File name:

EnterPoem.exe

Full analysis: https://app.any.run/tasks/2933096b-9f39-478b-91e3-df1165608163
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: November 02, 2024, 16:26:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit-loader
stealer
lumma
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

D525FD714F5C8BDBDE9FB2F2D87F1A1A

SHA1:

06892F112A319717312EFB86519E8A67D0671998

SHA256:

45C5C765C84272B599A28BB94F044F36D44266DDFEF13D0F6EF2A90283FC1410

SSDEEP:

49152:b/nsIJNd8NYvRySGx96qRFmryEbMJETrMIl5yYSTz58ekiCprfYP/Z6xxJckRyvz:bPsIJNd8mF2kW2TrMM5yYSh/CpEXZ6dO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Trackback.pif (PID: 2588)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2172)

    • Changes powershell execution policy (Bypass)

      • Trackback.pif (PID: 2588)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6300)

    • Stealers network behavior

      • svchost.exe (PID: 2172)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • EnterPoem.exe (PID: 6772)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6868)
      • EnterPoem.exe (PID: 6772)

    • Reads security settings of Internet Explorer

      • EnterPoem.exe (PID: 6772)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 6868)

    • The executable file from the user directory is run by the CMD process

      • Trackback.pif (PID: 2588)

    • Get information on the list of running processes

      • cmd.exe (PID: 6868)

    • Application launched itself

      • cmd.exe (PID: 6868)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 6868)
      • AutoIt3.exe (PID: 6316)
      • Trackback.pif (PID: 2588)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6868)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6868)

    • The process executes Powershell scripts

      • Trackback.pif (PID: 2588)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2172)

    • Node.exe was dropped

      • Trackback.pif (PID: 2588)

    • Starts POWERSHELL.EXE for commands execution

      • Trackback.pif (PID: 2588)

  • INFO

    • Create files in a temporary directory

      • EnterPoem.exe (PID: 6772)

    • Reads the computer name

      • EnterPoem.exe (PID: 6772)
      • Trackback.pif (PID: 2588)

    • Process checks computer location settings

      • EnterPoem.exe (PID: 6772)

    • The process uses the downloaded file

      • EnterPoem.exe (PID: 6772)

    • Creates a new folder

      • cmd.exe (PID: 5168)

    • Checks supported languages

      • Trackback.pif (PID: 2588)
      • EnterPoem.exe (PID: 6772)

    • Reads mouse settings

      • Trackback.pif (PID: 2588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:19:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 475136
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 9.37.6.44883
ProductVersionNumber: 9.37.6.44883
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
LegalTrademarks: SpectraFox is a trademark of ColorSync Dynamics
ProductName: SpectraFox
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
192
Monitored processes
61
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start enterpoem.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs THREAT trackback.pif choice.exe no specs sppextcomobj.exe no specs slui.exe no specs #LUMMA svchost.exe 3jju1wu5yibzzq5wbto91e6.exe no specs powershell.exe no specs conhost.exe no specs comp.exe no specs conhost.exe no specs autoit3.exe microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs microsoftedgeupdatecore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1008"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe—AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1048"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe—AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1084findstr /V "initiativemanufacturingborncached" Clip C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1112"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe—AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1252"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe—AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1344"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe—AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1568"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1576"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe—AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1744"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe—AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1748"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateCore.exe—AutoIt3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
5 765
Read events
5 764
Write events
1
Delete events
0

