File name:

PotentialLummaC2Cinfected.zip

Full analysis: https://app.any.run/tasks/61bc2d9d-a294-4233-a244-9f8075e34da5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: November 01, 2024, 08:13:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
evasion
rat
quasar
remote
github
lumma
stealer
exfiltration
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

9E5157CBB3AD6E7D5136213DA77CE13B

SHA1:

ABE195D97807B8DBB15C182B60B6A5209112E1B9

SHA256:

0E6FC77A72DD0B4C8F8FE7607C92EAC7CF5B0D607C9904E09D9FB1B2128A2E51

SSDEEP:

196608:ptmf7ctoeXc2oM2yEhk+9aoZ1I0sBxrlEbRE8r06JrFODIR85f5:+qoqcrM0ybooBxZE9xBJrgMa5B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • QUASAR has been detected (SURICATA)

      • jerniuiopu.exe (PID: 1712)
      • hbfgjhhesfd.exe (PID: 1784)
    • Adds path to the Windows Defender exclusion list

      • CapCut.exe (PID: 1168)
      • cmd.exe (PID: 7116)
    • Connects to the CnC server

      • svchost.exe (PID: 2172)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2172)
      • pdf.exe (PID: 2816)
    • QUASAR has been detected (YARA)

      • hbfgjhhesfd.exe (PID: 1784)
      • jerniuiopu.exe (PID: 1712)
  • SUSPICIOUS

    • Connects to unusual port

      • fgthawd.exe (PID: 5948)
      • mhbiwejrtgha.exe (PID: 7164)
      • jerniuiopu.exe (PID: 1712)
      • hbfgjhhesfd.exe (PID: 1784)
      • kldrgawdtjawd.exe (PID: 6736)
    • Checks for external IP

      • hbfgjhhesfd.exe (PID: 1784)
      • svchost.exe (PID: 2172)
      • jerniuiopu.exe (PID: 1712)
      • kldrgawdtjawd.exe (PID: 6736)
    • Application launched itself

      • CapCut.exe (PID: 1576)
    • Contacting a server suspected of hosting an CnC

      • jerniuiopu.exe (PID: 1712)
      • hbfgjhhesfd.exe (PID: 1784)
      • svchost.exe (PID: 2172)
      • pdf.exe (PID: 2816)
    • Starts CMD.EXE for commands execution

      • CapCut.exe (PID: 1168)
    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7116)
    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 7116)
    • Executable content was dropped or overwritten

      • CapCut.exe (PID: 1168)
    • There is functionality for taking screenshot (YARA)

      • jerniuiopu.exe (PID: 1712)
      • hbfgjhhesfd.exe (PID: 1784)
  • INFO

    • Manual execution by a user

      • hbfgjhhesfd.exe (PID: 1784)
      • fgthawd.exe (PID: 5948)
      • mhbiwejrtgha.exe (PID: 7164)
      • kldrgawdtjawd.exe (PID: 6736)
      • jerniuiopu.exe (PID: 1712)
      • OpenWith.exe (PID: 2928)
      • CapCut.exe (PID: 1576)
      • OpenWith.exe (PID: 2376)
      • OpenWith.exe (PID: 3916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(1712) jerniuiopu.exe
Version1.4.0.0
C2 (2)82.117.243.110:5173
Sub_DirSubDir
Install_Namecsrss.exe
MutexyfsS9ida0wX8mgpdJC
StartupNET framework
TagOffice
LogDirLogs
Signature
Certificate
(PID) Process(1784) hbfgjhhesfd.exe
Version1.4.0.0
C2 (2)82.117.243.110:5173
Sub_DirSubDir
Install_Namecsrss.exe
MutexedH11NGQWIdCwvLx00
StartupFramework
TagOffice
LogDirLogs
Signature
Certificate
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:10:31 15:24:30
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: -pril-main/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
17
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs mhbiwejrtgha.exe fgthawd.exe #QUASAR jerniuiopu.exe #QUASAR hbfgjhhesfd.exe kldrgawdtjawd.exe #LUMMA svchost.exe capcut.exe no specs conhost.exe no specs capcut.exe conhost.exe no specs openwith.exe no specs openwith.exe no specs cmd.exe no specs powershell.exe no specs openwith.exe no specs #LUMMA pdf.exe

