| File name: | SET_UP.exe |
| Full analysis: | https://app.any.run/tasks/83aa7ada-0a3d-4ca3-82ee-e98e12773558 |
| Verdict: | Malicious activity |
| Threats: | Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat. |
| Analysis date: | December 14, 2024, 12:16:45 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections |
| MD5: | 3D7985D235DDDD50133C9CB4D05E93CF |
| SHA1: | F4760735FAC36EE4453905208EE47589526A30C7 |
| SHA256: | 7FEB04DD3086C567C461E43A682DD1BFDF1CDE3C8F37338A87656FC81A23BA5D |
| SSDEEP: | 98304:4W0JMnH6lSPaAny7ahqeITAUa/TsEnLz5hxBBDgS8BQX/N5qjtGm5IcDP:QMjX1mlP |
MALICIOUS
LUMMA has been detected (SURICATA)
- svchost.exe (PID: 2192)
Actions looks like stealing of personal data
- Stored.com (PID: 8)
Steals credentials from Web Browsers
- Stored.com (PID: 8)
AutoIt loader has been detected (YARA)
- Stored.com (PID: 8)
LUMMA mutex has been found
- Stored.com (PID: 8)
SUSPICIOUS
Using 'findstr.exe' to search for text patterns in files and output
- cmd.exe (PID: 2972)
Starts CMD.EXE for commands execution
- SET_UP.exe (PID: 4132)
- cmd.exe (PID: 2972)
Reads security settings of Internet Explorer
- SET_UP.exe (PID: 4132)
Executing commands from ".cmd" file
- SET_UP.exe (PID: 4132)
Application launched itself
- cmd.exe (PID: 2972)
Get information on the list of running processes
- cmd.exe (PID: 2972)
Starts application with an unusual extension
- cmd.exe (PID: 2972)
The executable file from the user directory is run by the CMD process
- Stored.com (PID: 8)
Starts the AutoIt3 executable file
- cmd.exe (PID: 2972)
Executable content was dropped or overwritten
- cmd.exe (PID: 2972)
Contacting a server suspected of hosting an CnC
- svchost.exe (PID: 2192)
INFO
Checks supported languages
- SET_UP.exe (PID: 4132)
- Stored.com (PID: 8)
Reads the computer name
- SET_UP.exe (PID: 4132)
- Stored.com (PID: 8)
Create files in a temporary directory
- SET_UP.exe (PID: 4132)
Process checks computer location settings
- SET_UP.exe (PID: 4132)
The process uses the downloaded file
- SET_UP.exe (PID: 4132)
Creates a new folder
- cmd.exe (PID: 3612)
Reads mouse settings
- Stored.com (PID: 8)
Reads the machine GUID from the registry
- Stored.com (PID: 8)
Reads the software policy settings
- Stored.com (PID: 8)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| Subsystem: | Windows GUI |
|---|---|
| SubsystemVersion: | 5 |
| ImageVersion: | 6 |
| OSVersion: | 5 |
| EntryPoint: | 0x38af |
| UninitializedDataSize: | 16896 |
| InitializedDataSize: | 511488 |
| CodeSize: | 29696 |
| LinkerVersion: | 10 |
| PEType: | PE32 |
| ImageFileCharacteristics: | Executable, 32-bit |
| TimeStamp: | 2012:02:24 19:20:04+00:00 |
| MachineType: | Intel 386 or later, and compatibles |
Total processes
121
Monitored processes
13
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4132 | "C:\Users\admin\Desktop\SET_UP.exe" | C:\Users\admin\Desktop\SET_UP.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2972 | "C:\Windows\System32\cmd.exe" /c copy Figured Figured.cmd && Figured.cmd | C:\Windows\SysWOW64\cmd.exe | SET_UP.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 396 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1804 | tasklist | C:\Windows\SysWOW64\tasklist.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Lists the current running tasks Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5460 | findstr /I "wrsa opssvc" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5572 | tasklist | C:\Windows\SysWOW64\tasklist.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Lists the current running tasks Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5028 | findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3612 | cmd /c md 516983 | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 188 | findstr /V "ProposedKellyChampionCouldMinistryPhotographersNotFruit" Permitted | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1356 | cmd /c copy /b ..\Imposed + ..\Wellington + ..\Object + ..\Installations + ..\Loaded + ..\Hdtv U | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
