Analysis date (UTC): 13 November 2024, 22:03Analysis environment: Windows 10 Pro, build 19045, x64

genom2.com

MD5:AFB72BFE712D2327927910D865B0F17D

SHA1:967C144D709078D7F50EF0953860FE5A210BA654

SHA256:8332552A7233D9274B95C1A9F5C2F9527CFC2394BAD102DF39E15B326B8AA109

Analysis result

Threat level:Malicious activity

Tags:

lummastealerpossible-phishingstealcloadersusp-powershellwmi-base64g0njxa

Full analysis:Analysis genom2.com Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Adds exclusions to the Windows Defender exclusion list using PowerShell

Client_x86.exe (PID: 7032)

LUMMA has been detected (SURICATA)

svchost.exe (PID: 2172)

Executing a file with an untrusted certificate

2.exe (PID: 2360)

Connects to the CnC server

2.exe (PID: 2360)

STEALC has been detected (SURICATA)

2.exe (PID: 2360)

StealC has been detected

2.exe (PID: 2360)

SUSPICIOUS

Executable content was dropped or overwritten

Client_x86.exe (PID: 7032)

Process drops legitimate windows executable

Client_x86.exe (PID: 7032)

The process drops C-runtime libraries

Client_x86.exe (PID: 7032)

Starts POWERSHELL.EXE for commands execution

Client_x86.exe (PID: 7032)

Possibly malicious use of IEX has been detected

Client_x86.exe (PID: 7032)

Contacting a server suspected of hosting an CnC

svchost.exe (PID: 2172)
2.exe (PID: 2360)

Executes application which crashes

1.exe (PID: 7528)
2.exe (PID: 2360)

Connects to the server without a host name

2.exe (PID: 2360)

Windows Defender mutex has been found

2.exe (PID: 2360)

Potential Corporate Privacy Violation

2.exe (PID: 2360)

Process requests binary or script from the Internet

2.exe (PID: 2360)

INFO

The process uses the downloaded file

iexplore.exe (PID: 1160)

Reads the computer name

identity_helper.exe (PID: 4676)

Checks supported languages

identity_helper.exe (PID: 4676)

Reads Environment values

identity_helper.exe (PID: 4676)

Executable content was dropped or overwritten

msedge.exe (PID: 512)

Found Base64 encoded reference to WMI classes (YARA)

Client_x86.exe (PID: 7032)

Found Base64 encoded access to Windows Defender via PowerShell (YARA)

Client_x86.exe (PID: 7032)

Application launched itself

msedge.exe (PID: 512)
chrome.exe (PID: 6928)
msedge.exe (PID: 2980)

Checks if a key exists in the options dictionary (POWERSHELL)

powershell.exe (PID: 6884)

Script raised an exception (POWERSHELL)

powershell.exe (PID: 6884)

Manual execution by a user

msedge.exe (PID: 7652)

Threats

PID	Process	Class	Message
3020	msedge.exe	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 23
3020	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
3020	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
2172	svchost.exe	Domain Observed Used for C2 Detected	STEALER [ANY.RUN] Suspected Lumma Domain [Cloudflare] (shootyprovedn .biz)
2360	2.exe	Potentially Bad Traffic	ET INFO Dotted Quad Host DLL Request
2360	2.exe	Malware Command and Control Activity Detected	STEALER [ANY.RUN] Stealc HTTP POST Request
2360	2.exe	Malware Command and Control Activity Detected	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in
2360	2.exe	A suspicious filename was detected	ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity
2360	2.exe	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc Requesting plugins Config from C2
2360	2.exe	Malware Command and Control Activity Detected	ET MALWARE Win32/Stealc Requesting browsers Config from C2

Rows per page