File name:

LatitudeVsnet.exe

Full analysis: https://app.any.run/tasks/14cf742f-fc43-4b08-babe-786dc112037a
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:09:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
stealer
lumma
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

E643C56CD85FEBCEA0566CE4D1F63CAC

SHA1:

9D2FD7E7B4F28C994A371CEE42C29201AEC41B95

SHA256:

70CC1F20CF73146B96D6EBA742FB3403F0A6AA19B6DCED57D134BCAE9DEEB878

SSDEEP:

49152:dcCnHouk5+mn+NfRN7vu/aIYCiTR66L0MVvtB6hgQ2qZMiIrcWjwYck+Icca8cVG:Yuo0JNDu/aIl4ABMzwgQwcWUBBczbUqE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • LatitudeVsnet.exe (PID: 6512)

    • Steals credentials from Web Browsers

      • Grades.com (PID: 4896)

    • Actions looks like stealing of personal data

      • Grades.com (PID: 4896)

    • AutoIt loader has been detected (YARA)

      • Grades.com (PID: 4896)

    • LUMMA mutex has been found

      • Grades.com (PID: 4896)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • LatitudeVsnet.exe (PID: 6512)

    • Starts CMD.EXE for commands execution

      • LatitudeVsnet.exe (PID: 6512)
      • cmd.exe (PID: 5436)

    • Reads security settings of Internet Explorer

      • LatitudeVsnet.exe (PID: 6512)

    • There is functionality for taking screenshot (YARA)

      • LatitudeVsnet.exe (PID: 6512)
      • Grades.com (PID: 4896)

    • Get information on the list of running processes

      • cmd.exe (PID: 5436)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 5436)

    • Application launched itself

      • cmd.exe (PID: 5436)

    • The executable file from the user directory is run by the CMD process

      • Grades.com (PID: 4896)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5436)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 5436)

    • Searches for installed software

      • Grades.com (PID: 4896)

  • INFO

    • Reads the computer name

      • LatitudeVsnet.exe (PID: 6512)
      • extrac32.exe (PID: 6488)
      • Grades.com (PID: 4896)

    • Checks supported languages

      • LatitudeVsnet.exe (PID: 6512)
      • extrac32.exe (PID: 6488)
      • Grades.com (PID: 4896)

    • Process checks computer location settings

      • LatitudeVsnet.exe (PID: 6512)

    • Create files in a temporary directory

      • LatitudeVsnet.exe (PID: 6512)
      • extrac32.exe (PID: 6488)

    • Creates a new folder

      • cmd.exe (PID: 4272)

    • Reads mouse settings

      • Grades.com (PID: 4896)

    • Reads the software policy settings

      • Grades.com (PID: 4896)
      • slui.exe (PID: 5376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
18
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start latitudevsnet.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA grades.com choice.exe no specs slui.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
680findstr /V "Drag" Archived C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1280tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3884C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4180findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4272cmd /c md 539955C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4896Grades.com T C:\Users\admin\AppData\Local\Temp\539955\Grades.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\539955\grades.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
5072cmd /c copy /b ..\Ladies.ppsm + ..\Taiwan.ppsm + ..\Induction.ppsm + ..\Fixtures.ppsm + ..\Author.ppsm + ..\Cad.ppsm + ..\Chairman.ppsm + ..\Unless.ppsm T C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5228C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5376"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 633
Read events
1 633
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
21
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Unless.ppsmbinary
MD5:29B492B624BD4F69848FD7DD27EFFF1C
SHA256:CC1B7826C9FBE5F61ACB65D5EC2555301BCC02589B3D62E837D6B14941B12062
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Shakespeare.ppsmtext
MD5:F4F82B503DC6D9306935E3481F1BADA7
SHA256:20238E0AE28B77ACB7E7288F733E684058BE4D3DD15B5BDCE323A9EB7E3585C3
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Chairman.ppsmbinary
MD5:7CC3925B9DFEFE560BE7687E31DEE348
SHA256:8C29CAAE44846E802BBDC8614190F101877B4FA0D96CB55EA787532AA9404E56
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Fixtures.ppsmbinary
MD5:21F2AE9B847B66828F4BF4AC286A8231
SHA256:9EB7FBFBA643591131C3E83B292D465EA2B5AE6D3C34D1A09BBB63C215A6383A
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Contributed.ppsmcompressed
MD5:91E889FEC58B89A6A8A8FA0421A6FF25
SHA256:B7FA4B81B3092F4BE3ACA4AA25DCD957B44EF4B5BC4B9FA646A426D3B81B1338
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Cad.ppsmbinary
MD5:24873D6AC77943A4C916D586730CE6AA
SHA256:216D25CE2CBFFA380303B1C3B3D7FC734B85AFF3922CD6E2818C6A7AAB2C2197
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Author.ppsmbinary
MD5:7C3E71989BFCE91BC360F32C2DAA6906
SHA256:9EA24B1F8EFC963032D3CCE679DFDF8AA4C0D6725DCFED526DDA597A4BBFFB39
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Taiwan.ppsmbinary
MD5:8DEBE19F1B8122037F8FB3E1AD6EA613
SHA256:09A7E0035299A79D2B17837904B98F31F126247D3D93A716BE49809070920462
6512LatitudeVsnet.exeC:\Users\admin\AppData\Local\Temp\Induction.ppsmbinary
MD5:CEE55487A8C0A85EB5F4954812C18B55
SHA256:1D302E555C2F384491524CA0337D255273B0D18630C9197332200D811CED2FFA
6488extrac32.exeC:\Users\admin\AppData\Local\Temp\Undertakenbinary
MD5:34A277B04267C0EC4FC79EE1D3723124
SHA256:4DD05203D5D5B53761272CE17B48B822A5F7B3C63399E2F901DC301A12947331
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.20.154.94:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4784
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4784
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2432
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1512
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.20.154.94:80
www.microsoft.com
Telkom-Internet
ZA
whitelisted
2112
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 2.20.154.94
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.133
  • 20.190.160.2
  • 20.190.160.3
  • 40.126.32.76
  • 20.190.160.20
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
ySOLAXWVkkKmrMckAztlOfOo.ySOLAXWVkkKmrMckAztlOfOo
  • —
unknown
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
ninepicchf.bet
  • 104.21.82.185
  • 172.67.161.116
malicious
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
LatitudeVsnet.exe