| download: | /Pinga47/fatality-cs2/releases/download/Release/Release.rar |
| Full analysis: | https://app.any.run/tasks/6df3e366-dbfe-4704-84b8-33fd1b7b6a18 |
| Verdict: | Malicious activity |
| Threats: | Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat. |
| Analysis date: | November 23, 2024, 15:47:18 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | BC3158F149F55405909D1FA8BD94C006 |
| SHA1: | 25A016E4D45C5F402EB18A329B8DF45D09D81104 |
| SHA256: | C28E177F4A96A97F256B5919631A3AA1C2BD64E1EE193F9A47A8FA70DBB5FD8D |
| SSDEEP: | 49152:jlXiISg4XNIs4nM5MW4ik2Mk4/nkV8NKt74KSMrRr1QbWLSCzS4XKvEhKu6EAg9V:RXiN6dM5w8Mk4/na7u9yQKmCzqvEhKIp |
MALICIOUS
LUMMA has been detected (SURICATA)
- svchost.exe (PID: 2192)
- Launcher.exe (PID: 5892)
Connects to the CnC server
- svchost.exe (PID: 2192)
SUSPICIOUS
Generic archive extractor
- WinRAR.exe (PID: 2448)
Application launched itself
- Launcher.exe (PID: 372)
Executes application which crashes
- Launcher.exe (PID: 372)
Contacting a server suspected of hosting an CnC
- svchost.exe (PID: 2192)
- Launcher.exe (PID: 5892)
INFO
Manual execution by a user
- notepad.exe (PID: 5340)
- WinRAR.exe (PID: 3988)
- WinRAR.exe (PID: 5472)
- Launcher.exe (PID: 372)
- Taskmgr.exe (PID: 3840)
- Taskmgr.exe (PID: 4500)
The process uses the downloaded file
- WinRAR.exe (PID: 2448)
- WinRAR.exe (PID: 5472)
- WinRAR.exe (PID: 3988)
Reads security settings of Internet Explorer
- notepad.exe (PID: 5340)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 5472)
Checks supported languages
- Launcher.exe (PID: 5892)
- Launcher.exe (PID: 372)
Reads the computer name
- Launcher.exe (PID: 5892)
Reads the software policy settings
- Launcher.exe (PID: 5892)
Reads the machine GUID from the registry
- Launcher.exe (PID: 5892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
EXIF
ZIP
| FileVersion: | RAR v5 |
|---|---|
| CompressedSize: | 986200 |
| UncompressedSize: | 986200 |
| OperatingSystem: | Win32 |
| ArchivedFileName: | Release/Executor.rar |
Total processes
133
Monitored processes
13
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 372 | "C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\Launcher.exe" | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\Launcher.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225477 Modules
| |||||||||||||||
| 1140 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Launcher.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2448 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Downloads\Release.rar | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3640 | "C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\Launcher.exe" | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\Launcher.exe | — | Launcher.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3836 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3840 | "C:\WINDOWS\system32\taskmgr.exe" /4 | C:\Windows\System32\Taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Manager Exit code: 3221226540 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3988 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\Release\Release\Executor.rar" C:\Users\admin\Downloads\Release\Release\ | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 10 Version: 5.91.0 Modules
| |||||||||||||||
| 4076 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 372 -s 612 | C:\Windows\SysWOW64\WerFault.exe | Launcher.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4500 | "C:\WINDOWS\system32\taskmgr.exe" /4 | C:\Windows\System32\Taskmgr.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Task Manager Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
14 910
Read events
14 833
Write events
51
Delete events
26
Modification events
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\Release.rar | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 15 |
Value: | |||
| (PID) Process: | (2448) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 14 |
Value: | |||
Executable files
1
Suspicious files
53
Text files
44
