File name:

random.exe

Full analysis: https://app.any.run/tasks/367dad92-abdd-4305-80b2-4421b096fd1a
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 02:29:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
auto-sch
auto-startup
lumma
stealer
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

66B68301B8E02391AEFC1257A83D98C2

SHA1:

5209FAC424FF3BFC148E0738076D693B2D366E0F

SHA256:

87B22DC6E19D8AE5D0A41560D6DB0B3D7AE69A6E6A147FB5114B30DDF7710ACE

SSDEEP:

49152:3lWn+dP1n/9OONHghOumYd9nTD0bM1ziv00LATO2bvQ3ffK1nPhH9zyAGt6Bn+zU:4UPlVOMMzTww1zMVATPzwHKdPhRat6BP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • random.exe (PID: 5512)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2284)

    • Create files in the Startup directory

      • cmd.exe (PID: 3956)

    • AutoIt loader has been detected (YARA)

      • Invision.com (PID: 960)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • Invision.com (PID: 960)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • LUMMA mutex has been found

      • Invision.com (PID: 960)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • random.exe (PID: 5512)

    • Starts CMD.EXE for commands execution

      • random.exe (PID: 5512)
      • cmd.exe (PID: 1660)

    • Executing commands from a ".bat" file

      • random.exe (PID: 5512)

    • Get information on the list of running processes

      • cmd.exe (PID: 1660)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 1660)

    • Application launched itself

      • cmd.exe (PID: 1660)

    • The executable file from the user directory is run by the CMD process

      • Invision.com (PID: 960)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 1660)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1660)

    • There is functionality for taking screenshot (YARA)

      • Invision.com (PID: 960)
      • random.exe (PID: 5512)

    • Executable content was dropped or overwritten

      • Invision.com (PID: 960)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • Invision.com (PID: 960)

    • Searches for installed software

      • Invision.com (PID: 960)

  • INFO

    • Reads the computer name

      • random.exe (PID: 5512)
      • extrac32.exe (PID: 5544)
      • Invision.com (PID: 960)

    • Checks supported languages

      • random.exe (PID: 5512)
      • extrac32.exe (PID: 5544)
      • Invision.com (PID: 960)

    • Create files in a temporary directory

      • random.exe (PID: 5512)
      • extrac32.exe (PID: 5544)

    • Process checks computer location settings

      • random.exe (PID: 5512)

    • Creates a new folder

      • cmd.exe (PID: 4024)

    • Reads mouse settings

      • Invision.com (PID: 960)

    • Manual execution by a user

      • cmd.exe (PID: 2284)
      • cmd.exe (PID: 3956)
      • wscript.exe (PID: 6488)

    • Creates files or folders in the user directory

      • Invision.com (PID: 960)

    • The sample compiled with english language support

      • Invision.com (PID: 960)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 2284)

    • Auto-launch of the file from Startup directory

      • cmd.exe (PID: 3956)

    • Reads the machine GUID from the registry

      • Invision.com (PID: 960)

    • Checks proxy server information

      • slui.exe (PID: 1328)

