File name:

73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c

Full analysis: https://app.any.run/tasks/162b3069-e7d2-4665-a5ff-01c68e053dec
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 05:48:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
lumma
stealer
themida
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

F0B7A536D188BB6C12A4F36D8B9F526E

SHA1:

1E2B0E3AE9AA02D49C12EAFA504F119DF3E07BB6

SHA256:

73E0876324342A662980C1334B8AB2D22146413B24094B9B4DC48B09955E404C

SSDEEP:

98304:u4PlKIIsZmSBcNAo1Ku6ATI15XAIqZEUZQM3r6K2rG0cTG60fhAqtA2csPvngEiW:cLj2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

    • Steals credentials from Web Browsers

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

    • Actions looks like stealing of personal data

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

  • SUSPICIOUS

    • Reads the BIOS version

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

    • Searches for installed software

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

  • INFO

    • Reads the computer name

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

    • Checks supported languages

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

    • Reads the machine GUID from the registry

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

    • Reads the software policy settings

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)
      • slui.exe (PID: 7788)

    • Themida protector has been detected

      • 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe (PID: 1188)

    • Checks proxy server information

      • slui.exe (PID: 7788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:18 15:22:40+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 307712
InitializedDataSize: 47104
UninitializedDataSize: -
EntryPoint: 0x4b0000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA 73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe #LUMMA svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1188"C:\Users\admin\Desktop\73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe" C:\Users\admin\Desktop\73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7788C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
6 794
Read events
6 794
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
59
DNS requests
22
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
400
20.190.160.3:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
200
20.190.160.128:443
https://login.live.com/RST2.srf
unknown
xml
1.35 Kb
whitelisted
—
—
POST
200
188.114.96.3:443
https://travewlio.shop/ZNxbHi
unknown
binary
71 b
malicious
—
—
POST
400
20.190.160.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
200
188.114.96.3:443
https://travewlio.shop/ZNxbHi
unknown
binary
69 b
malicious
—
—
POST
200
20.190.159.130:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
POST
200
188.114.97.3:443
https://travewlio.shop/ZNxbHi
unknown
binary
69 b
malicious
—
—
POST
400
20.190.160.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
GET
200
20.223.36.55:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250325T054830Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=7737645bf08a48b5ad3c0abb8ebee1f5&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&currsel=137271744000000000&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3968507&metered=false&nettype=ethernet&npid=sc-88000045&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1359037&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
2.96 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1188
73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe
188.114.97.3:443
travewlio.shop
CLOUDFLARENET
NL
malicious
2104
svchost.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5008
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.174
whitelisted
touvrlane.bet
  • —
malicious
esccapewz.run
  • —
malicious
travewlio.shop
  • 188.114.97.3
  • 188.114.96.3
malicious
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
  • 23.216.77.42
  • 23.216.77.20
  • 23.216.77.28
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.131
  • 20.190.160.130
  • 20.190.160.132
  • 40.126.32.136
  • 40.126.32.76
  • 20.190.160.128
  • 20.190.160.22
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
1188
73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (travewlio .shop)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (touvrlane .bet)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (esccapewz .run)
1188
73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
1188
73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
1188
73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
1188
73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
1188
73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (travewlio .shop in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
73e0876324342a662980c1334b8ab2d22146413b24094b9b4dc48b09955e404c