File name:

#Pa$CŌ𝔻e--6814__OpeN-Setup$#.7z

Full analysis: https://app.any.run/tasks/eca9466b-ccfb-4acb-9019-d90c1bfa9b35
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: February 12, 2025, 15:05:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
delphi
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

7DD2B82801C77B3D607207533067F354

SHA1:

FDA6C021200F5AF116C1F3591FAEE685C6851227

SHA256:

099E05C8887F9ED9F2A386680E74F70C88F84E27B1ABA24CC4076D462341E52F

SSDEEP:

98304:KI/+W+X1oOvF3Ze5lWuuKkGJnHe2openTqcWxgdfupRpuQbXcfQYc9EkUjG29KVO:5WTHnoP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • setup.exe (PID: 2408)

    • LUMMA has been detected (SURICATA)

      • setup.exe (PID: 2408)

    • LUMMA mutex has been found

      • setup.exe (PID: 2408)

    • Steals credentials from Web Browsers

      • setup.exe (PID: 2408)

    • Actions looks like stealing of personal data

      • setup.exe (PID: 2408)

    • Known privilege escalation attack

      • dllhost.exe (PID: 1904)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 2408)

    • Searches for installed software

      • setup.exe (PID: 2408)

    • Executable content was dropped or overwritten

      • vcpkgsrv.exe (PID: 2572)
      • setup.exe (PID: 2408)

    • Process drops legitimate windows executable

      • vcpkgsrv.exe (PID: 2572)
      • setup.exe (PID: 2408)

    • The process drops C-runtime libraries

      • vcpkgsrv.exe (PID: 2572)
      • setup.exe (PID: 2408)

    • Starts itself from another location

      • vcpkgsrv.exe (PID: 2572)

    • Starts a Microsoft application from unusual location

      • vcpkgsrv.exe (PID: 2572)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 6864)
      • setup.exe (PID: 2408)

    • Checks supported languages

      • setup.exe (PID: 2408)
      • vcpkgsrv.exe (PID: 2572)
      • vcpkgsrv.exe (PID: 4952)
      • vcpkgsrv.exe (PID: 6232)

    • Reads the computer name

      • setup.exe (PID: 2408)
      • vcpkgsrv.exe (PID: 2572)
      • vcpkgsrv.exe (PID: 4952)
      • vcpkgsrv.exe (PID: 6232)

    • Compiled with Borland Delphi (YARA)

      • setup.exe (PID: 2408)

    • Reads the software policy settings

      • setup.exe (PID: 2408)
      • explorer.exe (PID: 6640)

    • Create files in a temporary directory

      • setup.exe (PID: 2408)
      • vcpkgsrv.exe (PID: 4952)
      • vcpkgsrv.exe (PID: 6232)
      • choice.exe (PID: 488)

    • The sample compiled with english language support

      • vcpkgsrv.exe (PID: 2572)
      • setup.exe (PID: 2408)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 1904)

    • Creates files in the program directory

      • vcpkgsrv.exe (PID: 2572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs rundll32.exe no specs #LUMMA setup.exe vcpkgsrv.exe vcpkgsrv.exe no specs choice.exe no specs conhost.exe no specs CMSTPLUA vcpkgsrv.exe no specs choice.exe no specs conhost.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
488C:\WINDOWS\SysWOW64\choice.exeC:\Windows\SysWOW64\choice.exe—vcpkgsrv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Offers the user a choice
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1740C:\WINDOWS\SysWOW64\choice.exeC:\Windows\SysWOW64\choice.exe—vcpkgsrv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1760\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—choice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1904C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
2408"C:\Users\admin\Desktop\#Pa$CŌ𝔻e--6814__OpeN-Setup$#\setup.exe" C:\Users\admin\Desktop\#Pa$CŌ𝔻e--6814__OpeN-Setup$#\setup.exe
explorer.exe
User:
admin
Company:
Hagel Technologies Ltd.
Integrity Level:
MEDIUM
Description:
DU Meter Service
Exit code:
0
Version:
8.10
Modules
Images
c:\users\admin\desktop\#pa$cō𝔻e--6814__open-setup$#\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2572"C:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\vcpkgsrv.exe"C:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\vcpkgsrv.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) Visual C++ Package Server
Exit code:
0
Version:
17.0.34202.158 built by: D17.7
Modules
Images
c:\users\admin\appdata\local\temp\gupg6k52li0nhpgtzt5wlx\vcpkgsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4952C:\ProgramData\FNPLicensingService\vcpkgsrv.exeC:\ProgramData\FNPLicensingService\vcpkgsrv.exe—vcpkgsrv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) Visual C++ Package Server
Exit code:
1
Version:
17.0.34202.158 built by: D17.7
Modules
Images
c:\programdata\fnplicensingservice\vcpkgsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
5488\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—choice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6232"C:\ProgramData\FNPLicensingService\vcpkgsrv.exe" C:\ProgramData\FNPLicensingService\vcpkgsrv.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) Visual C++ Package Server
Exit code:
1
Version:
17.0.34202.158 built by: D17.7
Modules
Images
c:\programdata\fnplicensingservice\vcpkgsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6420"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\#Pa$CŌ𝔻e--6814__OpeN-Setup$#.7zC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
1
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
6 889
Read events
6 859
Write events
17
Delete events
13