    • Reads the software policy settings

      • Invision.com (PID: 960)
      • slui.exe (PID: 1328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
22
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start random.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA invision.com choice.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe conhost.exe no specs wscript.exe no specs #LUMMA svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
728findstr /V "view" Maintained C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
960Invision.com h C:\Users\admin\AppData\Local\Temp\690935\Invision.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\690935\invision.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1276tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1328C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1660"C:\WINDOWS\System32\CMd.eXe" /c copy Perth.hopp Perth.hopp.bat & Perth.hopp.batC:\Windows\SysWOW64\cmd.exe—random.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2284cmd /c schtasks.exe /create /tn "Architect" /tr "wscript //B 'C:\Users\admin\AppData\Local\CryptoImageSyncPro Innovations Co\CryptoImageSyncProX.js'" /sc minute /mo 5 /FC:\Windows\SysWOW64\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2504schtasks.exe /create /tn "Architect" /tr "wscript //B 'C:\Users\admin\AppData\Local\CryptoImageSyncPro Innovations Co\CryptoImageSyncProX.js'" /sc minute /mo 5 /FC:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3300findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3956cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CryptoImageSyncProX.url" & echo URL="C:\Users\admin\AppData\Local\CryptoImageSyncPro Innovations Co\CryptoImageSyncProX.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CryptoImageSyncProX.url" & exitC:\Windows\SysWOW64\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
7 416
Read events
7 416
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
22
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5512random.exeC:\Users\admin\AppData\Local\Temp\Reached.hoppbinary
MD5:3415802C93458081B1C9DF2499A3ADFC
SHA256:47D4EC181A2A6DEFD1EA24BF6BE135B8831616EF8E2D032913191A237E8006E3
5544extrac32.exeC:\Users\admin\AppData\Local\Temp\Panasonicbinary
MD5:B8ECAAF2D4C688701B9D31C792056BF0
SHA256:AE19A6924532D7C73C104E5A112683745FBDEB5E11B9814A802B33366249BD26
5512random.exeC:\Users\admin\AppData\Local\Temp\Clouds.hoppbinary
MD5:E9A5B6CC52A8513A6A932A3473E938A5
SHA256:9F3A079F1C837F9344AC5D1F884D8C492B9612266F55DC317A1D8280E88A6DCB
5512random.exeC:\Users\admin\AppData\Local\Temp\Ron.hoppbinary
MD5:7EA446699BAECCBD94F730E911556EB4
SHA256:A5DF8C75380005A4718DD7028975261E5E9816C923373F7301DCAABB99D33FC8
5512random.exeC:\Users\admin\AppData\Local\Temp\Metro.hoppbinary
MD5:478075EC3D741E525CB08C4E1EDBBE2F
SHA256:FC3F29D07CEC956A72494216D1F3136A9647E7BCDA63E4A5F067612F38B01E1A
5512random.exeC:\Users\admin\AppData\Local\Temp\Perth.hopptext
MD5:79A356B528DAD904B698A2BF362AA590
SHA256:DDD791F5E7DDC62593D8C7B77AFCB2AF25D1AFEDE21FD70C96D35B5564152651
5512random.exeC:\Users\admin\AppData\Local\Temp\Rendering.hoppbinary
MD5:0A01134A1949C121F8ED8F519D746EBA
SHA256:A8C3033F598E30CD066975659C17582047B15765C3E444647D8047338BF8748F
5544extrac32.exeC:\Users\admin\AppData\Local\Temp\Exceptbinary
MD5:9D83BAA07F5C52C55E10735A2695EB26
SHA256:C42D8807CDF6C7CA88965BA42A1D3DED0F448A666DD502FCC5C549ADBA74B156
5512random.exeC:\Users\admin\AppData\Local\Temp\Header.hoppcompressed
MD5:BC7E914F416BEA12F810553A713701EB
SHA256:9107B3936B2E85A4FF5DFA70CF1AAB1D89BDCCAB0A2B1C6CF7C1E1C0F94BDA4B
5512random.exeC:\Users\admin\AppData\Local\Temp\Wednesday.hoppbinary
MD5:695B8CFB142660AE5B70FAF73B74AC8A
SHA256:C7EA0B7EF57B6011B750B3A23F79390D723B5B4329693A217ACB23B7C61707D0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
47
DNS requests
31
Threats
13

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
6724
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6516
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6516
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.71
  • 20.190.159.128
  • 40.126.31.130
  • 40.126.31.128
  • 20.190.159.68
whitelisted
VXvkGfcqqqZjxN.VXvkGfcqqqZjxN
  • —
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
macjajm.digital
  • —
unknown
flowerexju.bet
  • —
malicious
zmedtipp.live
  • —
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (easterxeen .run)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zmedtipp .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (flowerexju .bet)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (araucahkbm .live)
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (macjajm .digital)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (araucahkbm .live)
960
Invision.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcovtcg .top) in TLS SNI
2196
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcovtcg .top)
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
random.exe