Process information

PID
CMD
Path
Indicators
Parent process
1168"C:\Users\admin\Desktop\CapCut.exe" C:\Users\admin\Desktop\CapCut.exe
CapCut.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\capcut.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1576"C:\Users\admin\Desktop\CapCut.exe" C:\Users\admin\Desktop\CapCut.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\capcut.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1712"C:\Users\admin\Desktop\jerniuiopu.exe" C:\Users\admin\Desktop\jerniuiopu.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.0.0
Modules
Images
c:\users\admin\desktop\jerniuiopu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Quasar
(PID) Process(1712) jerniuiopu.exe
Version1.4.0.0
C2 (2)82.117.243.110:5173
Sub_DirSubDir
Install_Namecsrss.exe
MutexyfsS9ida0wX8mgpdJC
StartupNET framework
TagOffice
LogDirLogs
Signature
Certificate
1784"C:\Users\admin\Desktop\hbfgjhhesfd.exe" C:\Users\admin\Desktop\hbfgjhhesfd.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.0.0
Modules
Images
c:\users\admin\desktop\hbfgjhhesfd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Quasar
(PID) Process(1784) hbfgjhhesfd.exe
Version1.4.0.0
C2 (2)82.117.243.110:5173
Sub_DirSubDir
Install_Namecsrss.exe
MutexedH11NGQWIdCwvLx00
StartupFramework
TagOffice
LogDirLogs
Signature
Certificate
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2376"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\Accord.targetsC:\Windows\System32\OpenWith.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2816"C:\Lipras\pdf.exe"C:\Lipras\pdf.exe
CapCut.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\lipras\pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2928"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\53d3700f-8780-469d-82fa-f94ad757c81bC:\Windows\System32\OpenWith.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3916"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\cf70993d-8432-4f90-8bf0-5666ccca4145C:\Windows\System32\OpenWith.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4380"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\PotentialLummaC2Cinfected.zipC:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
31 689
Read events
31 575
Write events
114
Delete events
0

Modification events

(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\PotentialLummaC2Cinfected.zip
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
(PID) Process:(4380) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:type
Value:
120
Executable files
2
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1784hbfgjhhesfd.exeC:\Users\admin\AppData\Roaming\Logs\11-01-2024binary
MD5:3DAA04C9B9150F105C72F4407D38B1CE
SHA256:F4B4568EAEA54D2E3C7C168D9C9E7D30C6E3954838F437CED0735BCE13291DCA
1168CapCut.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\ktyhpldea[1].exeexecutable
MD5:E9A83661D98FCA881CD4497A985A20DE
SHA256:F8DBFF120F44CF68BCB802C11F24BBC506F11803E8745883A0F650DECEA1DB47
5912powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:C3C177D6064E475EA52203F2445E9D24
SHA256:C20EA7AE6DFC71A813BC1524A48E4EA272DC982DDB79BCE5B3E336213D3B5266
5912powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_32eud1ce.c4f.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5912powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_u1viqzio.4te.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1168CapCut.exeC:\Lipras\pdf.exeexecutable
MD5:E9A83661D98FCA881CD4497A985A20DE
SHA256:F8DBFF120F44CF68BCB802C11F24BBC506F11803E8745883A0F650DECEA1DB47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
38
DNS requests
11
Threats
31

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1784
hbfgjhhesfd.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
shared
1712
jerniuiopu.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
shared
5488
MoUsoCoreWorker.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6944
svchost.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6944
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6736
kldrgawdtjawd.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
shared
GET
302
140.82.121.4:443
https://github.com/vonuch1/start/raw/refs/heads/main/ktyhpldea.exe
unknown
GET
200
140.82.121.4:443
https://raw.githubusercontent.com/vonuch1/start/refs/heads/main/ktyhpldea.exe
unknown
executable
1.23 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
5488
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2.23.209.135:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
whitelisted
6944
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5488
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
23.32.185.131:80
www.microsoft.com
AKAMAI-AS
BR
whitelisted
6944
svchost.exe
23.32.185.131:80
www.microsoft.com
AKAMAI-AS
BR
whitelisted
5488
MoUsoCoreWorker.exe
23.32.185.131:80
www.microsoft.com
AKAMAI-AS
BR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.23.209.135
  • 2.23.209.140
  • 2.23.209.144
  • 2.23.209.193
  • 2.23.209.131
  • 2.23.209.141
  • 2.23.209.133
  • 2.23.209.148
  • 2.23.209.130
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 23.32.185.131
whitelisted
ip-api.com
  • 208.95.112.1
malicious
github.com
  • 140.82.121.3
shared
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.110.133
shared
navygenerayk.store
  • 188.114.96.3
  • 188.114.97.3
malicious
self.events.data.microsoft.com
  • 20.42.65.85
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
1784
hbfgjhhesfd.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
2172
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
1784
hbfgjhhesfd.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1712
jerniuiopu.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1712
jerniuiopu.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
6736
kldrgawdtjawd.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1784
hbfgjhhesfd.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] QuasarRAT Successful Connection (TCP)
1712
jerniuiopu.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] QuasarRAT Successful Connection (TCP)
2172
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2 ETPRO signatures available at the full report
No debug info