File name:

TWO1.exe

Full analysis: https://app.any.run/tasks/0f82eed5-fbbf-4858-8b5f-45f10bba6e9a
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Analysis date: October 03, 2025, 17:57:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
vidar
stealc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

E85FF3C8B17DB2E64CA3F8B9435524C7

SHA1:

557662626B8487DB282C18ECDF0796B6AB24F0E9

SHA256:

1285169ABAE30BA3D353644ED90DED5D7FE5EA119A027E8EEE1AEB8511C13F06

SSDEEP:

98304:F7Lc7jeWqkliwEH2cHJiwDmJNFfVe94+ViXj7kwwbwnb3V1tbBYdDSWDZz:kx2N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • TWO1.exe (PID: 7784)
    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2428)
    • VIDAR has been detected (YARA)

      • Colorado.scr (PID: 3420)
    • Actions looks like stealing of personal data

      • Colorado.scr (PID: 3420)
    • Steals credentials from Web Browsers

      • Colorado.scr (PID: 3420)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • TWO1.exe (PID: 7784)
      • cmd.exe (PID: 6916)
    • Executable content was dropped or overwritten

      • TWO1.exe (PID: 7784)
    • Reads command from file

      • cmd.exe (PID: 6916)
    • Application launched itself

      • cmd.exe (PID: 6916)
    • Get information on the list of running processes

      • cmd.exe (PID: 2504)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2504)
    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 2504)
    • Starts application with an unusual extension

      • cmd.exe (PID: 2504)
    • The executable file from the user directory is run by the CMD process

      • Colorado.scr (PID: 7800)
    • There is functionality for taking screenshot (YARA)

      • TWO1.exe (PID: 7784)
      • Colorado.scr (PID: 7800)
      • Colorado.scr (PID: 3420)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Colorado.scr (PID: 3420)
    • Reads security settings of Internet Explorer

      • Colorado.scr (PID: 3420)
    • Searches for installed software

      • Colorado.scr (PID: 3420)
  • INFO

    • Checks supported languages

      • TWO1.exe (PID: 7784)
      • extrac32.exe (PID: 8032)
      • Colorado.scr (PID: 7800)
      • Colorado.scr (PID: 3420)
    • Reads the computer name

      • TWO1.exe (PID: 7784)
      • extrac32.exe (PID: 8032)
      • Colorado.scr (PID: 7800)
      • Colorado.scr (PID: 3420)
    • Create files in a temporary directory

      • TWO1.exe (PID: 7784)
      • extrac32.exe (PID: 8032)
    • Reads mouse settings

      • Colorado.scr (PID: 7800)
    • Creates files in the program directory

      • Colorado.scr (PID: 3420)
    • Manual execution by a user

      • Colorado.scr (PID: 3420)
    • Checks proxy server information

      • slui.exe (PID: 7240)
      • Colorado.scr (PID: 3420)
    • Reads the software policy settings

      • slui.exe (PID: 7240)
      • Colorado.scr (PID: 3420)
    • Reads the machine GUID from the registry

      • Colorado.scr (PID: 3420)
    • Reads product name

      • Colorado.scr (PID: 3420)
    • Reads CPU info

      • Colorado.scr (PID: 3420)
    • Reads Environment values

      • Colorado.scr (PID: 3420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:07:21 23:53:50+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 26624
InitializedDataSize: 435200
UninitializedDataSize: 16896
EntryPoint: 0x352e
OSVersion: 5.1
ImageVersion: 6
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
12
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
2428C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2504cmd C:\Windows\SysWOW64\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3420C:\Users\admin\AppData\Local\Temp\33824\Colorado.scr C:\Users\admin\AppData\Local\Temp\33824\Colorado.scr
explorer.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 17, 0
Modules
Images
c:\users\admin\appdata\local\temp\33824\colorado.scr
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4928\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6752findstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc" C:\Windows\SysWOW64\findstr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6916cmd.exe /c cmd < Enrollment.mpgC:\Windows\SysWOW64\cmd.exeTWO1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7208tasklist C:\Windows\SysWOW64\tasklist.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7240findstr /V "Parking" Galleries C:\Windows\SysWOW64\findstr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7240C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7784"C:\Users\admin\Desktop\TWO1.exe" C:\Users\admin\Desktop\TWO1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\two1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
8 234
Read events
8 231
Write events
3
Delete events
0

