File name:

lnstaIIer_x86_patched.exe

Full analysis: https://app.any.run/tasks/e3c0b293-bbf4-4ba9-96f8-6176a86be043
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 12:35:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
autoit-loader
telegram
lumma
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

60B4E1B885190679650D67EE61C1001B

SHA1:

137ED46C6C6BF25749A9501DDBB9A5CB83FEAE6D

SHA256:

3C5B807F1F2662333D52AD59FD320624F8AB4D69D140F83015D938AB1A507847

SSDEEP:

98304:8voHQ5RXi4LThckz9llHYxYdripA3XIgFMPSB69rnMk2:UhCo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Mu.com (PID: 4892)

    • Create files in the Startup directory

      • cmd.exe (PID: 6028)

    • AutoIt loader has been detected (YARA)

      • Mu.com (PID: 4892)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • Actions looks like stealing of personal data

      • Mu.com (PID: 4892)

    • Steals credentials from Web Browsers

      • Mu.com (PID: 4892)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • lnstaIIer_x86_patched.exe (PID: 2392)

    • Executing commands from a ".bat" file

      • lnstaIIer_x86_patched.exe (PID: 2392)

    • Starts CMD.EXE for commands execution

      • lnstaIIer_x86_patched.exe (PID: 2392)
      • cmd.exe (PID: 660)

    • Get information on the list of running processes

      • cmd.exe (PID: 660)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 660)

    • Application launched itself

      • cmd.exe (PID: 660)

    • Starts application with an unusual extension

      • cmd.exe (PID: 660)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 660)

    • The executable file from the user directory is run by the CMD process

      • Mu.com (PID: 4892)

    • Executable content was dropped or overwritten

      • Mu.com (PID: 4892)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Mu.com (PID: 4892)

    • There is functionality for taking screenshot (YARA)

      • Mu.com (PID: 4892)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)

    • Searches for installed software

      • Mu.com (PID: 4892)

  • INFO

    • Checks supported languages

      • lnstaIIer_x86_patched.exe (PID: 2392)
      • extrac32.exe (PID: 4696)
      • Mu.com (PID: 4892)

    • Process checks computer location settings

      • lnstaIIer_x86_patched.exe (PID: 2392)

    • Reads the computer name

      • lnstaIIer_x86_patched.exe (PID: 2392)
      • extrac32.exe (PID: 4696)
      • Mu.com (PID: 4892)

    • The sample compiled with english language support

      • lnstaIIer_x86_patched.exe (PID: 2392)
      • Mu.com (PID: 4892)

    • Create files in a temporary directory

      • lnstaIIer_x86_patched.exe (PID: 2392)
      • extrac32.exe (PID: 4696)

    • Creates a new folder

      • cmd.exe (PID: 5124)

    • Reads mouse settings

      • Mu.com (PID: 4892)

    • Manual execution by a user

      • cmd.exe (PID: 6028)

    • Creates files or folders in the user directory

      • Mu.com (PID: 4892)

    • Reads the software policy settings

      • Mu.com (PID: 4892)
      • slui.exe (PID: 2136)
      • slui.exe (PID: 1056)

    • Checks proxy server information

      • slui.exe (PID: 1056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 432128
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 135.0.7049.85
ProductVersionNumber: 135.0.7049.85
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google LLC
FileDescription: Google Chrome
FileVersion: 135.0.7049.85
InternalName: chrome_exe
LegalCopyright: Copyright 2025 Google LLC. All rights reserved.
OriginalFileName: chrome.exe
ProductName: Google Chrome
ProductVersion: 135.0.7049.85
CompanyShortName: Google
ProductShortName: Chrome
LastChange: 1e112499da812a1dde62101ed601dcb93024aaff-refs/branch-heads/7049@{#1779}
OfficialBuild: 1
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
20
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start lnstaiier_x86_patched.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA mu.com choice.exe no specs cmd.exe conhost.exe no specs #LUMMA svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\WINDOWS\System32\cmd.exe" /c copy Neural.tmp Neural.tmp.bat & Neural.tmp.batC:\Windows\SysWOW64\cmd.exe—lnstaIIer_x86_patched.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1056C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1184findstr /V "EVE" Format C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1324tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2136"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2392"C:\Users\admin\Desktop\lnstaIIer_x86_patched.exe" C:\Users\admin\Desktop\lnstaIIer_x86_patched.exe—explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
135.0.7049.85
Modules
Images
c:\users\admin\desktop\lnstaiier_x86_patched.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2432tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3240findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
2 052
Read events
2 052
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
20
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
2392lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Taxi.tmpbinary
MD5:2C73AD9657BB4351A56E27D789DA441D
SHA256:533E2513E0C67364E724C27B8429A03BE41A1F4A082BB67623659E1B8CF7D79A
2392lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Neural.tmptext
MD5:1E504DF6035018F01FB2671E63C833B0
SHA256:947EE3D8EBD9ED9D5EE7B07664771A5B1EB63079E53EB992A7D0F4DD7E3B8BB8
2392lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Nature.tmpbinary
MD5:7BA6F0A4E3077CEF88BEA7655A68F42F
SHA256:D65696D18B24965AE30C486857CFBD60F263AC7BFDCA9BFB8597F5A98B457CFB
2392lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Sporting.tmpcompressed
MD5:5AB481C8A234B5AD671C12751F0AB604
SHA256:B509028644137C107B340BF8F3A2EDC9D9812D73BCC6EB98AD17FFF11782F3BE
2392lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Invitations.tmpbinary
MD5:B1F0AE657F0CFFAFF4905A2B89BE0063
SHA256:0E0AA6C8B70C090EACE0A914242834C5BB4EE9A9D41F9EC5E3309D5CD67870CE
2392lnstaIIer_x86_patched.exeC:\Users\admin\AppData\Local\Temp\Customise.tmpbinary
MD5:B69A2B08C6B4C0D962A2B0EC80578B8C
SHA256:67145993EFD2E799E8ABFEB970BE15B4C9BA91716F38966C1464C34BC1C4724A
660cmd.exeC:\Users\admin\AppData\Local\Temp\Neural.tmp.battext
MD5:1E504DF6035018F01FB2671E63C833B0
SHA256:947EE3D8EBD9ED9D5EE7B07664771A5B1EB63079E53EB992A7D0F4DD7E3B8BB8
4696extrac32.exeC:\Users\admin\AppData\Local\Temp\Gracebinary
MD5:B7580D764E252BA54202A683EC7BA429
SHA256:9FAF721D71EFFB7C588DEC7C2A98E6A18E5FAA0D9C635FBE7135B45CB7F480D2
4696extrac32.exeC:\Users\admin\AppData\Local\Temp\Formatbinary
MD5:4127B46ECA86BC16EC0E98276683AAF7
SHA256:1C15C2173EF5DACE1760637659A3E7AD34D24503C4DEC120AE38DAF71385CCFC
4696extrac32.exeC:\Users\admin\AppData\Local\Temp\Thumbsbinary
MD5:CA4B32A209731FED8EB1CD92A8F50293
SHA256:E16864B8C9669CDFA3A5D3692FDBCC1ECB55FF73F1EF55F48A33DFA31F361B9D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
32
DNS requests
30
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.191:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4228
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4228
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.191:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4892
Mu.com
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.191
  • 23.48.23.140
  • 23.48.23.156
  • 23.48.23.161
  • 23.48.23.147
  • 23.48.23.145
  • 23.48.23.153
  • 23.48.23.193
  • 23.48.23.141
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
qyphIBaHSKl.qyphIBaHSKl
  • —
unknown
login.live.com
  • 20.190.159.75
  • 40.126.31.73
  • 40.126.31.1
  • 20.190.159.129
  • 20.190.159.68
  • 20.190.159.0
  • 40.126.31.3
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
t.me
  • 149.154.167.99
whitelisted
eplinko.us
  • 104.21.15.162
  • 172.67.163.30
unknown

Threats

PID
Process
Class
Message
4892
Mu.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (changeaie .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (piratetwrath .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (liftally .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (quilltayle .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nighetwhisper .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zestmodp .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (salaccgfa .top)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (starofliught .top)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lnstaIIer_x86_patched.exe