File name:

Set-up.exe

Full analysis: https://app.any.run/tasks/b1a9a346-af9e-4a17-b10f-462e67d88fb6
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: January 05, 2025, 10:30:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

8139ECD1163D5FCC41821DBB61DDC2FF

SHA1:

707F18CC33E9BA8F7ADA11B202B44876D375CECF

SHA256:

4DBF3891EF5BB0E734B67630FE2B5210035D56307AD663F3867D9EBCDD00497A

SSDEEP:

98304:kv9ZEG/HONbSxhCi+EdltEWmDfLOc8GQo6+NIVmC9EVJh:R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Establish.com (PID: 5404)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)
      • Establish.com (PID: 5404)

    • Connects to the CnC server

      • svchost.exe (PID: 2192)

    • Stealers network behavior

      • Establish.com (PID: 5404)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Set-up.exe (PID: 6804)
      • cmd.exe (PID: 6848)

    • Reads security settings of Internet Explorer

      • Set-up.exe (PID: 6804)

    • Executing commands from ".cmd" file

      • Set-up.exe (PID: 6804)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6848)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6848)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6848)

    • Application launched itself

      • cmd.exe (PID: 6848)

    • Get information on the list of running processes

      • cmd.exe (PID: 6848)

    • The executable file from the user directory is run by the CMD process

      • Establish.com (PID: 5404)

    • Contacting a server suspected of hosting an CnC

      • Establish.com (PID: 5404)
      • svchost.exe (PID: 2192)

  • INFO

    • Creates files or folders in the user directory

      • Set-up.exe (PID: 6804)
      • extrac32.exe (PID: 7128)

    • Reads the computer name

      • Set-up.exe (PID: 6804)
      • extrac32.exe (PID: 7128)
      • Establish.com (PID: 5404)

    • Checks supported languages

      • Set-up.exe (PID: 6804)
      • extrac32.exe (PID: 7128)
      • Establish.com (PID: 5404)

    • Creates a new folder

      • cmd.exe (PID: 7108)

    • Process checks computer location settings

      • Set-up.exe (PID: 6804)

    • The process uses the downloaded file

      • Set-up.exe (PID: 6804)

    • Reads mouse settings

      • Establish.com (PID: 5404)

    • Reads the software policy settings

      • Establish.com (PID: 5404)

    • Reads the machine GUID from the registry

      • Establish.com (PID: 5404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:09:26 13:21:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 480768
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
15
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start set-up.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA establish.com choice.exe no specs #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3696choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5404Establish.com u C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\inetcache\446130\establish.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6232cmd /c copy /b 446130\Establish.com + Jon + Suggestion + Career + Biz + Build + Getting + Diving + Generation + Crossword + Betting + Lender 446130\Establish.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6292cmd /c copy /b ..\Teen + ..\Alabama + ..\Important + ..\Drawings + ..\Den + ..\Sluts + ..\Names u C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6804"C:\Users\admin\Desktop\Set-up.exe" C:\Users\admin\Desktop\Set-up.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\set-up.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6848"C:\Windows\System32\cmd.exe" /c move Manor Manor.cmd & Manor.cmdC:\Windows\SysWOW64\cmd.exe—Set-up.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6940tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6948findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
3 902
Read events
3 902
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
21
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6804Set-up.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Relationscompressed
MD5:5E0DE4F2FD4D38EE81A15AC14CE2C969
SHA256:7A2A356B7F46E4F37999DD9CE3ECFA7A66CE7DDA4FB5A61CFB7DC840489B7FC4
6804Set-up.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Namesbinary
MD5:57B6A485627BAECFA5DCFB502302F5A1
SHA256:B136E3405BFFB3F933D9D0D2E58D60D7C0F3C9C524ED7BC35AB5E062E507113D
6848cmd.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Manor.cmdtext
MD5:D56C18404768483C2484A502B0DA5FC4
SHA256:B820146A0717C92007A6C5CDE0FBED169576E1E31D3BA5BB456ED04FF9F0E9D3
6804Set-up.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Importantbinary
MD5:ADACC2F80343487D73B16F8123C54B7D
SHA256:B08BBEA7033A56F42B720CCFE7998E9420BC9561F5069AFE30CA8AAAAC908A7B
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Buildbinary
MD5:C48C0679685C473A47C3891E4D02B9B2
SHA256:CA8FB1C7CAF38D7483697762BECAC0C29AF09F2D2705366FBC941C30D53B7262
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Suggestionbinary
MD5:8962D624F9206BC21E436E50875BAA4F
SHA256:59393AF256C1C55406511C5885B1523681FB035188C6CFCBEA4FD84C3747FA67
6804Set-up.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Slutsbinary
MD5:28D8ADD8D0A4C5DF5C6A4B44DDE54D38
SHA256:5F7F9CF7166F9332D99893BDF51FF2E89EB882859ED4A61431753629DB9219E7
6804Set-up.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Manortext
MD5:D56C18404768483C2484A502B0DA5FC4
SHA256:B820146A0717C92007A6C5CDE0FBED169576E1E31D3BA5BB456ED04FF9F0E9D3
6804Set-up.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Drawingsbinary
MD5:6653A3FACEB89300BE8C6678416E1756
SHA256:C4B45B1CAF5665F279B4B23223BFB9248788C254FEB22A80553D2E141E068A51
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Careerbinary
MD5:4C97B36B018276C1CFEA2CAF84412819
SHA256:37281A1856B71C3AE5AD48CDF5F069C2A37017578925097B52C9C8AE316574D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
28
DNS requests
20
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
440
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.212.216.106:443
https://steamcommunity.com/profiles/76561199724331900
unknown
html
34.3 Kb
whitelisted
—
—
POST
200
172.67.160.114:443
https://wholersorie.shop/api
unknown
text
17 b
malicious
—
—
POST
200
104.21.71.146:443
https://noisycuttej.shop/api
unknown
text
17 b
malicious
—
—
POST
200
172.67.179.160:443
https://framekgirus.shop/api
unknown
text
17 b
malicious
—
—
POST
200
104.21.112.1:443
https://tirepublicerj.shop/api
unknown
text
17 b
malicious
—
—
POST
200
188.114.97.3:443
https://deletteproposez.click/api
unknown
text
17 b
—
—
—
POST
200
104.21.48.1:443
https://cloudewahsj.shop/api
unknown
text
17 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.137:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
440
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5404
Establish.com
188.114.97.3:443
deletteproposez.click
CLOUDFLARENET
NL
unknown
5404
Establish.com
104.21.112.1:443
abruptyopsn.shop
CLOUDFLARENET
—
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
google.com
  • 142.250.74.206
whitelisted
crl.microsoft.com
  • 23.48.23.137
  • 23.48.23.188
  • 23.48.23.183
  • 23.48.23.191
  • 23.48.23.134
  • 23.48.23.181
  • 23.48.23.140
  • 23.48.23.138
  • 23.48.23.194
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fJLEZdwdvmkbhApFpKCL.fJLEZdwdvmkbhApFpKCL
  • —
unknown
deletteproposez.click
  • 188.114.97.3
  • 188.114.96.3
unknown
nearycrepso.shop
  • —
malicious
abruptyopsn.shop
  • 104.21.112.1
  • 104.21.80.1
  • 104.21.48.1
  • 104.21.96.1
  • 104.21.64.1
  • 104.21.16.1
  • 104.21.32.1
malicious
wholersorie.shop
  • 172.67.160.114
  • 104.21.41.51
malicious

Threats

PID
Process
Class
Message
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abruptyopsn .shop)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nearycrepso .shop)
5404
Establish.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (abruptyopsn .shop in TLS SNI)
5404
Establish.com
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wholersorie .shop)
5404
Establish.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (wholersorie .shop in TLS SNI)
5404
Establish.com
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (framekgirus .shop)
5404
Establish.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (framekgirus .shop in TLS SNI)
5404
Establish.com
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Set-up.exe