Modification events

(PID) Process:(6316) AutoIt3.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:ebhhaeg
Value:
"C:\hbcfbdf\AutoIt3.exe" C:\hbcfbdf\ebhhaeg.a3x
Executable files
4
Suspicious files
15
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6772EnterPoem.exeC:\Users\admin\AppData\Local\Temp\Manufacturersbinary
MD5:32B02CEB9CF2390B0BAA1287869B183C
SHA256:6E0A523A35FC0889B2CA967DF9E49F9BC24A757FD8DA15C10B376D5548C1F1E1
6772EnterPoem.exeC:\Users\admin\AppData\Local\Temp\Clipbinary
MD5:A50EA9A47715B1EEBE76D0797A90A443
SHA256:4E0FF3771ABF5525D183CA61934C27E315D18E060A2B14F15857A7820FC50915
6772EnterPoem.exeC:\Users\admin\AppData\Local\Temp\Feelingbinary
MD5:BAB8BC88DC75E1876929B9C6E700A683
SHA256:C5305A5807CB55ED1799ABC0A7215F6D5DA4F3E888FAE5F9E30FCBE0B8F26A7A
6772EnterPoem.exeC:\Users\admin\AppData\Local\Temp\Woundbinary
MD5:9EDAA1FD97302AF249ED4B1BEE766B89
SHA256:DE372460E39B3598371EAA5D87A53821FA9CD09C1579CB196EB0CE8D84DD2F51
2588Trackback.pifC:\Users\admin\AppData\Local\Temp\PJRQ35\Afflicted.a3x —
MD5:—
SHA256:—
6772EnterPoem.exeC:\Users\admin\AppData\Local\Temp\Relytext
MD5:F7189EA942DD1366B89B7B865F4D6227
SHA256:5A1CF60FE4FB87911DD71467AA59740D11C9A5F13DB47801CD1A4AB7ECF89164
6316AutoIt3.exeC:\hbcfbdf\ebhhaeg.a3x —
MD5:—
SHA256:—
26483JJU1WU5YIBZZQ5WBTO91E6.exeC:\Users\admin\AppData\Local\Temp\826cc3f7image
MD5:E11362AB856AD40E432C9AA356EA7FB0
SHA256:2EE91362BBE22AADA4D879FA18DFC5FDA57700BD8255B084789339C6950148A2
2588Trackback.pifC:\Users\admin\AppData\Local\Temp\K9Q7WNRY7CA2HU3K60CO.ps1html
MD5:EE70E52441EC629D1708DFD3BBBFE7D7
SHA256:4FF9EB9A44F8D55794854AC15DC70A4DE297478012582A21C7D4864202470903
6772EnterPoem.exeC:\Users\admin\AppData\Local\Temp\Trimbinary
MD5:E810E55AF75FF79DFD1D8597E8101A43
SHA256:0969399090A4F8710D84D4620DB829592C3A6E08B40C9702F7CDC45376018455
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
49
DNS requests
28
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6996
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6996
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2588
Trackback.pif
GET
200
172.217.18.3:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
4004
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7132
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2588
Trackback.pif
GET
200
172.217.18.3:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3524
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
92.123.104.65:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4004
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4004
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
780
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 40.127.240.158
whitelisted
www.bing.com
  • 92.123.104.65
  • 92.123.104.10
  • 92.123.104.9
  • 92.123.104.63
  • 92.123.104.17
  • 92.123.104.4
  • 92.123.104.6
  • 92.123.104.67
  • 92.123.104.12
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.185.142
whitelisted
eYOIVVhHJz.eYOIVVhHJz
  • —
unknown
login.live.com
  • 40.126.31.73
  • 20.190.159.73
  • 20.190.159.2
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.0
  • 40.126.31.71
  • 40.126.31.69
whitelisted
th.bing.com
  • 92.123.104.65
  • 92.123.104.63
  • 92.123.104.67
  • 92.123.104.4
  • 92.123.104.62
  • 92.123.104.10
  • 92.123.104.6
  • 92.123.104.9
  • 92.123.104.12
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
crl.microsoft.com
  • 23.48.23.177
  • 23.48.23.167
  • 23.48.23.164
  • 23.48.23.143
  • 23.48.23.147
  • 23.48.23.176
  • 23.48.23.145
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 23.32.185.131
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
2172
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
2588
Trackback.pif
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
2172
svchost.exe
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Domain has been identified as part of Lumma Stealer's infrastructure (creative-habitat .shop)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EnterPoem.exe