File name:

Setup.exe

Full analysis: https://app.any.run/tasks/45d79eb2-4949-45ff-8a19-d8c7e6671494
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: August 28, 2024, 18:02:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
lumma
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

248EFB59A223BA854803752DAC53D470

SHA1:

5780E6AEA2F10F55271AB5515F81E6B44775A03F

SHA256:

6A476615986EB5EEF5B4EA2324D9DC1CA886364456E7F7FBDB063101C6C3E915

SSDEEP:

98304:mSt23MMkwV50N306f9h5XcmHv708m0ypwss5EcguLt/Mn3LkjYTul/q67OvOf4Tq:G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Stealers network behavior

      • BitLockerToGo.exe (PID: 5344)

    • LUMMA has been detected (SURICATA)

      • BitLockerToGo.exe (PID: 5344)

    • Actions looks like stealing of personal data

      • BitLockerToGo.exe (PID: 5344)

    • LUMMA has been detected (YARA)

      • BitLockerToGo.exe (PID: 5344)

    • Changes the autorun value in the registry

      • BitLockerToGo.exe (PID: 3268)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 7004)
      • BitLockerToGo.exe (PID: 3268)
      • BitLockerToGo.exe (PID: 5344)

    • There is functionality for communication over UDP network (YARA)

      • Setup.exe (PID: 7004)

    • Searches for installed software

      • BitLockerToGo.exe (PID: 5344)

    • Executable content was dropped or overwritten

      • BitLockerToGo.exe (PID: 3268)
      • BitLockerToGo.exe (PID: 5344)

    • Reads security settings of Internet Explorer

      • BitLockerToGo.exe (PID: 3268)

    • Reads the date of Windows installation

      • BitLockerToGo.exe (PID: 3268)

    • Process drops legitimate windows executable

      • BitLockerToGo.exe (PID: 3268)

    • Starts itself from another location

      • BitLockerToGo.exe (PID: 3268)

  • INFO

    • Checks supported languages

      • Setup.exe (PID: 7004)
      • BitLockerToGo.exe (PID: 5344)
      • NAAN6B1EZ0AO50LQYG6LLR.exe (PID: 3160)
      • BitLockerToGo.exe (PID: 3268)
      • Commsntuser.pol.exe (PID: 2876)

    • Reads the software policy settings

      • Setup.exe (PID: 7004)
      • BitLockerToGo.exe (PID: 5344)
      • slui.exe (PID: 2096)

    • Reads the computer name

      • BitLockerToGo.exe (PID: 5344)
      • Setup.exe (PID: 7004)
      • BitLockerToGo.exe (PID: 3268)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 7004)

    • Create files in a temporary directory

      • Setup.exe (PID: 7004)
      • BitLockerToGo.exe (PID: 5344)

    • Creates files in the program directory

      • BitLockerToGo.exe (PID: 3268)

