File name:

Unpacker.exe

Full analysis: https://app.any.run/tasks/3760c438-6986-463e-9896-64a5b0dd19e4
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: November 03, 2024, 13:33:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
possible-phishing
exfiltration
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 7 sections
MD5:

A76B2C677F5647AE31E40D17E54C1BF2

SHA1:

AA069AD7BC1A9D335BFC7EA197FEADFB590E4267

SHA256:

78B44C6F9788A8C520BB2539CAFC2AEA3D1AF4492C11F2AF36EE7E5EE6A41102

SSDEEP:

24576:6gekDGWpLL38bWPW5QbL/+PElJ/Da895wHMvJi4q7NG:6gekDGAn38bWPW5QbL/+PElJ/Da895ws

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA has been detected (YARA)

      • Unpacker.exe (PID: 6704)

    • LUMMA has been detected (SURICATA)

      • Unpacker.exe (PID: 6704)
      • svchost.exe (PID: 2172)

    • Connects to the CnC server

      • svchost.exe (PID: 2172)

    • Stealers network behavior

      • Unpacker.exe (PID: 6704)

    • Actions looks like stealing of personal data

      • Unpacker.exe (PID: 6704)

  • SUSPICIOUS

    • Application launched itself

      • Unpacker.exe (PID: 6024)

    • Executes application which crashes

      • Unpacker.exe (PID: 6024)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2172)
      • Unpacker.exe (PID: 6704)

    • Possible Social Engineering Attempted

      • svchost.exe (PID: 2172)

  • INFO

    • Checks supported languages

      • Unpacker.exe (PID: 6024)
      • Unpacker.exe (PID: 6704)

    • Reads the computer name

      • Unpacker.exe (PID: 6704)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 1440)

    • Reads the software policy settings

      • WerFault.exe (PID: 1440)
      • Unpacker.exe (PID: 6704)

    • Reads the machine GUID from the registry

      • Unpacker.exe (PID: 6704)

    • Checks proxy server information

      • WerFault.exe (PID: 1440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:02 14:19:46+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 258048
InitializedDataSize: 72704
UninitializedDataSize: -
EntryPoint: 0x21e90
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start unpacker.exe conhost.exe no specs unpacker.exe no specs #LUMMA unpacker.exe werfault.exe #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
608"C:\Users\admin\Desktop\Unpacker.exe"C:\Users\admin\Desktop\Unpacker.exe—Unpacker.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\unpacker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1440C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6024 -s 364C:\Windows\SysWOW64\WerFault.exe
Unpacker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4060\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Unpacker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6024"C:\Users\admin\Desktop\Unpacker.exe" C:\Users\admin\Desktop\Unpacker.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\unpacker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6704"C:\Users\admin\Desktop\Unpacker.exe"C:\Users\admin\Desktop\Unpacker.exe
Unpacker.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\unpacker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
9 415
Read events
9 415
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1440WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Unpacker.exe_b52f5f5589331eb891d63c815e538dc79064ba8d_2548d183_8ff9009e-77e9-4e97-bbcd-821895445b8e\Report.wer —
MD5:—
SHA256:—
1440WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD7BC.tmp.WERInternalMetadata.xmlxml
MD5:1DDE2D9DCEF934FCDF4BB018A6AA2F9D
SHA256:15E8AA3779F51DB423FFCC2267B30FE3D8F612FCD725FC2ECB5D08BA12EF8F4D
1440WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD80B.tmp.xmlxml
MD5:6F3AF66BB412892EDAF63763437CC851
SHA256:846917E7A3316DF1CB16154EE4421B7DAD37BA1649E3AC23C86AD934BCE29193
1440WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Unpacker.exe.6024.dmpbinary
MD5:8D4619BA789F6C41CE0793E3943D717B
SHA256:A05444582CC42D68798C3698001AF438DE98B877233AE5B2AC4CCBFD8C913EA1
1440WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD71F.tmp.dmpdmp
MD5:9498B45547C2BF8AB78B82A988737616
SHA256:3B0EB6833CD4F27398B9E913FDEA12228588A089840718D6F4835605D3206C66
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
29
DNS requests
12
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7056
RUXIMICS.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6704
Unpacker.exe
GET
—
147.45.47.81:80
http://147.45.47.81/conhost.exe
unknown
—
—
unknown
—
—
POST
200
172.67.145.203:443
https://goalyfeastz.site/api
unknown
text
16.6 Kb
malicious
—
—
POST
200
104.21.33.140:443
https://goalyfeastz.site/api
unknown
text
2 b
malicious
—
—
POST
200
104.21.33.140:443
https://goalyfeastz.site/api
unknown
text
17 b
malicious
—
—
POST
200
172.67.145.203:443
https://goalyfeastz.site/api
unknown
text
17 b
malicious
—
—
POST
200
104.21.33.140:443
https://goalyfeastz.site/api
unknown
text
17 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7056
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7056
RUXIMICS.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6704
Unpacker.exe
172.67.145.203:443
goalyfeastz.site
CLOUDFLARENET
US
malicious
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
computeryrati.site
  • —
malicious
seallysl.site
  • —
malicious
opposezmny.site
  • —
malicious
goalyfeastz.site
  • 172.67.145.203
  • 104.21.33.140
malicious
www.microsoft.com
  • 184.30.21.171
whitelisted
watson.events.data.microsoft.com
  • 20.42.73.29
whitelisted
self.events.data.microsoft.com
  • 52.182.143.215
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site)
6704
Unpacker.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site)
2172
svchost.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Suspected Malicious Domain by Cloudflare (computeryrati .site)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site)
6704
Unpacker.exe
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer CnC Host Checkin
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity M2
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Check-In
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Unpacker.exe