File name:

New [v2.1.0].exe

Full analysis: https://app.any.run/tasks/5ae25022-8907-4062-bedf-c4f9cd75bc3a
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: January 19, 2025, 00:44:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
lumma
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

4E1A4E6033A6D15433DEB6EB82231629

SHA1:

A2A2F1070411EAABEE8BC879FB426980DF9BDBAF

SHA256:

316FEEC8DDF25C4767893CC77A0D754EA2B52623A8D25C12C0B9AD7D96E8B88A

SSDEEP:

49152:Ln+95BJJk6j5EnIBfBCHLZVkxwpVwhUMSY6kmbIjduyfNaRYvQ62tT3ahytLEprU:Lny57iaGeCrZVkiVwuMSY6k9JFPD2tTX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • New [v2.1.0].exe (PID: 6316)

    • LUMMA mutex has been found

      • Fuel.com (PID: 6980)

    • Steals credentials from Web Browsers

      • Fuel.com (PID: 6980)

    • Actions looks like stealing of personal data

      • Fuel.com (PID: 6980)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • New [v2.1.0].exe (PID: 6316)

    • Starts CMD.EXE for commands execution

      • New [v2.1.0].exe (PID: 6316)
      • cmd.exe (PID: 6480)

    • Executing commands from ".cmd" file

      • New [v2.1.0].exe (PID: 6316)

    • Get information on the list of running processes

      • cmd.exe (PID: 6480)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6480)

    • The executable file from the user directory is run by the CMD process

      • Fuel.com (PID: 6980)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6480)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6480)

    • Application launched itself

      • cmd.exe (PID: 6480)

    • There is functionality for taking screenshot (YARA)

      • New [v2.1.0].exe (PID: 6316)

  • INFO

    • Checks supported languages

      • New [v2.1.0].exe (PID: 6316)
      • extrac32.exe (PID: 6804)
      • Fuel.com (PID: 6980)

    • Process checks computer location settings

      • New [v2.1.0].exe (PID: 6316)

    • Reads the computer name

      • New [v2.1.0].exe (PID: 6316)
      • extrac32.exe (PID: 6804)
      • Fuel.com (PID: 6980)

    • Creates a new folder

      • cmd.exe (PID: 6784)

    • Create files in a temporary directory

      • extrac32.exe (PID: 6804)

    • Reads mouse settings

      • Fuel.com (PID: 6980)

    • Reads the software policy settings

      • Fuel.com (PID: 6980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:09:26 13:21:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 445952
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
15
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start new [v2.1.0].exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA fuel.com choice.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6316"C:\Users\admin\Desktop\New [v2.1.0].exe" C:\Users\admin\Desktop\New [v2.1.0].exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\new [v2.1.0].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6480"C:\Windows\System32\cmd.exe" /c copy Sas Sas.cmd & Sas.cmdC:\Windows\SysWOW64\cmd.exe—New [v2.1.0].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6500\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6556tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6576findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6712tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6720findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6784cmd /c md 197411C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6804extrac32 /Y /E HampshireC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 243
Read events
1 243
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
19
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6316New [v2.1.0].exeC:\Users\admin\AppData\Local\Temp\Hampshirecompressed
MD5:9F82B8B7AF8A13649EDF30763A3AF724
SHA256:095BD75E2B89F7F765C5725F3CB951CE2035A9AAD506E57411CDFE34B985E82C
6316New [v2.1.0].exeC:\Users\admin\AppData\Local\Temp\Fleecebinary
MD5:77B975A68085E1CFB9FE5924485E7742
SHA256:61BEC7478304CABE73C0C50F296569B2F5CCFDAA912C6811BCCAF9B71C0C45A4
6316New [v2.1.0].exeC:\Users\admin\AppData\Local\Temp\Evidencebinary
MD5:D7BA65B05A7242969EBFCB675C6079F3
SHA256:080C36067201FF28429BBE2FFBD835DB081886BDE92EDF7D21E6F5F8D1A6DE28
6316New [v2.1.0].exeC:\Users\admin\AppData\Local\Temp\Warbinary
MD5:4171CC5F58A31A621AA4768FB0050F3D
SHA256:064106A399ACCC164B52B6BD9A5C18E801A342DBF8E28C1AEF0BC7F8F90AF05A
6804extrac32.exeC:\Users\admin\AppData\Local\Temp\Chemicalsbinary
MD5:66D0769A079800AA1C22302F43FA0A96
SHA256:02F6688B0946D3AF3DE1EDEDF344B232FA838DCEDF79E0BA1294D7A02B438570
6316New [v2.1.0].exeC:\Users\admin\AppData\Local\Temp\Turnerbinary
MD5:73FBB1FE4AA463D744EA8484186DFD82
SHA256:E85B227C58A2F9FF3E6DC36F954C8FD7423465D6A4C4156CC3A2CE26B341A582
6316New [v2.1.0].exeC:\Users\admin\AppData\Local\Temp\Integrationbinary
MD5:65C6E7447D2FC36BA111A84BF008369A
SHA256:063243FABEC259A6CAB3C4263162A4B70B0088A36066001CE58F45D24F7B7EDD
6316New [v2.1.0].exeC:\Users\admin\AppData\Local\Temp\Hangbinary
MD5:1001EB8F8004BF0309131C3D8C6FD148
SHA256:7BAE34107281F2CE640267B9CCA410527FFE8927CA8DD1068E08991C69ED01DB
6804extrac32.exeC:\Users\admin\AppData\Local\Temp\Rcabinary
MD5:87C1CCE3C28B18A045F03B5986916F68
SHA256:1ADEB6C8F004EBC0F8480560D31C6A50C3F9B94677AD2E3F8DA4147BBA93E9D8
6316New [v2.1.0].exeC:\Users\admin\AppData\Local\Temp\Spabinary
MD5:58B192A77C2EDB011C629E8F93EF8019
SHA256:5173DFEC587BC5B2830C02CC271560F55874C4D7F2561FAB822F380F8C9DEC5E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
38
DNS requests
20
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6396
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
3524
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3524
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
640
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 104.126.37.128
  • 104.126.37.153
  • 104.126.37.170
  • 104.126.37.185
  • 104.126.37.178
  • 104.126.37.176
  • 104.126.37.131
  • 104.126.37.129
  • 104.126.37.130
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 184.30.18.9
whitelisted
BUwLTZmikiMIWpI.BUwLTZmikiMIWpI
  • —
unknown
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 40.127.240.158
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
New [v2.1.0].exe