| download: | /lordsasta/krnl-executor/releases/download/krnl/Release.rar |
| Full analysis: | https://app.any.run/tasks/d904daac-9b7f-421f-ab06-8765c8396428 |
| Verdict: | Malicious activity |
| Threats: | Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat. |
| Analysis date: | December 13, 2024, 21:14:01 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | BC3158F149F55405909D1FA8BD94C006 |
| SHA1: | 25A016E4D45C5F402EB18A329B8DF45D09D81104 |
| SHA256: | C28E177F4A96A97F256B5919631A3AA1C2BD64E1EE193F9A47A8FA70DBB5FD8D |
| SSDEEP: | 49152:jlXiISg4XNIs4nM5MW4ik2Mk4/nkV8NKt74KSMrRr1QbWLSCzS4XKvEhKu6EAg9V:RXiN6dM5w8Mk4/na7u9yQKmCzqvEhKIp |
MALICIOUS
LUMMA has been detected (SURICATA)
- svchost.exe (PID: 2192)
Connects to the CnC server
- svchost.exe (PID: 2192)
SUSPICIOUS
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 5712)
Executes application which crashes
- Launcher.exe (PID: 5300)
Application launched itself
- Launcher.exe (PID: 5300)
- WinRAR.exe (PID: 5712)
Generic archive extractor
- WinRAR.exe (PID: 5712)
Contacting a server suspected of hosting an CnC
- svchost.exe (PID: 2192)
INFO
Application launched itself
- firefox.exe (PID: 6664)
- firefox.exe (PID: 6440)
Checks proxy server information
- WerFault.exe (PID: 5740)
Checks supported languages
- Launcher.exe (PID: 4724)
- Launcher.exe (PID: 5300)
Reads the software policy settings
- Launcher.exe (PID: 4724)
- WerFault.exe (PID: 5740)
Manual execution by a user
- Launcher.exe (PID: 5300)
- firefox.exe (PID: 6664)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 6724)
The process uses the downloaded file
- WinRAR.exe (PID: 6724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
EXIF
ZIP
| ArchivedFileName: | Release/Executor.rar |
|---|---|
| OperatingSystem: | Win32 |
| UncompressedSize: | 986200 |
| CompressedSize: | 986200 |
| FileVersion: | RAR v5 |
Total processes
152
Monitored processes
24
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 5712 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Release.rar | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 6724 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa5712.26302\Executor.rar | C:\Program Files\WinRAR\WinRAR.exe | WinRAR.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 6940 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5300 | "C:\Users\admin\Desktop\Executor\Executor\Launcher.exe" | C:\Users\admin\Desktop\Executor\Executor\Launcher.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225477 Modules
| |||||||||||||||
| 3140 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Launcher.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4724 | "C:\Users\admin\Desktop\Executor\Executor\Launcher.exe" | C:\Users\admin\Desktop\Executor\Executor\Launcher.exe | Launcher.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5740 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5300 -s 136 | C:\Windows\SysWOW64\WerFault.exe | Launcher.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6664 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 6440 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 123.0 Modules
| |||||||||||||||
Total events
23 229
Read events
23 211
Write events
18
Delete events
0
Modification events
| (PID) Process: | (5712) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (5712) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (5712) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (5712) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Release.rar | |||
| (PID) Process: | (5712) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (5712) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (5712) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (5712) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6724) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (6724) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
Executable files
1
Suspicious files
398
Text files
52
Unknown types
52
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5712 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa5712.26302\Executor.rar | compressed | |
MD5:6AB0ABD018BF5687F0637537820CBCF6 | SHA256:DD9DBD0484C88E111103FA990789CA3ED01AD40D569D3D5C35BAF34C2532E7F7 | |||
| 6724 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\camera\oivio.yaml | text | |
MD5:F6F7DD3DE4538A71757E3EEEDE31DB52 | SHA256:F839763D3EAC65F98DEE1433E5609825017FF247FC6DF4307A49787799AAC667 | |||
| 6724 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\camera\realsense_848_480.yaml | text | |
MD5:0A3A9C6D6B8EDBE68C9E23B03443A7E2 | SHA256:B294EA0ECA78C1F5516BEF1F3F81EF58FE26C5D3D1506CEEAFB8CA63C84D5735 | |||
| 6724 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\visual_odometry\vo_euroc_dark.yaml | text | |
MD5:C2183C839D09BF5FFC08FE6355413AD1 | SHA256:4566F337954D983AAA5A783927CB163EC9E4E8A8B1F67C7882947B4E0713DB23 | |||
| 6724 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\relocalization\reloc_euroc.yaml | text | |
MD5:136160B61B688BF3F137E20EE0C003A3 | SHA256:C5B7EE352225A75BE90B2D63AA78CC87CF458D94936D900415315086B4471E60 | |||
| 6724 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\map_refinement\mr_tartanair.yaml | text | |
MD5:00DC7F3A01A9C30F2A3543F393D096A9 | SHA256:142FE74EE78FF06B0536CB1ADD4C35136341210D978DE5448D0F6943C77C49CD | |||
| 6724 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\Launcher.exe | executable | |
MD5:C99CC71BD76015C0977719BE6AB62262 | SHA256:66A7D7A3EF1274447552F5A78AAE3A2DA9668467D3D91FE0160E8A249890074F | |||
| 6724 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\camera\euroc.yaml | text | |
MD5:62B31102071B36BA67A8AF5AC15275A0 | SHA256:9389B5D73F436DF8387217B34105F12B48687AE6FFBBD9FB02A701A65F7B0E35 | |||
| 6724 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\visual_odometry\vo_uma_bumblebee.yaml | text | |
MD5:A5331C9078F042D1D55BB0E531688E1B | SHA256:94E151036122911E3E8470EFCC22847666E670720DF59129CD048A8442708244 | |||
| 6724 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb6724.26817\Executor\Executor\configs\camera\tartanair.yaml | text | |
MD5:2E04EB504DBE739471278363665D4B19 | SHA256:3FE6C7CF262718E6DEAFBB8BD30E5C39E36B8975016D1CA83F82BF67CCA62880 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
129
DNS requests
137
Threats
13
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6440 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
6248 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
5740 | WerFault.exe | GET | 200 | 23.48.23.169:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5540 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5540 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6440 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6440 | firefox.exe | POST | 200 | 195.138.255.18:80 | http://r10.o.lencr.org/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
640 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5064 | SearchApp.exe | 2.23.209.189:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1176 | svchost.exe | 40.126.32.134:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1176 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (processhol .sbs) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xp3cts1aim .sbs) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (p10tgrace .sbs) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (librari-night .sbs) |
— | — | A Network Trojan was detected | ET MALWARE Observed DNS Query to Lumma Stealer Domain (processhol .sbs) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (befall-sm0ker .sbs) |
— | — | A Network Trojan was detected | ET MALWARE Observed DNS Query to Lumma Stealer Domain (3xp3cts1aim .sbs) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (owner-vacat10n .sbs) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs) |
— | — | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peepburry828 .sbs) |