section loaded: wininet.dll Jump to behavior
Source: je9t0bDEVN.exe Static file information: File size 4132864 > 1048576
Source: je9t0bDEVN.exe Static PE information: Raw size of ./PING/2 is bigger than: 0x100000 < 0x262000
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: ./PING/2
PE file contains an invalid checksum
Source: je9t0bDEVN.exe Static PE information: real checksum: 0x284eca should be: 0x3f6de3
PE file contains sections with non-standard names
Source: je9t0bDEVN.exe Static PE information: section name: ./PING/0
Source: je9t0bDEVN.exe Static PE information: section name: ./PING/1
Source: je9t0bDEVN.exe Static PE information: section name: ./PING/2
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00412B0A push ebx; retf 0004h 0_2_00412B0D
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00776574 push 0F370C96h; mov dword ptr [esp], esi 0_2_0077657C
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00401DCF push eax; mov dword ptr [esp], 00000000h 0_2_00401DD4
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_004686B1 push ecx; ret 0_2_004686C4
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00415F5D push eax; ret 0_2_00415F5E
Source: je9t0bDEVN.exe Static PE information: section name: .text entropy: 6.8060853503210135
Source: je9t0bDEVN.exe Static PE information: section name: ./PING/0 entropy: 7.837674875091487
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: Amcache.hve.4.dr Binary or memory string: VMware
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.4.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_00465ADF mov eax, dword ptr fs:[00000030h] 0_2_00465ADF
Source: C:\Users\user\Desktop\je9t0bDEVN.exe Code function: 0_2_0045BEE6 mov ecx, dword ptr fs:[00000030h] 0_2_0045BEE6

HIPS / PFW / Operating System Protection Evasion
barindex
LummaC encrypted strings found
Source: je9t0bDEVN.exe, 00000000.00000000.1177245730.0000000000481000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: barbecueappledos.pw
Source: je9t0bDEVN.exe, 00000000.00000000.1177245730.0000000000481000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: killredls.pw
Source: je9t0bDEVN.exe, 00000000.00000000.1177245730.0000000000481000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: keewoolas.pw
Source: je9t0bDEVN.exe, 00000000.00000000.1177245730.0000000000481000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: moskhoods.pw
Source: je9t0bDEVN.exe, 00000000.00000000.1177245730.0000000000481000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: dayzilons.pw
Source: je9t0bDEVN.exe, 00000000.00000000.1177245730.0000000000481000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: revivalsecularas.pw
Source: je9t0bDEVN.exe, 00000000.00000000.1177245730.0000000000481000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: steycools.pw
Source: je9t0bDEVN.exe, 00000000.00000000.1177245730.0000000000481000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: bloockflad.pw
Source: je9t0bDEVN.exe, 00000000.00000000.1177245730.0000000000481000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: bookgames.pw
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.4.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.binstr, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.binstr, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1436381 Sample: je9t0bDEVN Startdate: 05/05/2024 Architecture: WINDOWS Score: 96 11 Multi AV Scanner detection for domain / URL 2->11 13 Found malware configuration 2->13 15 Antivirus detection for URL or domain 2->15 17 5 other signatures 2->17 6 je9t0bDEVN.exe 2->6         started        process3 signatures4 19 LummaC encrypted strings found 6->19 9 WerFault.exe 21 16 6->9         started        process5
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
keewoolas.pw true
  • 15%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
revivalsecularas.pw true
  • 15%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
killredls.pw true
  • 15%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
bloockflad.pw true
  • 14%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
barbecueappledos.pw true
  • 12%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
steycools.pw true
  • 14%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
bookgames.pw true
  • 15%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
moskhoods.pw true
  • 16%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
dayzilons.pw true
  • 13%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown