Malware analysis genhqq.xyz Malicious activity | ANY.RUN

Add for printing

URL:	genhqq.xyz
Full analysis:	https://app.any.run/tasks/5703d0f3-5e00-4a1b-9823-c1f0fead1a05
Verdict:	Malicious activity
Threats:	Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	July 06, 2025, 04:24:23
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	lumma stealer
Indicators:
MD5:	9ECABFBD92C9CAE09DADD11EA0C7FB44
SHA1:	DFC40F6A45574C7E113D1FF5B67238D6CEA7C474
SHA256:	68054BDCA35B078DA55AE7135CDFCBAA52943744939975A85ADFB97E8EEDD562
SSDEEP:	3:dNpu:dNpu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- LUMMA has been detected (SURICATA)
  - msedge.exe (PID: 5012)
- Connects to the CnC server
  - msedge.exe (PID: 5012)
SUSPICIOUS
- Contacting a server suspected of hosting an CnC
  - msedge.exe (PID: 5012)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

150

Monitored processes

1

Malicious processes

1

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
5012	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --webtransport-developer-mode --string-annotations --always-read-main-dll --field-trial-handle=2180,i,6161488519127897921,10116046693238162506,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe		msedge.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92

Add for printing

Total events

0

Read events

0

Write events

0

Delete events

0

Modification events

No data

Add for printing

Executable files

0

Suspicious files

3

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State		binary
		MD5:F054A7D6E382DF24018FE84986B710A2	SHA256:4E5235C6B40BCE6C5FD0554D554FCDB38E8016DCDDFA9CAB63103407CAF8DAEB
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RFc8e0c.TMP		binary
		MD5:8CA6AC4CD0D4F8B2EA5A9FC6FD4311D7	SHA256:EE810A451AEA499C3D6F89EDB840ED025DF0937874485A211A3BB39F915F4EA0
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\36d5314c-ee44-4d31-b513-4587ec0d699d.tmp		binary
		MD5:F054A7D6E382DF24018FE84986B710A2	SHA256:4E5235C6B40BCE6C5FD0554D554FCDB38E8016DCDDFA9CAB63103407CAF8DAEB

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

59

TCP/UDP connections

61

DNS requests

42

Threats

5

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	HEAD	403	199.232.210.172:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9?P1=1751247403&P2=404&P3=2&P4=KIOuyaltQzGUv9%2fRXevwe%2b%2fSXHyfYvf%2f5L%2fb6O%2fEjuA9bg7JGUT71DQcxatSu%2by%2f0Fb5ScE2gwu8%2bMYnHtBQiQ%3d%3d	unknown	—	—	whitelisted
—	—	HEAD	200	23.212.222.21:443	https://fs.microsoft.com/fs/windows/config.json	unknown	—	—	—
—	—	GET	404	144.172.115.212:443	https://genhqq.xyz/	unknown	—	—	—
—	—	POST	200	150.171.28.11:443	https://edge.microsoft.com/componentupdater/api/v1/update	unknown	text	1.48 Kb	whitelisted
—	—	GET	200	23.212.222.21:443	https://fs.microsoft.com/fs/windows/config.json	unknown	binary	55 b	whitelisted
6360	RUXIMICS.exe	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5336	MoUsoCoreWorker.exe	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4784	svchost.exe	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5012	msedge.exe	GET	403	199.232.210.172:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9?P1=1751247403&P2=404&P3=2&P4=KIOuyaltQzGUv9%2fRXevwe%2b%2fSXHyfYvf%2f5L%2fb6O%2fEjuA9bg7JGUT71DQcxatSu%2by%2f0Fb5ScE2gwu8%2bMYnHtBQiQ%3d%3d	unknown	—	—	whitelisted
5336	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4784	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6360	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5336	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	199.232.210.172:80	msedge.b.tlu.dl.delivery.mp.microsoft.com	FASTLY	US	whitelisted
5012	msedge.exe	2.16.241.201:443	www.bing.com	Akamai International B.V.	DE	whitelisted
4900	svchost.exe	104.102.63.189:443	fs.microsoft.com	AKAMAI-AS	US	whitelisted
6360	RUXIMICS.exe	2.20.245.139:80	crl.microsoft.com	Akamai International B.V.	SE	whitelisted
5336	MoUsoCoreWorker.exe	2.20.245.139:80	crl.microsoft.com	Akamai International B.V.	SE	whitelisted
4784	svchost.exe	2.20.245.139:80	crl.microsoft.com	Akamai International B.V.	SE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 51.124.78.146 4.231.128.59	whitelisted
msedge.b.tlu.dl.delivery.mp.microsoft.com	199.232.210.172 199.232.214.172 208.89.74.27 208.89.74.29 208.89.74.17 208.89.74.21 208.89.74.23 208.89.74.31 208.89.74.19 2.16.168.112 2.16.168.108	whitelisted
google.com	142.250.185.110	whitelisted
www.bing.com	2.16.241.201 2.16.241.218 2.16.204.141 2.16.204.161	whitelisted
fs.microsoft.com	104.102.63.189	whitelisted
crl.microsoft.com	2.20.245.139 2.20.245.137 23.216.77.28 23.216.77.6	whitelisted
genhqq.xyz	144.172.115.212	unknown
edge.microsoft.com	150.171.27.11 150.171.28.11	whitelisted
www.microsoft.com	95.101.149.131 2.23.181.156	whitelisted
config.edge.skype.com	13.107.42.16	whitelisted

Threats

PID	Process	Class	Message
—	—	Domain Observed Used for C2 Detected	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (genhqq .xyz)
—	—	Domain Observed Used for C2 Detected	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (genhqq .xyz)
—	—	Domain Observed Used for C2 Detected	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (genhqq .xyz)
—	—	Domain Observed Used for C2 Detected	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (genhqq .xyz)
—	—	Domain Observed Used for C2 Detected	ET MALWARE Observed Win32/Lumma Stealer Related Domain (genhqq .xyz) in TLS SNI

Add for printing

No debug info

General Info

genhqq.xyz

9ECABFBD92C9CAE09DADD11EA0C7FB44

DFC40F6A45574C7E113D1FF5B67238D6CEA7C474

68054BDCA35B078DA55AE7135CDFCBAA52943744939975A85ADFB97E8EEDD562

3:dNpu:dNpu

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

LUMMA has been detected (SURICATA)

Connects to the CnC server

SUSPICIOUS

Contacting a server suspected of hosting an CnC

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings