File name:

LatitudeVsnet.exe

Full analysis: https://app.any.run/tasks/14cf742f-fc43-4b08-babe-786dc112037a
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:09:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
stealer
lumma
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

E643C56CD85FEBCEA0566CE4D1F63CAC

SHA1:

9D2FD7E7B4F28C994A371CEE42C29201AEC41B95

SHA256:

70CC1F20CF73146B96D6EBA742FB3403F0A6AA19B6DCED57D134BCAE9DEEB878

SSDEEP:

49152:dcCnHouk5+mn+NfRN7vu/aIYCiTR66L0MVvtB6hgQ2qZMiIrcWjwYck+Icca8cVG:Yuo0JNDu/aIl4ABMzwgQwcWUBBczbUqE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • LatitudeVsnet.exe (PID: 6512)

    • Steals credentials from Web Browsers

      • Grades.com (PID: 4896)

    • LUMMA mutex has been found

      • Grades.com (PID: 4896)

    • Actions looks like stealing of personal data

      • Grades.com (PID: 4896)

    • AutoIt loader has been detected (YARA)

      • Grades.com (PID: 4896)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • LatitudeVsnet.exe (PID: 6512)

    • Executing commands from a ".bat" file

      • LatitudeVsnet.exe (PID: 6512)

    • Starts CMD.EXE for commands execution

      • LatitudeVsnet.exe (PID: 6512)
      • cmd.exe (PID: 5436)

    • There is functionality for taking screenshot (YARA)

      • LatitudeVsnet.exe (PID: 6512)
      • Grades.com (PID: 4896)

    • Get information on the list of running processes

      • cmd.exe (PID: 5436)

    • Application launched itself

      • cmd.exe (PID: 5436)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5436)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5436)

    • The executable file from the user directory is run by the CMD process

      • Grades.com (PID: 4896)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 5436)

    • Searches for installed software

      • Grades.com (PID: 4896)

  • INFO

    • Process checks computer location settings

      • LatitudeVsnet.exe (PID: 6512)

    • Checks supported languages

      • LatitudeVsnet.exe (PID: 6512)
      • extrac32.exe (PID: 6488)
      • Grades.com (PID: 4896)

    • Reads the computer name

      • LatitudeVsnet.exe (PID: 6512)
      • extrac32.exe (PID: 6488)
      • Grades.com (PID: 4896)

    • Create files in a temporary directory

      • LatitudeVsnet.exe (PID: 6512)
      • extrac32.exe (PID: 6488)

    • Creates a new folder

      • cmd.exe (PID: 4272)

    • Reads the software policy settings

      • Grades.com (PID: 4896)
      • slui.exe (PID: 5376)

    • Reads mouse settings

      • Grades.com (PID: 4896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
18
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start latitudevsnet.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA grades.com choice.exe no specs slui.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
680findstr /V "Drag" Archived C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1280tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3884C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4180findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4272cmd /c md 539955C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4896Grades.com T C:\Users\admin\AppData\Local\Temp\539955\Grades.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\539955\grades.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
5072cmd /c copy /b ..\Ladies.ppsm + ..\Taiwan.ppsm + ..\Induction.ppsm + ..\Fixtures.ppsm + ..\Author.ppsm + ..\Cad.ppsm + ..\Chairman.ppsm + ..\Unless.ppsm T C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5228C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5376"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 633
Read events
1 633
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
21
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Chairman.ppsmbinary
MD5:7CC3925B9DFEFE560BE7687E31DEE348
SHA256:29566D72FF5FB20FEDC6DA5016F77E6C6A0E53E5D83EA4B9BDC9B8A7813515AF
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Taiwan.ppsmbinary
MD5:8DEBE19F1B8122037F8FB3E1AD6EA613
SHA256:20B51002BA1B6F3A26F2B64943593FF995127501A59B5573E9A83F8F98279F2D
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Author.ppsmbinary
MD5:7C3E71989BFCE91BC360F32C2DAA6906
SHA256:39A6DEA0E20037F9760D5A873881ECF75663F257C1ECE078F28F0360BA931783
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Ladies.ppsmbinary
MD5:C41B4F3B3D67588C0C483A0C365FF9D3
SHA256:0B1481AE972D45997DB7AA551CE1D94169490D53F87B2293E0D597D99E16B832
5436cmd.exeC:\Users\admin\AppData\Local\Temp\Shakespeare.ppsm.battext
MD5:F4F82B503DC6D9306935E3481F1BADA7
SHA256:20238E0AE28B77ACB7E7288F733E684058BE4D3DD15B5BDCE323A9EB7E3585C3
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Contributed.ppsmcompressed
MD5:91E889FEC58B89A6A8A8FA0421A6FF25
SHA256:F67194BD63CFD171C19A4364F506CA3B6669E1EDF4B6D1BE7C8D4E00C0C6894A
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Induction.ppsmbinary
MD5:CEE55487A8C0A85EB5F4954812C18B55
SHA256:EA3147F55DFBE8542AE87438A5E9B6A486DB06EE800BE0D8FDC2D6B31E543E98
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Fixtures.ppsmbinary
MD5:21F2AE9B847B66828F4BF4AC286A8231
SHA256:204CC6AF0195A2AAFDD7AACBC68EBDC8A3D5D5CE27562863FF8629F3EB51D569
6488extrac32.exeC:\Users\admin\AppData\Local\Temp\Undertakenbinary
MD5:34A277B04267C0EC4FC79EE1D3723124
SHA256:66D5465368A4EE8E67C1A87B8F2453E4758774373A3BF1B13A9813B9E20723CB
6488extrac32.exeC:\Users\admin\AppData\Local\Temp\Amongstbinary
MD5:4632D3E8ABA11E8CEEBCA09B00999498
SHA256:AF18143C8D538F60D494E01F7F300EBE9B9C524DD434618D71DF54140761D9CB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4784
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4784
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2432
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1512
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.20.154.94:80
www.microsoft.com
Telkom-Internet
ZA
whitelisted
2112
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 2.20.154.94
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.133
  • 20.190.160.2
  • 20.190.160.3
  • 40.126.32.76
  • 20.190.160.20
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
ySOLAXWVkkKmrMckAztlOfOo.ySOLAXWVkkKmrMckAztlOfOo
  • —
unknown
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
ninepicchf.bet
  • 104.21.82.185
  • 172.67.161.116
malicious
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LatitudeVsnet.exe