3 972
Read events
3 972
Write events
0
Delete events
0
Modification events
Executable files
1
Suspicious files
16
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4132 | SET_UP.exe | C:\Users\admin\AppData\Local\Temp\Locator | abr | |
MD5:85E9FAB9AB9A2CE1935F980078995C7B | SHA256:0392E54997947D4E6AC2A5A919F18699DB82524DA641AA913B9E360BB2A1D7DF | |||
| 4132 | SET_UP.exe | C:\Users\admin\AppData\Local\Temp\Installations | pgc | |
MD5:D028BA6B6939326C7BD30516E21E4FF4 | SHA256:7C1AA8EC4C791E4DB7CE1D95DB8C9DF75BAAC3BFB0CB0F1EC56064C88D09BC0D | |||
| 4132 | SET_UP.exe | C:\Users\admin\AppData\Local\Temp\Quest | binary | |
MD5:05C707C8F33E056405D5138D7CBAC25B | SHA256:0815C0EFAB440E5298F28FE5D266AD8DEA60EADB3A82DB46C95ADBE2B6EEADB0 | |||
| 2972 | cmd.exe | C:\Users\admin\AppData\Local\Temp\Figured.cmd | text | |
MD5:21350FCCD60418B01CF83AC826AA31E9 | SHA256:BE21F7CA2001511FBC3E0E43312F8649E83037EBF098682D5FA1D290E62BF470 | |||
| 4132 | SET_UP.exe | C:\Users\admin\AppData\Local\Temp\Transport | mp3 | |
MD5:29310511E646A9DB8EC20112F750205A | SHA256:92572FF759F59420EB6EF712DC8DB8469C63425F0B2AB5798EBB19370FFB61E1 | |||
| 4132 | SET_UP.exe | C:\Users\admin\AppData\Local\Temp\Joel | mp3 | |
MD5:FED092A988D0DB96E611A27280DD05B7 | SHA256:8CD6962716B0B9BF77F28D1A37238CBDCB09FDB97F0761FF224B78201227CCB3 | |||
| 4132 | SET_UP.exe | C:\Users\admin\AppData\Local\Temp\Figured | text | |
MD5:21350FCCD60418B01CF83AC826AA31E9 | SHA256:BE21F7CA2001511FBC3E0E43312F8649E83037EBF098682D5FA1D290E62BF470 | |||
| 4132 | SET_UP.exe | C:\Users\admin\AppData\Local\Temp\Had | binary | |
MD5:8402510886C8CEB4FD093BBAFA8F452B | SHA256:68B1859430203661F8D31A767909364F645DA1944D6FD0C4CD4EA79C2F2C6212 | |||
| 1356 | cmd.exe | C:\Users\admin\AppData\Local\Temp\516983\U | binary | |
MD5:76435283F8EC4F375A9D474DEA552242 | SHA256:2283D849D6BE570BB6EFAF7440F53B52ED9C8ACE2844B838C98A53E0322764D0 | |||
| 4132 | SET_UP.exe | C:\Users\admin\AppData\Local\Temp\Permitted | binary | |
MD5:443F5628E48F754B7751D344B9C4C88A | SHA256:5339E4495D03B9301B7D15424DB91B68B7E84B3DCF769B5F44B7CAF7FAB66DE4 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
28
DNS requests
7
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | POST | 200 | 104.21.78.51:443 | https://futipoy.shop/api | unknown | text | 20.4 Kb | — |
— | — | POST | 200 | 172.67.216.241:443 | https://futipoy.shop/api | unknown | text | 2 b | — |
— | — | POST | 200 | 172.67.216.241:443 | https://futipoy.shop/api | unknown | text | 140 b | — |
— | — | POST | 200 | 172.67.216.241:443 | https://futipoy.shop/api | unknown | text | 14 b | — |
— | — | POST | 200 | 104.21.78.51:443 | https://futipoy.shop/api | unknown | text | 14 b | — |
— | — | POST | 200 | 172.67.216.241:443 | https://futipoy.shop/api | unknown | text | 14 b | — |
— | — | POST | 200 | 104.21.78.51:443 | https://futipoy.shop/api | unknown | text | 14 b | — |
— | — | POST | 200 | 104.21.78.51:443 | https://futipoy.shop/api | unknown | text | 14 b | — |
— | — | POST | 200 | 172.67.216.241:443 | https://futipoy.shop/api | unknown | text | 14 b | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 2.23.209.130:443 | www.bing.com | Akamai International B.V. | GB | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
8 | Stored.com | 172.67.216.241:443 | futipoy.shop | CLOUDFLARENET | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
trxBhEXoOi.trxBhEXoOi |
| unknown |
futipoy.shop |
| unknown |
klipcatepiu0.shop |
| unknown |
self.events.data.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Domain Observed Used for C2 Detected | STEALER [ANY.RUN] Suspected Lumma domain by CrossDomain (klipcatepiu0 .shop) |