File name:

!Setup.exe

Full analysis: https://app.any.run/tasks/174f8822-5619-440f-9152-87791e0fa43e
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 16:09:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
stealer
lumma
autoit
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

CB8F02134E7A9E082E0D9BF4C988B202

SHA1:

C4A32F3385E1B91D135D2F713779299BDB6D0AB0

SHA256:

2B5FDBA3647700D3DDE718E3B43FDE8C12F3425D0AB768D446450DEEB1A3DE33

SSDEEP:

98304:v0pwcLDr0T5icphuxhYaORg0fimVY9+R30jAIYUtMU9RlXxiV:umV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been found (auto)

      • !Setup.exe (PID: 6244)

    • Executing a file with an untrusted certificate

      • !Setup.exe (PID: 6244)

    • AutoIt loader has been detected (YARA)

      • Banned.com (PID: 6108)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • !Setup.exe (PID: 6244)

    • Starts CMD.EXE for commands execution

      • !Setup.exe (PID: 6244)
      • cmd.exe (PID: 6560)

    • Executing commands from ".cmd" file

      • !Setup.exe (PID: 6244)

    • Get information on the list of running processes

      • cmd.exe (PID: 6560)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6560)

    • Application launched itself

      • cmd.exe (PID: 6560)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6560)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6560)

    • There is functionality for taking screenshot (YARA)

      • Banned.com (PID: 6108)
      • !Setup.exe (PID: 6244)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)

    • The executable file from the user directory is run by the CMD process

      • Banned.com (PID: 6108)

  • INFO

    • The sample compiled with english language support

      • !Setup.exe (PID: 6244)

    • Reads the computer name

      • !Setup.exe (PID: 6244)
      • extrac32.exe (PID: 5204)
      • Banned.com (PID: 6108)

    • Checks supported languages

      • !Setup.exe (PID: 6244)
      • extrac32.exe (PID: 5204)
      • Banned.com (PID: 6108)

    • Creates files or folders in the user directory

      • !Setup.exe (PID: 6244)
      • extrac32.exe (PID: 5204)

    • Process checks computer location settings

      • !Setup.exe (PID: 6244)

    • Creates a new folder

      • cmd.exe (PID: 5376)

    • Reads mouse settings

      • Banned.com (PID: 6108)

    • Reads the software policy settings

      • Banned.com (PID: 6108)
      • slui.exe (PID: 1676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:20:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 29696
InitializedDataSize: 513024
UninitializedDataSize: 16896
EntryPoint: 0x38af
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.2841.5.9973
ProductVersionNumber: 1.2841.5.9973
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Integrated healthcare platform for comprehensive patient management.
FileDescription: Integrated healthcare platform for comprehensive patient management.
LegalCopyright: Copyright © HealthHub Dynamics Inc. 2021 All rights reserved.
LegalTrademarks: HealthHubX is a trademark of HealthHub Dynamics Inc.
ProductName: HealthHubX
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
18
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start !setup.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs banned.com choice.exe no specs #LUMMA svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1056tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1188findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1228cmd /c copy /b ..\Bids + ..\Ceo + ..\Throat + ..\Hall + ..\Access + ..\Availability + ..\Scout + ..\War V C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1676"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2284C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
3888findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4608findstr /V "Ratio" Returning C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4892cmd /c copy /b 71992\Banned.com + Fwd + Rise + Designed + Balanced + Available + Dir + Soccer + Race + Ford + Writing 71992\Banned.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5204extrac32 /Y /E EcC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 622
Read events
1 622
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
21
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6244!Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Scoutbinary
MD5:76D9165FFF95E5302786C486398E284B
SHA256:1B5A2E903DEC1BD0620E473D0DFF69761ACF5E375EAC1ED87ADF76F36F2386A3
6244!Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Campaignstext
MD5:2E7B0022580A56F4A6645D751E977BC1
SHA256:3D616D0119732BF2780AF373845A9F8F1C50AED7CEA51D54E0E790FFEC75280E
6244!Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Accessbinary
MD5:CFCFA68F88E27612AB83EA57018A850C
SHA256:C6A15A8FA80F99E5F34775677B74082A0946FCF2F10AD3827691059821F034F7
6244!Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Eccompressed
MD5:AFA0F6F9328F080270E89AFFF0581506
SHA256:40E274B995FF6326EB0F89943CF999743AE9BDA9F314B3D775F62EC71A5F51C2
6244!Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Throatbinary
MD5:34BE2CF79F42494DB963EC85DA206D2E
SHA256:7CFB013FACCD6086F660D5B46712EBACABF2A160A26E453A7B83D83412A16A11
6244!Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Ceobinary
MD5:7D627757A86D54CD1B6C057A7DBFCF26
SHA256:3AAF7017767A1A1FBB1D9A80FA2C5B3C05583D879BE0A0E2F32898076A4D3BA7
6244!Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Bidsbinary
MD5:464B43F4D2DF8DF1A0D420A378B13284
SHA256:F0E44F93299CCE792814297DC2A34082B057FFCFBD7320C32B16598367A115E8
6244!Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Warbinary
MD5:F0067E491667E285C6AA36CABB0934F0
SHA256:7C27FA3805B5877F74A80274B3ACCFF8041CFCB5C8FF930DE5B93F49569A9C8E
5204extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Risebinary
MD5:85667E167580AB6EE879A397EC8378D5
SHA256:FAB0E8057B43711FDCF24AB3BB355B5CBC3F3D37782E598BF4925AB58E602E74
5204extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Writingbinary
MD5:117FE1670C955271C9D468192301A43F
SHA256:4C4FD142141A03A04B927A31F365DFB0ACD6F972340B109430AF367EAA2856ED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
26
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5640
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 69.192.161.161
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.131
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
xhWaXURTqNAudpSlyMZZXaDi.xhWaXURTqNAudpSlyMZZXaDi
  • —
unknown
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fallyjustif .click)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
!Setup.exe