Modification events

(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_0
Value:
4C000000730100000402000000000000F0F0F0000000000000000000000000000000000000000000AE02060000000000000000003B000000B402000000000000000000000000000001000000
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_1
Value:
4C000000730100000500000000000000F0F0F00000000000000000000000000000000000000000000C0304000000000000000000180000002A00000000000000000000000000000002000000
(PID) Process:(6420) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\General\Toolbar\Layout
Operation:writeName:Band76_2
Value:
4C000000730100000400000000000000F0F0F00000000000000000000000000000000000000000001A0305000000000000000000180000006400000000000000000000000000000003000000
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
(PID) Process:(6864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:13
Value:
Executable files
23
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2408setup.exeC:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\airstrip.eps —
MD5:—
SHA256:—
2408setup.exeC:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\cpfe.dll —
MD5:—
SHA256:—
2408setup.exeC:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\dbxase.dllexecutable
MD5:019F61F5BF96F5B80A846EFEF7FFE931
SHA256:E136DB925A11447A2E0444D45866471A4BC54B03B403B912663054AA17BE469B
2408setup.exeC:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\dbxfb.dllexecutable
MD5:FBE21C0E2FD44E82896F6274FE7ACAEC
SHA256:BD31280409672D3FE50F60421882CE69EDBDE8F6E47DB668BC6D55A3D0A74A73
2408setup.exeC:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\vclie290.bplexecutable
MD5:50DAA52CB7544673646693CFB80BD040
SHA256:8E46646B371D0A100EAE3852775D416BF9669E4E20E98ABF744993595687FD0B
2572vcpkgsrv.exeC:\ProgramData\FNPLicensingService\cpfe.dll —
MD5:—
SHA256:—
2408setup.exeC:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\DbxDb2.dllexecutable
MD5:438658D2D42B2417AFD34BACEC6A55AA
SHA256:85E12FF818F0412262B7D0070B7550E7F7E757DF735FAA7AAAC4B73F018FE26B
2408setup.exeC:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\concrt140.dllexecutable
MD5:F36DAE6EA00F102B60A5011AF0732123
SHA256:0A3894DD420ED6B4C7EBBDE463DBBDE69CDB032E290B1C86C21CCDAA4DA95526
2408setup.exeC:\Users\admin\AppData\Local\Temp\GUPG6K52LI0NHPGTZT5WLX\msvcp140.dllexecutable
MD5:CDAE969102E88F6704D853F9521EEDD2
SHA256:4AD3DE3443D7658F74C978E7EB04730E3D812BC592FEE47BE4E6348D1FB4814E
2572vcpkgsrv.exeC:\ProgramData\FNPLicensingService\airstrip.eps —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
42
DNS requests
24
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.18.244.211:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.20.102.93:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.16.38.4:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.16.38.4:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5892
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5892
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6748
backgroundTaskHost.exe
GET
200
2.16.38.4:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.18.244.211:80
crl.microsoft.com
Akamai International B.V.
FR
whitelisted
—
—
95.101.136.201:443
—
Akamai International B.V.
GB
unknown
4712
MoUsoCoreWorker.exe
2.20.102.93:80
www.microsoft.com
RCS & RDS
RO
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
95.101.136.201:443
—
Akamai International B.V.
GB
unknown
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.16.38.4:80
ocsp.digicert.com
AKAMAI-AS
ES
whitelisted
1176
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.18.244.211
  • 2.18.244.216
whitelisted
www.microsoft.com
  • 2.20.102.93
  • 23.35.229.160
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
ocsp.digicert.com
  • 2.16.38.4
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.65
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.5
  • 20.190.160.128
  • 20.190.160.4
  • 20.190.160.131
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
arc.msn.com
  • 20.223.36.55
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2408
setup.exe
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
#Pa$CŌ𝔻e--6814__OpeN-Setup$#.7z