File name:

7e5062d38e14859f4f6b0227e88b43ed.exe

Full analysis: https://app.any.run/tasks/8bfd6331-643d-4e21-84a6-dfe3de441ef5
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 06:25:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
stealer
lumma
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

7E5062D38E14859F4F6B0227E88B43ED

SHA1:

83F3173269C6C3FD36163A8E70EAC8A7FF4CCA18

SHA256:

7521DE9B4CCCFD3833F5BEB86A80696330A745C6CDDE7C0E0C92462CD08F0F2F

SSDEEP:

49152:nI40bcGagKEgf0kZLqlJ9D8+kxZpZUwrhY9KM9nm6YiUXrVY3Vc7sPw+lKPK7fL3:70bBazxfdLuJt8f/V6IUm6YpXr23Vc74

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Measurement.com (PID: 7988)

    • Actions looks like stealing of personal data

      • Measurement.com (PID: 7988)

    • Steals credentials from Web Browsers

      • Measurement.com (PID: 7988)

    • LUMMA mutex has been found

      • Measurement.com (PID: 7988)

  • SUSPICIOUS

    • Get information on the list of running processes

      • cmd.exe (PID: 7588)

    • There is functionality for taking screenshot (YARA)

      • 7e5062d38e14859f4f6b0227e88b43ed.exe (PID: 7528)
      • Measurement.com (PID: 7988)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7588)

    • Application launched itself

      • cmd.exe (PID: 7588)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7588)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7588)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7588)
      • 7e5062d38e14859f4f6b0227e88b43ed.exe (PID: 7528)

    • Executing commands from a ".bat" file

      • 7e5062d38e14859f4f6b0227e88b43ed.exe (PID: 7528)

    • Reads security settings of Internet Explorer

      • 7e5062d38e14859f4f6b0227e88b43ed.exe (PID: 7528)

    • The executable file from the user directory is run by the CMD process

      • Measurement.com (PID: 7988)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Measurement.com (PID: 7988)

  • INFO

    • Checks supported languages

      • 7e5062d38e14859f4f6b0227e88b43ed.exe (PID: 7528)
      • extrac32.exe (PID: 7892)
      • Measurement.com (PID: 7988)

    • Reads the computer name

      • Measurement.com (PID: 7988)
      • extrac32.exe (PID: 7892)
      • 7e5062d38e14859f4f6b0227e88b43ed.exe (PID: 7528)

    • Reads mouse settings

      • Measurement.com (PID: 7988)

    • Create files in a temporary directory

      • 7e5062d38e14859f4f6b0227e88b43ed.exe (PID: 7528)
      • extrac32.exe (PID: 7892)

    • Process checks computer location settings

      • 7e5062d38e14859f4f6b0227e88b43ed.exe (PID: 7528)

    • Creates a new folder

      • cmd.exe (PID: 7872)

    • Reads the software policy settings

      • Measurement.com (PID: 7988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
15
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 7e5062d38e14859f4f6b0227e88b43ed.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA measurement.com choice.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7520C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7528"C:\Users\admin\AppData\Local\Temp\7e5062d38e14859f4f6b0227e88b43ed.exe" C:\Users\admin\AppData\Local\Temp\7e5062d38e14859f4f6b0227e88b43ed.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7e5062d38e14859f4f6b0227e88b43ed.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7588"C:\WINDOWS\System32\cmd.exe" /c copy Religion.xlam Religion.xlam.bat & Religion.xlam.batC:\Windows\SysWOW64\cmd.exe—7e5062d38e14859f4f6b0227e88b43ed.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7596\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7664tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7680findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7816tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7824findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7872cmd /c md 533181C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7892extrac32 /Y /E Ministers.xlamC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 052
Read events
1 052
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
21
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7892extrac32.exeC:\Users\admin\AppData\Local\Temp\Neighborbinary
MD5:04DC657C6B4EF6CB64B73C5C765AC031
SHA256:D73E707DDEA8377F2C9E9A2BF96A3ED55E8ED8EEF125AC6467D41CE047BAC2DD
7892extrac32.exeC:\Users\admin\AppData\Local\Temp\Costumesbinary
MD5:2A3D191C0F782E58CD73FFE9DC966A35
SHA256:4977A1863DB817636071751AC3B5C8AD1F117C7303257B6D1181E80526DCDAC4
7892extrac32.exeC:\Users\admin\AppData\Local\Temp\Kenyabinary
MD5:B7B0797EB2EC71916501966EDF6A1C84
SHA256:8CD566D708863618C3E604643B6E90F094B2189ABDD9D09F7EF5942EC5772868
75287e5062d38e14859f4f6b0227e88b43ed.exeC:\Users\admin\AppData\Local\Temp\Religion.xlamtext
MD5:84C7D7A363368558B8A48CAA9A7E9A01
SHA256:EE58281F9C8B2DA89C8B6029BA864805B132932B50960203BB10A56383495B60
75287e5062d38e14859f4f6b0227e88b43ed.exeC:\Users\admin\AppData\Local\Temp\These.xlambinary
MD5:B9C35E5E846407CD532579D9AA0681CE
SHA256:84B6A157975165566F8559DF896CA111A64A63DD7599F7316D5E682A755C158D
75287e5062d38e14859f4f6b0227e88b43ed.exeC:\Users\admin\AppData\Local\Temp\Territories.xlambinary
MD5:D1F49FE27B53AC125AE557EE7328DD11
SHA256:3E8314632CD45816B59B0F03B2C2583317D7D7BE4BFF39C8A33EF0785BA50E0D
7588cmd.exeC:\Users\admin\AppData\Local\Temp\Religion.xlam.battext
MD5:84C7D7A363368558B8A48CAA9A7E9A01
SHA256:EE58281F9C8B2DA89C8B6029BA864805B132932B50960203BB10A56383495B60
75287e5062d38e14859f4f6b0227e88b43ed.exeC:\Users\admin\AppData\Local\Temp\Citizen.xlambinary
MD5:4820EF1861DCD8E59C476FA4021F9B27
SHA256:1B4BD590DE585E6D002451F221BFAC7315A77A59574BE6305D35B3E6B9D25A8B
75287e5062d38e14859f4f6b0227e88b43ed.exeC:\Users\admin\AppData\Local\Temp\Wives.xlambinary
MD5:BC1C43347A0A832A8C2266E314BC7ECB
SHA256:85260A9F30B330014170DE3D75D5155C43A5AC9432D2D47AD7BE68AE7C900932
75287e5062d38e14859f4f6b0227e88b43ed.exeC:\Users\admin\AppData\Local\Temp\Immigration.xlambinary
MD5:7AD1C04675F2207F061F037023C3EFD9
SHA256:80A606AA0C046BE0E8FDB12FA9611E025F5A459916533E23B1B3500391DB3677
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7344
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7344
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4784
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
DQEcqykIisQYabfqPouLEh.DQEcqykIisQYabfqPouLEh
  • —
unknown
login.live.com
  • 20.190.160.65
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.138
  • 20.190.160.66
  • 40.126.32.68
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
7988
Measurement.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
7e5062d38e14859f4f6b0227e88b43ed.exe