File name:

Set-up.exe

Full analysis: https://app.any.run/tasks/b1a9a346-af9e-4a17-b10f-462e67d88fb6
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: January 05, 2025, 10:30:23
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

8139ECD1163D5FCC41821DBB61DDC2FF

SHA1:

707F18CC33E9BA8F7ADA11B202B44876D375CECF

SHA256:

4DBF3891EF5BB0E734B67630FE2B5210035D56307AD663F3867D9EBCDD00497A

SSDEEP:

98304:kv9ZEG/HONbSxhCi+EdltEWmDfLOc8GQo6+NIVmC9EVJh:R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Establish.com (PID: 5404)

    • Connects to the CnC server

      • svchost.exe (PID: 2192)

    • Stealers network behavior

      • Establish.com (PID: 5404)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)
      • Establish.com (PID: 5404)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Set-up.exe (PID: 6804)

    • Get information on the list of running processes

      • cmd.exe (PID: 6848)

    • Starts CMD.EXE for commands execution

      • Set-up.exe (PID: 6804)
      • cmd.exe (PID: 6848)

    • Executing commands from ".cmd" file

      • Set-up.exe (PID: 6804)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6848)

    • Application launched itself

      • cmd.exe (PID: 6848)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6848)

    • The executable file from the user directory is run by the CMD process

      • Establish.com (PID: 5404)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6848)

    • Contacting a server suspected of hosting an CnC

      • Establish.com (PID: 5404)
      • svchost.exe (PID: 2192)

  • INFO

    • Checks supported languages

      • Set-up.exe (PID: 6804)
      • extrac32.exe (PID: 7128)
      • Establish.com (PID: 5404)

    • Reads the computer name

      • Set-up.exe (PID: 6804)
      • extrac32.exe (PID: 7128)
      • Establish.com (PID: 5404)

    • Creates files or folders in the user directory

      • Set-up.exe (PID: 6804)
      • extrac32.exe (PID: 7128)

    • Process checks computer location settings

      • Set-up.exe (PID: 6804)

    • The process uses the downloaded file

      • Set-up.exe (PID: 6804)

    • Creates a new folder

      • cmd.exe (PID: 7108)

    • Reads mouse settings

      • Establish.com (PID: 5404)

    • Reads the machine GUID from the registry

      • Establish.com (PID: 5404)