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2448 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor.rar | compressed | |
MD5:6AB0ABD018BF5687F0637537820CBCF6 | SHA256:DD9DBD0484C88E111103FA990789CA3ED01AD40D569D3D5C35BAF34C2532E7F7 | |||
| 5472 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\configs\map_refinement\mr_tartanair.yaml | text | |
MD5:00DC7F3A01A9C30F2A3543F393D096A9 | SHA256:142FE74EE78FF06B0536CB1ADD4C35136341210D978DE5448D0F6943C77C49CD | |||
| 5472 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\configs\camera\realsense_848_480.yaml | text | |
MD5:0A3A9C6D6B8EDBE68C9E23B03443A7E2 | SHA256:B294EA0ECA78C1F5516BEF1F3F81EF58FE26C5D3D1506CEEAFB8CA63C84D5735 | |||
| 5472 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\configs\map_refinement\mr_euroc.yaml | text | |
MD5:3A1B1A707DD09EFFBC11012DD353E8BB | SHA256:59B6786FB4A5450A268FB3C0B9B935EF4C93344C7065631ED2D4FF07744B60E7 | |||
| 5472 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\configs\relocalization\reloc_tartanair.yaml | text | |
MD5:5AEC82CC058C2FA0676A4663C8C0624C | SHA256:7B7A240C55BD466DF423CAC182F17DFD240E678A1F87137AC7B96E83A153F2F7 | |||
| 5472 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\configs\camera\uma_bumblebee.yaml | text | |
MD5:3DA07A92A0542217DAB0FBADCEF14F7A | SHA256:8405E9AB2ABBFDD817812CD972747CA13990E89277CA45ED00DE17674A5F70C2 | |||
| 5472 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\configs\camera\tartanair.yaml | text | |
MD5:2E04EB504DBE739471278363665D4B19 | SHA256:3FE6C7CF262718E6DEAFBB8BD30E5C39E36B8975016D1CA83F82BF67CCA62880 | |||
| 5472 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\configs\relocalization\reloc_euroc.yaml | text | |
MD5:136160B61B688BF3F137E20EE0C003A3 | SHA256:C5B7EE352225A75BE90B2D63AA78CC87CF458D94936D900415315086B4471E60 | |||
| 5472 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\configs\visual_odometry\vo_euroc.yaml | text | |
MD5:4AACBE6B96A9D82191B27788AEEFE565 | SHA256:CD3903A45ED897987292A137DBE64D993D671E0AB04FD6802DA519B300BFDB80 | |||
| 5472 | WinRAR.exe | C:\Users\admin\Downloads\Release\Release\Executor\Executor\Executor\configs\visual_odometry\vo_oivio.yaml | text | |
MD5:C45C6FDA25CEB5FCDF5D9261346BD23C | SHA256:0F7B9D2956A42B35E219EA091107498EA707BB83FDF82EFF10A8A45AC72B76A6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
47
DNS requests
25
Threats
26
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6076 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3976 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6076 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5892 | Launcher.exe | 188.114.97.3:443 | cook-rain.sbs | CLOUDFLARENET | NL | unknown |
5892 | Launcher.exe | 49.13.77.253:443 | processhol.sbs | Hetzner Online GmbH | DE | malicious |
5892 | Launcher.exe | 23.207.106.113:443 | steamcommunity.com | AKAMAI-AS | JP | whitelisted |
4076 | WerFault.exe | 20.42.65.92:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
cook-rain.sbs |
| unknown |
processhol.sbs |
| malicious |
librari-night.sbs |
| unknown |
befall-sm0ker.sbs |
| unknown |
p10tgrace.sbs |
| malicious |
peepburry828.sbs |
| malicious |
owner-vacat10n.sbs |
| unknown |
3xp3cts1aim.sbs |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5892 | Launcher.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) |
2192 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs) |
2192 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs) |
2192 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs) |
2192 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs) |
5892 | Launcher.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (processhol .sbs in TLS SNI) |
5892 | Launcher.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (librari-night .sbs in TLS SNI) |
2192 | svchost.exe | A Network Trojan was detected | ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs) |
5892 | Launcher.exe | A Network Trojan was detected | ET MALWARE Observed Lumma Stealer Domain (processhol .sbs in TLS SNI) |
5892 | Launcher.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (3xp3cts1aim .sbs in TLS SNI) |