    • Process checks computer location settings

      • BitLockerToGo.exe (PID: 3268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(5344) BitLockerToGo.exe
C2 (9)traineiwnqo.shop
stagedchheiqwo.shop
condedqpwqm.shop
stamppreewntnq.shop
locatedblsoqp.shop
timetabledffiewi.shop
caffegclasiqwp.shop
millyscroqwp.shop
evoliutwoqm.shop
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 3
CodeSize: 7349760
InitializedDataSize: 766976
UninitializedDataSize: -
EntryPoint: 0x774a0
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 4.6.0.0
ProductVersionNumber: 4.6.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Yota Software
FileDescription: Yota Email Migrator Setup
FileVersion: 4.6.0.0
LegalCopyright:
OriginalFileName:
ProductName: Yota Email Migrator
ProductVersion: 4.6.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
8
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start THREAT setup.exe #LUMMA bitlockertogo.exe sppextcomobj.exe no specs slui.exe naan6b1ez0ao50lqyg6llr.exe no specs bitlockertogo.exe commsntuser.pol.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2096"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2876"C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Desktop\Commsntuser.pol.exe" C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Desktop\Commsntuser.pol.exe—BitLockerToGo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BitLocker To Go Reader
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\programdata\mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38desktop\commsntuser.pol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
3160"C:\Users\admin\AppData\Local\Temp\NAAN6B1EZ0AO50LQYG6LLR.exe"C:\Users\admin\AppData\Local\Temp\NAAN6B1EZ0AO50LQYG6LLR.exe—BitLockerToGo.exe
User:
admin
Company:
Auslogics
Integrity Level:
MEDIUM
Description:
Auslogics ServiceCommander
Exit code:
666
Version:
2.x
Modules
Images
c:\users\admin\appdata\local\temp\naan6b1ez0ao50lqyg6llr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcryptprimitives.dll
3268"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
NAAN6B1EZ0AO50LQYG6LLR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BitLocker To Go Reader
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\bitlockerdiscoveryvolumecontents\bitlockertogo.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3672C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5344"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
BitLocker To Go Reader
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\bitlockerdiscoveryvolumecontents\bitlockertogo.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Lumma
(PID) Process(5344) BitLockerToGo.exe
C2 (9)traineiwnqo.shop
stagedchheiqwo.shop
condedqpwqm.shop
stamppreewntnq.shop
locatedblsoqp.shop
timetabledffiewi.shop
caffegclasiqwp.shop
millyscroqwp.shop
evoliutwoqm.shop
6880C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7004"C:\Users\admin\AppData\Local\Temp\Setup.exe" C:\Users\admin\AppData\Local\Temp\Setup.exe
explorer.exe
User:
admin
Company:
Yota Software
Integrity Level:
MEDIUM
Description:
Yota Email Migrator Setup
Exit code:
666
Version:
4.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
9 404
Read events
9 147
Write events
257
Delete events
0

Modification events

(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-462
Value:
Afghanistan Standard Time
(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-461
Value:
Afghanistan Daylight Time
(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-222
Value:
Alaskan Standard Time
(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-221
Value:
Alaskan Daylight Time
(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-2392
Value:
Aleutian Standard Time
(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-2391
Value:
Aleutian Daylight Time
(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-2162
Value:
Altai Standard Time
(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-2161
Value:
Altai Daylight Time
(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-392
Value:
Arab Standard Time
(PID) Process:(7004) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:C:\WINDOWS\system32\,@tzres.dll,-391
Value:
Arab Daylight Time
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5344BitLockerToGo.exeC:\Users\admin\AppData\Local\Temp\NAAN6B1EZ0AO50LQYG6LLR.exeexecutable
MD5:99D729B31262AB0F880F905FE50BFD32
SHA256:4B9265FE98DAF4D8EAFCEAAB2417AC6A45D25E7A2F55418CDE096A5ED0072370
3268BitLockerToGo.exeC:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Desktop\Commsntuser.pol.exeexecutable
MD5:A64BEAB5D4516BECA4C40B25DC0C1CD8
SHA256:36FB87F4E3048659D91FB4250D07582BBBEDA35A7A5839CA61AA0D85DC1BD63C
7004Setup.exeC:\Users\admin\AppData\Local\Temp\fake_useragent_0.2.0.jsonbinary
MD5:0AF58ABD8A3FD21EB8C012A05A58AD0E
SHA256:12A537681364542407E0E1A7BF52D51B213335F28BF8253A4871C2599FF55602
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
35
DNS requests
20
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1752
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5032
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5032
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6192
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
6264
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7004
Setup.exe
185.199.109.133:443
raw.githubusercontent.com
FASTLY
US
shared
6192
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5344
BitLockerToGo.exe
188.114.96.3:443
timetabledffiewi.shop
CLOUDFLARENET
NL
malicious
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1752
svchost.exe
40.126.29.10:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.110.133
shared
timetabledffiewi.shop
  • 188.114.96.3
  • 188.114.97.3
malicious
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.29.10
  • 40.126.29.15
  • 20.190.157.9
  • 40.126.29.7
  • 40.126.29.8
  • 20.190.157.11
  • 40.126.29.5
  • 40.126.29.12
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
bitbucket.org
  • 185.166.143.48
  • 185.166.143.49
  • 185.166.143.50
shared
bbuseruploads.s3.amazonaws.com
  • 52.217.64.148
  • 3.5.25.96
  • 3.5.29.217
  • 3.5.25.159
  • 52.216.26.236
  • 3.5.23.166
  • 52.217.117.49
  • 3.5.27.51
shared
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
5344
BitLockerToGo.exe
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe