Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 00:03
General
-
Target
kornkes.exe
-
Size
19KB
-
MD5
0ca288dd5dee603ef60a89a4d93bd5ef
-
SHA1
5cb75c3c0f97eb1aeb9c6e1bcf0ddb48b3c27388
-
SHA256
6555be0bfcea4072319928660df82543777be2e550cfd4d8e812de92f358ea48
-
SHA512
c62e7c0a9757dc4f67f901d32a558714119f00ce40250fd4077732ab6599275cb4ba96e8404428b1bbd235662da482c3b8539ae17941e3f500714da6bbc9739f
-
SSDEEP
192:vsB2RnYACSrbQAyUu5xuhTDQXHjLviaGDtYQEQXN3XOUTaU/RCszgAo:vZukbQ/UQuYjLvzGDVE0xXhaUJCWgAo
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
https://parkywatter.cfd/api
Extracted
lumma
https://parkywatter.cfd/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\kornkes.exe"C:\Users\Admin\AppData\Local\Temp\kornkes.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
356KB
-
Filesize
48KB
-
Filesize
704KB
-
Filesize
356KB