Modification events

(PID) Process:(3420) Colorado.scrKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3420) Colorado.scrKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3420) Colorado.scrKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
1
Suspicious files
19
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7784TWO1.exeC:\Users\admin\AppData\Local\Temp\Autumn.mpgbinary
MD5:3D63C8E5E89AF68F381B1BF9EAD204C4
SHA256:70AA751A70950D4183BBF5643C238BD4C3164EFD8BF87A017CBE5C980AD605E3
8032extrac32.exeC:\Users\admin\AppData\Local\Temp\Weddingbinary
MD5:878E3AD9B9008400C460E748F780704E
SHA256:FF384A83F5AAC313FB1CD470599A820FA2FA1B2C519479FF06F645F8CA7C5486
8032extrac32.exeC:\Users\admin\AppData\Local\Temp\Brakebinary
MD5:06163459E95A4DCAD5C032E3BEC4164C
SHA256:C6E8FCFBED67009957DA1741102FD01D8E7779724182F42EDB794EEA5BB773F7
8032extrac32.exeC:\Users\admin\AppData\Local\Temp\Accessbinary
MD5:F3087C5BA5E4DCFAD5BA18E966D813B2
SHA256:6F477CB285693000D506AE2DBC4F65FDC4D05F05B19D4DB674B88C02E72C7DA1
7784TWO1.exeC:\Users\admin\AppData\Local\Temp\Morris.mpgbinary
MD5:C4921CCBCC47FFF43F82483C9F383DC3
SHA256:28C85B43CEEC7772AAE200415FAE818FDB82D9F8EBAD84967EC0A71629AAED52
7784TWO1.exeC:\Users\admin\AppData\Local\Temp\Sides.mpgbinary
MD5:E38B8E6B1E3B23BAF26A1CF87471DA07
SHA256:646CF75565A204A7E06904985DD04496AC0A1AF2ADAFC2CBFD238A8CC041BBCF
7784TWO1.exeC:\Users\admin\AppData\Local\Temp\Drop.mpgbinary
MD5:12FA0AE572EBAA4D7D308843415842BE
SHA256:635BB9C3E7AF806A7C6F2A35B6259CCF85790C8833E16C433A59E6170CDA96AF
7784TWO1.exeC:\Users\admin\AppData\Local\Temp\nsq1F22.tmp\nsExec.dllexecutable
MD5:08E9796CA20C5FC5076E3AC05FB5709A
SHA256:8165C7AEF7DE3D3E0549776535BEDC380AD9BE7BB85E60AD6436F71528D092AF
8032extrac32.exeC:\Users\admin\AppData\Local\Temp\Doebinary
MD5:D797B28D19A8E5ACCBB7589D99ECE691
SHA256:A4BBEA31839EE463FADD7D47700693D50F88AAE1ACB4C5BB6FF4430D9782726C
8032extrac32.exeC:\Users\admin\AppData\Local\Temp\Innovativebinary
MD5:C7FC0FBAD8504BCA216A5C21C9F296E0
SHA256:F02DF5BBAB3309F3402B8CC95970AB05686EA9379C17659DC3C0414C7BBA77B4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
22
DNS requests
8
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
149.154.167.99:443
https://telegram.me/rif0lm
GB
html
12.0 Kb
unknown
GET
200
49.13.36.184:443
https://pp.jullianacalhau.com.br/
DE
unknown
POST
200
49.13.36.184:443
https://pp.jullianacalhau.com.br/
DE
text
62 b
unknown
POST
200
49.13.36.184:443
https://pp.jullianacalhau.com.br/
DE
text
5.69 Kb
unknown
POST
200
49.13.36.184:443
https://pp.jullianacalhau.com.br/
DE
text
5 b
unknown
POST
500
4.154.209.85:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
unknown
POST
500
4.154.209.85:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
xml
512 b
unknown
POST
200
49.13.36.184:443
https://pp.jullianacalhau.com.br/
DE
text
2.13 Kb
unknown
POST
200
49.13.36.184:443
https://pp.jullianacalhau.com.br/
DE
text
11.3 Kb
unknown
POST
200
49.13.36.184:443
https://pp.jullianacalhau.com.br/
DE
text
108 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6016
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
992
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
23.192.36.142:443
www.bing.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:138
whitelisted
5948
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2172
slui.exe
4.154.185.43:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7240
slui.exe
4.154.185.43:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3420
Colorado.scr
149.154.167.99:443
telegram.me
Telegram Messenger Inc
GB
whitelisted
3420
Colorado.scr
49.13.36.184:443
pp.jullianacalhau.com.br
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
www.bing.com
  • 23.192.36.142
  • 23.192.36.137
whitelisted
google.com
  • 216.58.206.78
whitelisted
SBrSBcCQFZkXMd.SBrSBcCQFZkXMd
unknown
activation-v2.sls.microsoft.com
  • 4.154.185.43
whitelisted
telegram.me
  • 149.154.167.99
whitelisted
pp.jullianacalhau.com.br
  • 49.13.36.184
malicious

Threats

PID
Process
Class
Message
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2428
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Lumma DNS Activity observed
A Network Trojan was detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
A Network Trojan was detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
No debug info