    • Reads the software policy settings

      • Establish.com (PID: 5404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:09:26 13:21:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 480768
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
15
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start set-up.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA establish.com choice.exe no specs #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3696choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5404Establish.com u C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\inetcache\446130\establish.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6232cmd /c copy /b 446130\Establish.com + Jon + Suggestion + Career + Biz + Build + Getting + Diving + Generation + Crossword + Betting + Lender 446130\Establish.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6292cmd /c copy /b ..\Teen + ..\Alabama + ..\Important + ..\Drawings + ..\Den + ..\Sluts + ..\Names u C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6804"C:\Users\admin\Desktop\Set-up.exe" C:\Users\admin\Desktop\Set-up.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\set-up.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6848"C:\Windows\System32\cmd.exe" /c move Manor Manor.cmd & Manor.cmdC:\Windows\SysWOW64\cmd.exe—Set-up.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6940tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6948findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
3 902
Read events
3 902
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
21
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6804Set-up.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Denbinary
MD5:5DEFD3F542122B3A5ABD75B165E2CC7B
SHA256:5EEB8AF7E11B5DC69E16C0B844112C5011F1D8968459F6EF35A164C85C023E7C
6804Set-up.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Teenbinary
MD5:8A5C1741055D26716C478719663D3B8F
SHA256:44B69842D307C29252BF633B5620763CF03A86802F290B16FC170A0F58072BA0
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Gettingbinary
MD5:22061E39A2E5A05CB18FF97072D7DF38
SHA256:418FD2806D521594FE53D8FD14F6E4DB9478C94EA9DA3B4B43147DCDD19FFFF4
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Lenderbinary
MD5:2E2BD7823F992547CC126F7C518577CB
SHA256:6BC170392D6E9B1869771304BF95A29BF79A4E9FBA8E649EFA3C130660140E2E
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Careerbinary
MD5:4C97B36B018276C1CFEA2CAF84412819
SHA256:37281A1856B71C3AE5AD48CDF5F069C2A37017578925097B52C9C8AE316574D3
6804Set-up.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Alabamabinary
MD5:FA299C830E33A1DF942763E78A44FF36
SHA256:EE014925BD3B6332A435A69A3D0A39E7F2BF8D7188173EC8545591F39BCB3F37
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Jonbinary
MD5:8340AA793C44278994245D0E1E22BED3
SHA256:69D62F5B19C8C0559DFE5EE0E8D9C28251187C4970AF93E805E6E0680B5556BA
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Crosswordbinary
MD5:6892F6D8AEDBFC545AECD2516D291852
SHA256:859A1095806FDCB198915C0BCB29DA52E9D48F5572E7A5573EF844379BC2ABC2
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Lifetimebinary
MD5:AE568D06EBA40193FCA35D5AF1264538
SHA256:EE4F9382261BEE98C7F5C3511144985DD79856BF4745665FF59444A754623187
7128extrac32.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Buildbinary
MD5:C48C0679685C473A47C3891E4D02B9B2
SHA256:CA8FB1C7CAF38D7483697762BECAC0C29AF09F2D2705366FBC941C30D53B7262
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
28
DNS requests
20
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
440
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
188.114.97.3:443
https://deletteproposez.click/api
unknown
text
17 b
unknown
—
—
POST
200
104.21.112.1:443
https://abruptyopsn.shop/api
unknown
text
17 b
malicious
—
—
POST
200
104.21.71.146:443
https://noisycuttej.shop/api
unknown
text
17 b
malicious
—
—
POST
200
104.21.112.1:443
https://tirepublicerj.shop/api
unknown
text
17 b
malicious
—
—
GET
200
23.212.216.106:443
https://steamcommunity.com/profiles/76561199724331900
unknown
html
34.3 Kb
whitelisted
—
—
POST
200
172.67.160.114:443
https://wholersorie.shop/api
unknown
text
17 b
malicious
—
—
POST
200
172.67.179.160:443
https://framekgirus.shop/api
unknown
text
17 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.137:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
440
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5404
Establish.com
188.114.97.3:443
deletteproposez.click
CLOUDFLARENET
NL
unknown
5404
Establish.com
104.21.112.1:443
abruptyopsn.shop
CLOUDFLARENET
—
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
google.com
  • 142.250.74.206
whitelisted
crl.microsoft.com
  • 23.48.23.137
  • 23.48.23.188
  • 23.48.23.183
  • 23.48.23.191
  • 23.48.23.134
  • 23.48.23.181
  • 23.48.23.140
  • 23.48.23.138
  • 23.48.23.194
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fJLEZdwdvmkbhApFpKCL.fJLEZdwdvmkbhApFpKCL
  • —
unknown
deletteproposez.click
  • 188.114.97.3
  • 188.114.96.3
unknown
nearycrepso.shop
  • —
malicious
abruptyopsn.shop
  • 104.21.112.1
  • 104.21.80.1
  • 104.21.48.1
  • 104.21.96.1
  • 104.21.64.1
  • 104.21.16.1
  • 104.21.32.1
malicious
wholersorie.shop
  • 172.67.160.114
  • 104.21.41.51
malicious

Threats

PID
Process
Class
Message
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abruptyopsn .shop)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nearycrepso .shop)
5404
Establish.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (abruptyopsn .shop in TLS SNI)
5404
Establish.com
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wholersorie .shop)
5404
Establish.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (wholersorie .shop in TLS SNI)
5404
Establish.com
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (framekgirus .shop)
5404
Establish.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (framekgirus .shop in TLS SNI)
5404
Establish.com
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Set-up.exe