Analysis date (UTC): 28 August 2024, 18:33Analysis environment: Windows 10 Pro, build 19045, x64

Setup.exe

MD5:6CF063919156A1A045D2E624E0450AF0

SHA1:D620F14EE2252AA51E0370D61F887A55EBB5EA6E

SHA256:5E9BA24639F70787E56F10A241271AE819EF9C573EDB22B9EEADE7CB40A2DF2A

Analysis result

Threat level:Malicious activity

Tags:

lummastealer

Full analysis:Analysis Setup.exe (MD5: 6CF063919156A1A045D2E624E0450AF0) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Stealers network behavior

BitLockerToGo.exe (PID: 4604)

LUMMA has been detected (SURICATA)

BitLockerToGo.exe (PID: 4604)

Actions looks like stealing of personal data

BitLockerToGo.exe (PID: 4604)

LUMMA has been detected (YARA)

BitLockerToGo.exe (PID: 4604)

Changes the autorun value in the registry

BitLockerToGo.exe (PID: 2576)

SUSPICIOUS

Drops the executable file immediately after the start

Setup.exe (PID: 4688)
BitLockerToGo.exe (PID: 4604)
BitLockerToGo.exe (PID: 2576)

There is functionality for communication over UDP network (YARA)

Setup.exe (PID: 4688)
J4PLAZUKIEVB6MJC.exe (PID: 5112)

Searches for installed software

BitLockerToGo.exe (PID: 4604)

Executable content was dropped or overwritten

BitLockerToGo.exe (PID: 4604)
BitLockerToGo.exe (PID: 2576)

Process drops legitimate windows executable

BitLockerToGo.exe (PID: 2576)

Reads security settings of Internet Explorer

BitLockerToGo.exe (PID: 2576)

Reads the date of Windows installation

BitLockerToGo.exe (PID: 2576)

Starts itself from another location

BitLockerToGo.exe (PID: 2576)

INFO

Reads the computer name

BitLockerToGo.exe (PID: 4604)
BitLockerToGo.exe (PID: 2576)

Checks supported languages

BitLockerToGo.exe (PID: 4604)
Setup.exe (PID: 4688)
J4PLAZUKIEVB6MJC.exe (PID: 5112)
BitLockerToGo.exe (PID: 2576)
USOPrivateTemplates.exe (PID: 1840)

Reads the software policy settings

BitLockerToGo.exe (PID: 4604)

Create files in a temporary directory

BitLockerToGo.exe (PID: 4604)

Creates files in the program directory

BitLockerToGo.exe (PID: 2576)

Process checks computer location settings

BitLockerToGo.exe (PID: 2576)

Threats

PID	Process	Class	Message
4604	BitLockerToGo.exe	A Network Trojan was detected	STEALER [ANY.RUN] Lumma Stealer TLS Connection