File name:

SET_UP.exe

Full analysis: https://app.any.run/tasks/10439d73-7986-416e-9758-90033d8bc81a
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 12:16:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

3D7985D235DDDD50133C9CB4D05E93CF

SHA1:

F4760735FAC36EE4453905208EE47589526A30C7

SHA256:

7FEB04DD3086C567C461E43A682DD1BFDF1CDE3C8F37338A87656FC81A23BA5D

SSDEEP:

98304:4W0JMnH6lSPaAny7ahqeITAUa/TsEnLz5hxBBDgS8BQX/N5qjtGm5IcDP:QMjX1mlP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • SET_UP.exe (PID: 6548)

    • AutoIt loader has been detected (YARA)

      • Stored.com (PID: 6916)

    • LUMMA mutex has been found

      • Stored.com (PID: 6916)

    • Steals credentials from Web Browsers

      • Stored.com (PID: 6916)

    • Actions looks like stealing of personal data

      • Stored.com (PID: 6916)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SET_UP.exe (PID: 6548)

    • Starts CMD.EXE for commands execution

      • SET_UP.exe (PID: 6548)
      • cmd.exe (PID: 6608)

    • Get information on the list of running processes

      • cmd.exe (PID: 6608)

    • Application launched itself

      • cmd.exe (PID: 6608)

    • Executing commands from ".cmd" file

      • SET_UP.exe (PID: 6548)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6608)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 6608)

    • The executable file from the user directory is run by the CMD process

      • Stored.com (PID: 6916)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6608)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6608)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2192)

  • INFO

    • Reads the computer name

      • SET_UP.exe (PID: 6548)
      • Stored.com (PID: 6916)

    • Checks supported languages

      • SET_UP.exe (PID: 6548)
      • Stored.com (PID: 6916)

    • Create files in a temporary directory

      • SET_UP.exe (PID: 6548)

    • Process checks computer location settings

      • SET_UP.exe (PID: 6548)

    • The process uses the downloaded file

      • SET_UP.exe (PID: 6548)

    • Creates a new folder

      • cmd.exe (PID: 6852)

    • Reads mouse settings

      • Stored.com (PID: 6916)

    • Reads the software policy settings

      • Stored.com (PID: 6916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: 6
OSVersion: 5
EntryPoint: 0x38af
UninitializedDataSize: 16896
InitializedDataSize: 511488
CodeSize: 29696
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2012:02:24 19:20:04+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start set_up.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs #LUMMA stored.com choice.exe no specs #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
6548"C:\Users\admin\AppData\Local\Temp\SET_UP.exe" C:\Users\admin\AppData\Local\Temp\SET_UP.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\set_up.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6608"C:\Windows\System32\cmd.exe" /c copy Figured Figured.cmd && Figured.cmdC:\Windows\SysWOW64\cmd.exe
SET_UP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6680tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6692findstr /I "wrsa opssvc" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6792tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6800findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6852cmd /c md 516983C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6872findstr /V "ProposedKellyChampionCouldMinistryPhotographersNotFruit" Permitted C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6896cmd /c copy /b ..\Imposed + ..\Wellington + ..\Object + ..\Installations + ..\Loaded + ..\Hdtv U C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 095
Read events
1 095
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
16
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Imposedbinary
MD5:0DD2C7509651F562DA3416886397FBD8
SHA256:51FA83D962CC144E022B8684D2F000830F9DE5D00662A97038566CF7A5B4BA63
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Hadbinary
MD5:8402510886C8CEB4FD093BBAFA8F452B
SHA256:68B1859430203661F8D31A767909364F645DA1944D6FD0C4CD4EA79C2F2C6212
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Permittedbinary
MD5:443F5628E48F754B7751D344B9C4C88A
SHA256:5339E4495D03B9301B7D15424DB91B68B7E84B3DCF769B5F44B7CAF7FAB66DE4
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Ghanabinary
MD5:3AB94BB43E76A8079D9A89259A3A49A4
SHA256:1627A89C2D801544C1020462EFB4D6C7D615A6407BC6097B7F7423FE79C383D9
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Locatorbinary
MD5:85E9FAB9AB9A2CE1935F980078995C7B
SHA256:0392E54997947D4E6AC2A5A919F18699DB82524DA641AA913B9E360BB2A1D7DF
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Transportbinary
MD5:29310511E646A9DB8EC20112F750205A
SHA256:92572FF759F59420EB6EF712DC8DB8469C63425F0B2AB5798EBB19370FFB61E1
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Installationspgc
MD5:D028BA6B6939326C7BD30516E21E4FF4
SHA256:7C1AA8EC4C791E4DB7CE1D95DB8C9DF75BAAC3BFB0CB0F1EC56064C88D09BC0D
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Suicidebinary
MD5:1EE9DAEEF21C43336AE8626E9335BEB5
SHA256:DAB4963BCAFDA1A1E3FCEE0678F1B77B8440DA6E6F04A3CB858AD37101ABFE3D
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Figuredtext
MD5:21350FCCD60418B01CF83AC826AA31E9
SHA256:BE21F7CA2001511FBC3E0E43312F8649E83037EBF098682D5FA1D290E62BF470
6548SET_UP.exeC:\Users\admin\AppData\Local\Temp\Returnsgpg
MD5:299474AEFC18F21A899289DA0E9C20A5
SHA256:8C6FA7CD083A01B4A76F96188BE63E1E80657C45F0D85418B342C2580A45472C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
37
DNS requests
22
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1380
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1380
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2548
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2940
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2548
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1380
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1380
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.137
  • 104.126.37.154
  • 104.126.37.129
  • 104.126.37.185
  • 104.126.37.186
  • 104.126.37.139
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.72
  • 40.126.32.140
  • 20.190.160.22
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.133
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
trxBhEXoOi.trxBhEXoOi
  • —
unknown
arc.msn.com
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
—
—
Domain Observed Used for C2 Detected
STEALER [ANY.RUN] Suspected Lumma domain by CrossDomain (klipcatepiu0 .shop)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SET_UP.exe