Malware analysis https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbWdmTlNPYzR5NWxrRHlPYkJXMmpMRXBIRF9WUXxBQ3Jtc0tsQ255RGZxSkpfTEVRbE1hR3VXUFR3M3BjQjhPMURvdlUwVWRwcHFBc3poVGp1b3ZIVGN2c1pDOVAzYWk2U1UyZ3F1QnptRHk4anB4TWwyaXlTNDc5cDV5V0RoQ3c4V05ua0x3MWVxVDFUZkVwTHR4UQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Frh92lfjknxdql%2FGame%2BSetup%2B2024 Malicious activity

analyze malware

Huge database of samples and IOCs
Custom VM setup
Unlimited submissions
Interactive approach

Add for printing

URL:	https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbWdmTlNPYzR5NWxrRHlPYkJXMmpMRXBIRF9WUXxBQ3Jtc0tsQ255RGZxSkpfTEVRbE1hR3VXUFR3M3BjQjhPMURvdlUwVWRwcHFBc3poVGp1b3ZIVGN2c1pDOVAzYWk2U1UyZ3F1QnptRHk4anB4TWwyaXlTNDc5cDV5V0RoQ3c4V05ua0x3MWVxVDFUZkVwTHR4UQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Frh92lfjknxdql%2FGame%2BSetup%2B2024
Full analysis:	https://app.any.run/tasks/95ef16e6-9b36-496b-a6b4-bb4115b26b78
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat. Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	July 14, 2024 at 04:55:12
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	lumma stealer loader xmrig pastebin miner
Indicators:
MD5:	575215D8A16E90A42F7E55AC318592A4
SHA1:	48A52AEAF59BB310460864C5C768A791BFFE6304
SHA256:	7C83A717E777FA0A976FE3165F13FC5B4D259FF2A65E774E9B633A8A7F3C9D0D
SSDEEP:	6:2OLUxGKmquxZSOWue2e4wSVHYgUuwy0HBmBVdeW/s1et8GxHp3/83zh3eG4sDUPR:2jGRPPS4e2euYAwnHBmjdJU88IHsF3eZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- LUMMA has been detected (SURICATA)
  - RegAsm.exe (PID: 7128)
- Drops the executable file immediately after the start
  - RegAsm.exe (PID: 7128)
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
  - 7z.exe (PID: 1048)
  - cmd.exe (PID: 3936)
  - 7z.exe (PID: 4772)
  - 7z.exe (PID: 836)
  - Installer.exe (PID: 3832)
- Actions looks like stealing of personal data
  - RegAsm.exe (PID: 7128)
- XMRig has been detected
  - Installer.exe (PID: 3832)
- Uses Task Scheduler to run other applications
  - cmd.exe (PID: 2128)
  - cmd.exe (PID: 2520)
SUSPICIOUS
- Process drops legitimate windows executable
  - WinRAR.exe (PID: 6304)
- The process creates files with name similar to system file names
  - WinRAR.exe (PID: 6304)
  - Installer.exe (PID: 3832)
- Reads security settings of Internet Explorer
  - WinRAR.exe (PID: 6304)
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
- Searches for installed software
  - RegAsm.exe (PID: 7128)
- Potential Corporate Privacy Violation
  - RegAsm.exe (PID: 7128)
  - Installer.exe (PID: 3832)
- Process requests binary or script from the Internet
  - RegAsm.exe (PID: 7128)
  - Installer.exe (PID: 3832)
- Contacting a server suspected of hosting an CnC
  - RegAsm.exe (PID: 7128)
- Connects to the server without a host name
  - RegAsm.exe (PID: 7128)
  - Installer.exe (PID: 3832)
- Drops 7-zip archiver for unpacking
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
- Executable content was dropped or overwritten
  - RegAsm.exe (PID: 7128)
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
  - 7z.exe (PID: 836)
  - cmd.exe (PID: 3936)
  - Installer.exe (PID: 3832)
- Reads the date of Windows installation
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
- Starts CMD.EXE for commands execution
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
  - Installer.exe (PID: 3832)
- Executing commands from a ".bat" file
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
- The executable file from the user directory is run by the CMD process
  - 7z.exe (PID: 1048)
  - 7z.exe (PID: 4772)
  - 7z.exe (PID: 836)
  - Installer.exe (PID: 5488)
  - Installer.exe (PID: 5300)
  - Installer.exe (PID: 3832)
- Uses ATTRIB.EXE to modify file attributes
  - cmd.exe (PID: 3936)
- Base64-obfuscated command line is found
  - cmd.exe (PID: 5524)
- BASE64 encoded PowerShell command has been detected
  - cmd.exe (PID: 5524)
- Starts POWERSHELL.EXE for commands execution
  - cmd.exe (PID: 5524)
- Creates file in the systems drive root
  - Installer.exe (PID: 3832)
  - chrome.exe (PID: 2476)
- Drops a system driver (possible attempt to evade defenses)
  - Installer.exe (PID: 3832)
- Crypto Currency Mining Activity Detected
  - Installer.exe (PID: 3832)
INFO
- Reads Microsoft Office registry keys
  - chrome.exe (PID: 5604)
- The process uses the downloaded file
  - WinRAR.exe (PID: 6304)
  - chrome.exe (PID: 4148)
  - chrome.exe (PID: 5604)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 6304)
- Reads the software policy settings
  - slui.exe (PID: 368)
  - RegAsm.exe (PID: 7128)
  - slui.exe (PID: 2028)
  - Installer.exe (PID: 3832)
- Application launched itself
  - chrome.exe (PID: 5604)
- Checks supported languages
  - Setup.exe (PID: 5732)
  - RegAsm.exe (PID: 7128)
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
  - 7z.exe (PID: 1048)
  - mode.com (PID: 780)
  - 7z.exe (PID: 4772)
  - 7z.exe (PID: 836)
  - Installer.exe (PID: 3832)
- Reads the computer name
  - RegAsm.exe (PID: 7128)
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
  - 7z.exe (PID: 1048)
  - 7z.exe (PID: 836)
  - 7z.exe (PID: 4772)
  - Installer.exe (PID: 3832)
- Create files in a temporary directory
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
  - RegAsm.exe (PID: 7128)
  - 7z.exe (PID: 1048)
  - 7z.exe (PID: 4772)
  - 7z.exe (PID: 836)
  - Installer.exe (PID: 3832)
- Drops the executable file immediately after the start
  - WinRAR.exe (PID: 6304)
- Process checks computer location settings
  - F4PF5OV9PC232XW34MSVO4HT.exe (PID: 776)
- Disables trace logs
  - Installer.exe (PID: 3832)
- Checks proxy server information
  - slui.exe (PID: 2028)
  - Installer.exe (PID: 3832)
- Creates files in the program directory
  - Installer.exe (PID: 3832)
- Reads the machine GUID from the registry
  - Installer.exe (PID: 3832)
- Reads Environment values
  - Installer.exe (PID: 3832)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 4536)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

