Analysis date (UTC): 8 June 2024, 20:31Analysis environment: Windows 10 Pro, build 19045, x64

Setup_v1.0.5.exe

MD5:71093DFE2BC1B3D65ACAF5CC8177CDAF
SHA1:3F11200D6CA7CE563D39676AAD116A646B9A7F0C
SHA256:6EEA2773C1B4B5C6FB7C142933E220C96F9A4EC89055BF0CF54ACCDCDE7DF535

Analysis result

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

  • Setup_v1.0.5.exe (PID: 6488)

LUMMA has been detected (YARA)

  • Setup_v1.0.5.exe (PID: 6884)
  • Setup_v1.0.5.exe (PID: 6488)
  • BitLockerToGo.exe (PID: 6952)
  • BitLockerToGo.exe (PID: 7012)

LUMMA has been detected (SURICATA)

  • BitLockerToGo.exe (PID: 6952)
  • BitLockerToGo.exe (PID: 7012)

Actions looks like stealing of personal data

  • BitLockerToGo.exe (PID: 6952)
  • BitLockerToGo.exe (PID: 7012)

SUSPICIOUS

Searches for installed software

  • BitLockerToGo.exe (PID: 6952)
  • BitLockerToGo.exe (PID: 7012)

INFO

Checks supported languages

  • Setup_v1.0.5.exe (PID: 6488)
  • BitLockerToGo.exe (PID: 6952)
  • Setup_v1.0.5.exe (PID: 6884)
  • BitLockerToGo.exe (PID: 7012)

Reads the computer name

  • BitLockerToGo.exe (PID: 6952)
  • BitLockerToGo.exe (PID: 7012)

Reads the software policy settings

  • BitLockerToGo.exe (PID: 6952)
  • BitLockerToGo.exe (PID: 7012)

Manual execution by a user

  • Setup_v1.0.5.exe (PID: 6884)

Reads the machine GUID from the registry

  • BitLockerToGo.exe (PID: 6952)
  • BitLockerToGo.exe (PID: 7012)

Threats

PIDProcessClassMessage
6952BitLockerToGo.exeA Network Trojan was detectedSTEALER [ANY.RUN] Lumma Stealer TLS Connection
——A Network Trojan was detectedET MALWARE Lumma Stealer Related Activity
——Malware Command and Control Activity DetectedSTEALER [ANY.RUN] Win32/Lumma Stealer Check-In
——A Network Trojan was detectedET MALWARE Lumma Stealer Related Activity M2
——Malware Command and Control Activity DetectedET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration
——Malware Command and Control Activity DetectedSTEALER [ANY.RUN] Win32/Lumma Stealer Exfiltration
7012BitLockerToGo.exeA Network Trojan was detectedSTEALER [ANY.RUN] Lumma Stealer TLS Connection
——A Network Trojan was detectedET MALWARE Lumma Stealer Related Activity
——A Network Trojan was detectedET MALWARE Lumma Stealer Related Activity M2
——Malware Command and Control Activity DetectedSTEALER [ANY.RUN] Win32/Lumma Stealer Check-In

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN