download:

/lordsasta/krnl-executor/releases/download/krnl/Release.rar

Full analysis: https://app.any.run/tasks/d904daac-9b7f-421f-ab06-8765c8396428
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: December 13, 2024, 21:14:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
lumma
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

BC3158F149F55405909D1FA8BD94C006

SHA1:

25A016E4D45C5F402EB18A329B8DF45D09D81104

SHA256:

C28E177F4A96A97F256B5919631A3AA1C2BD64E1EE193F9A47A8FA70DBB5FD8D

SSDEEP:

49152:jlXiISg4XNIs4nM5MW4ik2Mk4/nkV8NKt74KSMrRr1QbWLSCzS4XKvEhKu6EAg9V:RXiN6dM5w8Mk4/na7u9yQKmCzqvEhKIp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)

    • Connects to the CnC server

      • svchost.exe (PID: 2192)

  • SUSPICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5712)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5712)

    • Application launched itself

      • Launcher.exe (PID: 5300)
      • WinRAR.exe (PID: 5712)

    • Executes application which crashes

      • Launcher.exe (PID: 5300)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2192)

  • INFO

    • Manual execution by a user

      • Launcher.exe (PID: 5300)
      • firefox.exe (PID: 6664)

    • Checks supported languages

      • Launcher.exe (PID: 4724)
      • Launcher.exe (PID: 5300)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6724)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6724)

    • Reads the software policy settings

      • Launcher.exe (PID: 4724)
      • WerFault.exe (PID: 5740)

    • Checks proxy server information

      • WerFault.exe (PID: 5740)

    • Application launched itself

      • firefox.exe (PID: 6664)
      • firefox.exe (PID: 6440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 986200
UncompressedSize: 986200
OperatingSystem: Win32
ArchivedFileName: Release/Executor.rar
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
24
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe rundll32.exe no specs launcher.exe conhost.exe no specs launcher.exe werfault.exe #LUMMA svchost.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2736"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240213221259 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8b71ba5-ae61-402e-b116-73f3eaf18c81} 6440 "\\.\pipe\gecko-crash-server-pipe.6440" 1becc7ec310 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
3140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4724"C:\Users\admin\Desktop\Executor\Executor\Launcher.exe"C:\Users\admin\Desktop\Executor\Executor\Launcher.exe
Launcher.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\executor\executor\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5236"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4856 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 4864 -prefMapHandle 4652 -prefsLen 36588 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17b81dcb-5c29-4cb6-8093-72a1415ba61f} 6440 "\\.\pipe\gecko-crash-server-pipe.6440" 1bed4bb0310 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
5300"C:\Users\admin\Desktop\Executor\Executor\Launcher.exe" C:\Users\admin\Desktop\Executor\Executor\Launcher.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\executor\executor\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5316"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2152 -parentBuildID 20240213221259 -prefsHandle 2144 -prefMapHandle 2132 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92f15833-a122-48af-88c5-a4701c2395b9} 6440 "\\.\pipe\gecko-crash-server-pipe.6440" 1bebf880310 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5540"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5688 -childID 7 -isForBrowser -prefsHandle 5436 -prefMapHandle 5560 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1532 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4741205-f86e-428b-ad9f-ba5d1d1ac680} 6440 "\\.\pipe\gecko-crash-server-pipe.6440" 1bed7e93850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
5568"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4260 -childID 2 -isForBrowser -prefsHandle 4252 -prefMapHandle 2788 -prefsLen 36588 -prefMapSize 244583 -jsInitHandle 1532 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {860b3d9a-b363-491d-b4af-d978507a6999} 6440 "\\.\pipe\gecko-crash-server-pipe.6440" 1bed3048690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
5604"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5036 -childID 3 -isForBrowser -prefsHandle 5116 -prefMapHandle 5112 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1532 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4285f1fe-b108-4d32-a9b8-403e8abb4403} 6440 "\\.\pipe\gecko-crash-server-pipe.6440" 1bed62fed90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
Total events
23 229
Read events
23 211
Write events
18
Delete events
0

Modification events

(PID) Process:(5712) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5712) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5712) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5712) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Release.rar
(PID) Process:(5712) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5712) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5712) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5712) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
Executable files
1
Suspicious files
398
Text files
52
Unknown types
52

Dropped files

PID
Process
Filename
Type
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\camera\realsense_848_480.yamltext
MD5:0A3A9C6D6B8EDBE68C9E23B03443A7E2
SHA256:B294EA0ECA78C1F5516BEF1F3F81EF58FE26C5D3D1506CEEAFB8CA63C84D5735
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\camera\dark_euroc.yamltext
MD5:62B31102071B36BA67A8AF5AC15275A0
SHA256:9389B5D73F436DF8387217B34105F12B48687AE6FFBBD9FB02A701A65F7B0E35
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\camera\oivio.yamltext
MD5:F6F7DD3DE4538A71757E3EEEDE31DB52
SHA256:F839763D3EAC65F98DEE1433E5609825017FF247FC6DF4307A49787799AAC667
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\camera\euroc.yamltext
MD5:62B31102071B36BA67A8AF5AC15275A0
SHA256:9389B5D73F436DF8387217B34105F12B48687AE6FFBBD9FB02A701A65F7B0E35
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\map_refinement\mr_oivio.yamltext
MD5:780FFF3221B3D35FC1A1460B99A700A6
SHA256:3727DDE7A3E8EEF74076FF068CCD7C364CB9A8640488BC068CD3705B4476EF7C
5712WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa5712.26302\Executor.rarcompressed
MD5:6AB0ABD018BF5687F0637537820CBCF6
SHA256:DD9DBD0484C88E111103FA990789CA3ED01AD40D569D3D5C35BAF34C2532E7F7
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\relocalization\reloc_euroc.yamltext
MD5:136160B61B688BF3F137E20EE0C003A3
SHA256:C5B7EE352225A75BE90B2D63AA78CC87CF458D94936D900415315086B4471E60
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\camera\uma_bumblebee.yamltext
MD5:3DA07A92A0542217DAB0FBADCEF14F7A
SHA256:8405E9AB2ABBFDD817812CD972747CA13990E89277CA45ED00DE17674A5F70C2
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\mob-info\MobsInfo.jsbinary
MD5:3B411E5063F1B20FD902C5B80498F8D2
SHA256:91264019A1E99F39F1CF716BA15D036BE29FF83D56492C76DE0889846F3C7C07
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\mob-info\mobs.jsbinary
MD5:EF757AEA475A3446C7B990759F2EE783
SHA256:BCF3C551E05378B07D8B94316975000B866FBE784E9A6D965D100A7AECA7C016
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
129
DNS requests
137
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6248
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5540
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5740
WerFault.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5540
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5740
WerFault.exe
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6440
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
640
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.189:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 23.48.23.169
  • 23.48.23.156
  • 23.48.23.167
  • 23.48.23.194
  • 23.48.23.138
  • 23.48.23.137
  • 23.48.23.173
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.35.229.160
whitelisted
www.bing.com
  • 2.23.209.189
  • 2.23.209.182
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.187
  • 2.23.209.140
  • 2.23.209.179
  • 2.23.209.130
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xp3cts1aim .sbs)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p10tgrace .sbs)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs)
2192
svchost.exe
A Network Trojan was detected
ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs)
2192
svchost.exe
A Network Trojan was detected
ET MALWARE Observed DNS Query to Lumma Stealer Domain (3xp3cts1aim .sbs)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (owner-vacat10n .sbs)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peepburry828 .sbs)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/lordsasta/krnl-executor/releases/download/krnl/Release.rar