198

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

5604

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints "https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbWdmTlNPYzR5NWxrRHlPYkJXMmpMRXBIRF9WUXxBQ3Jtc0tsQ255RGZxSkpfTEVRbE1hR3VXUFR3M3BjQjhPMURvdlUwVWRwcHFBc3poVGp1b3ZIVGN2c1pDOVAzYWk2U1UyZ3F1QnptRHk4anB4TWwyaXlTNDc5cDV5V0RoQ3c4V05ua0x3MWVxVDFUZkVwTHR4UQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Frh92lfjknxdql%2FGame%2BSetup%2B2024"

C:\Program Files\Google\Chrome\Application\chrome.exe

explorer.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

2392

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffd94d4dc40,0x7ffd94d4dc4c,0x7ffd94d4dc58

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

6284

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1928 --field-trial-handle=1908,i,12071345838269714465,2287970173672130342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

6296

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2172 --field-trial-handle=1908,i,12071345838269714465,2287970173672130342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

6340

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2356 --field-trial-handle=1908,i,12071345838269714465,2287970173672130342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

6604

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1908,i,12071345838269714465,2287970173672130342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

6616

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1908,i,12071345838269714465,2287970173672130342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

2308

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4568 --field-trial-handle=1908,i,12071345838269714465,2287970173672130342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

4264

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4688 --field-trial-handle=1908,i,12071345838269714465,2287970173672130342,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

2176

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Exit code:

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

Add for printing

Total events

42 619

Read events

42 403

Write events

202

Delete events

Modification events


(PID) Process:	(5604) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(5604) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(5604) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:	write	Name:	StatusCodes
Value:
(PID) Process:	(5604) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:	write	Name:	StatusCodes
Value: 01000000
(PID) Process:	(5604) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(5604) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:	write	Name:	dr
Value: 1
(PID) Process:	(5604) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(5604) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Chrome
Operation:	write	Name:	UsageStatsInSample
Value: 0
(PID) Process:	(5604) chrome.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:	write	Name:	usagestats
Value: 0
(PID) Process:	(5604) chrome.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:	write	Name:	metricsid
Value:

Add for printing

Executable files

566

Suspicious files

199

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
5604	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
5604	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old		—
		MD5:—	SHA256:—
5604	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
5604	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF1cfd91.TMP		—
		MD5:—	SHA256:—
5604	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old		—
		MD5:—	SHA256:—
5604	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1cfd91.TMP		—
		MD5:—	SHA256:—
5604	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old		—
		MD5:—	SHA256:—
5604	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old		—
		MD5:—	SHA256:—
5604	chrome.exe	C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\LAST VERSION		text
		MD5:FCE53E052E5CF7C20819320F374DEA88	SHA256:CD95DE277E746E92CC2C53D9FC92A8F6F0C3EDFB7F1AD9A4E9259F927065BC89
5604	chrome.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old		text
		MD5:19D1A06251A8678F85D8DE5BFAB83807	SHA256:AA6E55DCF84CDAF0BD3F913E7B837F65500E9B71A5A7AA773D02FFBC18C7FF01

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

162

DNS requests

122

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6064	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4752	svchost.exe	GET	200	23.216.77.19:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5288	svchost.exe	GET	206	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3	unknown	—	—	whitelisted
5288	svchost.exe	HEAD	200	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3	unknown	—	—	whitelisted
4656	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
6508	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5288	svchost.exe	GET	206	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3	unknown	—	—	whitelisted
6516	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5288	svchost.exe	GET	206	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3	unknown	—	—	whitelisted
5288	svchost.exe	GET	206	34.104.35.123:80	http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihinmdlkakkaopbjbbcngflc_120.0.6050.0_all_dgzfpknn7v3zslsbhrwu6bt44e.crx3	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4032	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4752	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
4656	SearchApp.exe	104.126.37.176:443	www.bing.com	Akamai International B.V.	DE	unknown
1292	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4448	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4656	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
6064	svchost.exe	40.126.32.136:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	unknown
6064	svchost.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
5604	chrome.exe	239.255.255.250:1900	—	—	—	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208	whitelisted
www.bing.com	104.126.37.176 104.126.37.171 104.126.37.130 104.126.37.178 104.126.37.128 104.126.37.131 104.126.37.186 104.126.37.139 104.126.37.170	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
google.com	142.250.184.206	whitelisted
login.live.com	40.126.32.136 40.126.32.134 20.190.160.20 40.126.32.76 20.190.160.17 40.126.32.72 20.190.160.22 40.126.32.140	whitelisted
www.youtube.com	142.250.184.238 216.58.212.174 142.250.185.206 142.250.74.206 142.250.181.238 142.250.186.174 142.250.185.110 172.217.16.206 142.250.185.78 142.250.186.78 142.250.185.174 142.250.185.238 216.58.206.78 142.250.185.142 216.58.206.46 172.217.18.110	whitelisted
accounts.google.com	173.194.79.84	whitelisted
go.microsoft.com	184.30.17.189	whitelisted
nexusrules.officeapps.live.com	52.111.227.11	whitelisted
www.gstatic.com	142.250.184.227	whitelisted

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
—	—	Potentially Bad Traffic	ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
—	—	Potentially Bad Traffic	ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
—	—	Potentially Bad Traffic	ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
—	—	Domain Observed Used for C2 Detected	ET MALWARE Lumma Stealer Related CnC Domain in DNS Lookup (contemplateodszsv .shop)
—	—	Domain Observed Used for C2 Detected	ET MALWARE Observed Lumma Stealer Related Domain (contemplateodszsv .shop in TLS SNI)
—	—	A Network Trojan was detected	STEALER [ANY.RUN] Lumma Stealer TLS Connection
—	—	Domain Observed Used for C2 Detected	ET MALWARE Observed Lumma Stealer Related Domain (contemplateodszsv .shop in TLS SNI)
—	—	Domain Observed Used for C2 Detected	ET MALWARE Observed Lumma Stealer Related Domain (contemplateodszsv .shop in TLS SNI)
—	—	Domain Observed Used for C2 Detected	ET MALWARE Observed Lumma Stealer Related Domain (contemplateodszsv .shop in TLS SNI)

1 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

575215D8A16E90A42F7E55AC318592A4

48A52AEAF59BB310460864C5C768A791BFFE6304

7C83A717E777FA0A976FE3165F13FC5B4D259FF2A65E774E9B633A8A7F3C9D0D

6:2OLUxGKmquxZSOWue2e4wSVHYgUuwy0HBmBVdeW/s1et8GxHp3/83zh3eG4sDUPR:2jGRPPS4e2euYAwnHBmjdJU88IHsF3eZ

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

LUMMA has been detected (SURICATA)

Drops the executable file immediately after the start

Actions looks like stealing of personal data

XMRig has been detected

Uses Task Scheduler to run other applications

SUSPICIOUS

Process drops legitimate windows executable

The process creates files with name similar to system file names

Reads security settings of Internet Explorer

Searches for installed software

Potential Corporate Privacy Violation

Process requests binary or script from the Internet

Contacting a server suspected of hosting an CnC

Connects to the server without a host name

Drops 7-zip archiver for unpacking

Executable content was dropped or overwritten

Reads the date of Windows installation

Starts CMD.EXE for commands execution

Executing commands from a ".bat" file

The executable file from the user directory is run by the CMD process

Uses ATTRIB.EXE to modify file attributes

Base64-obfuscated command line is found

BASE64 encoded PowerShell command has been detected

Starts POWERSHELL.EXE for commands execution

Creates file in the systems drive root

Drops a system driver (possible attempt to evade defenses)

Crypto Currency Mining Activity Detected

INFO

Reads Microsoft Office registry keys

The process uses the downloaded file

Executable content was dropped or overwritten

Reads the software policy settings

Application launched itself

Checks supported languages

Reads the computer name

Create files in a temporary directory

Drops the executable file immediately after the start

Process checks computer location settings

Disables trace logs

Checks proxy server information

Creates files in the program directory

Reads the machine GUID from the registry

Reads Environment values

Script raised an exception (POWERSHELL)

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules