File name:

4321.zip

Full analysis: https://app.any.run/tasks/be521066-37b6-463d-992f-5dc639ec6f25
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: December 29, 2024, 13:04:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
stealer
lumma
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

D0703B77FEEA66D49C7AD38A99C42BA2

SHA1:

3C2A3F14ADBD2035234E1D1A6DDFA5D8A07BF5D0

SHA256:

8F493A64FC3C3A9B2A9A2108D1F5E6371134ABC151F71D2E1B0BBBCC4BC14435

SSDEEP:

98304:aHbX9l7Klz7BLwWpCuBTOUYQ/uunTu1mwe75uUcPo9WtOUMZKRgnRyiYvbFvwByc:qL720U8uj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ImApp.exe (PID: 7032)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 3208)
      • explorer.exe (PID: 2408)

    • Steals credentials from Web Browsers

      • explorer.exe (PID: 3208)
      • explorer.exe (PID: 2408)

    • LUMMA mutex has been found

      • explorer.exe (PID: 2408)
      • explorer.exe (PID: 3208)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 5628)
      • ImApp.exe (PID: 7032)

    • Executable content was dropped or overwritten

      • ImApp.exe (PID: 7032)

    • The process drops C-runtime libraries

      • ImApp.exe (PID: 7032)

    • Starts itself from another location

      • ImApp.exe (PID: 7032)
      • ImApp.exe (PID: 3224)

    • Starts CMD.EXE for commands execution

      • ImApp.exe (PID: 7116)
      • ImApp.exe (PID: 5788)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 5628)
      • ImApp.exe (PID: 7032)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5628)

    • Manual execution by a user

      • ImApp.exe (PID: 7032)
      • ImApp.exe (PID: 3224)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 5628)

    • Checks supported languages

      • ImApp.exe (PID: 7032)
      • ImApp.exe (PID: 7116)
      • ImApp.exe (PID: 3224)
      • ImApp.exe (PID: 5788)

    • Reads the computer name

      • ImApp.exe (PID: 7032)
      • ImApp.exe (PID: 7116)
      • ImApp.exe (PID: 3224)
      • ImApp.exe (PID: 5788)

    • Creates files or folders in the user directory

      • ImApp.exe (PID: 7032)

    • Create files in a temporary directory

      • ImApp.exe (PID: 7116)
      • ImApp.exe (PID: 5788)

    • Reads the software policy settings

      • explorer.exe (PID: 3208)
      • explorer.exe (PID: 2408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:12:27 01:46:18
ZipCRC: 0x7b3ff3e9
ZipCompressedSize: 759606
ZipUncompressedSize: 802217
ZipFileName: circumferential.ogg
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
11
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe imapp.exe imapp.exe no specs cmd.exe no specs conhost.exe no specs #LUMMA explorer.exe imapp.exe no specs imapp.exe no specs cmd.exe no specs conhost.exe no specs #LUMMA explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
2408C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\nhmeuusk
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
3208C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\rcgjk
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3224"C:\Users\admin\Desktop\ImApp.exe" C:\Users\admin\Desktop\ImApp.exe—explorer.exe
User:
admin
Company:
IncrediMail, Ltd.
Integrity Level:
MEDIUM
Description:
IncrediMail Tray Application
Exit code:
0
Version:
6, 3, 9, 5274
Modules
Images
c:\users\admin\desktop\imapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5244C:\WINDOWS\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe—ImApp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5628"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\4321.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5748\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5788C:\Users\admin\AppData\Roaming\vjl_protect_test\ImApp.exeC:\Users\admin\AppData\Roaming\vjl_protect_test\ImApp.exe—ImApp.exe
User:
admin
Company:
IncrediMail, Ltd.
Integrity Level:
MEDIUM
Description:
IncrediMail Tray Application
Exit code:
1
Version:
6, 3, 9, 5274
Modules
Images
c:\users\admin\appdata\roaming\vjl_protect_test\imapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6304\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7032"C:\Users\admin\Desktop\ImApp.exe" C:\Users\admin\Desktop\ImApp.exe
explorer.exe
User:
admin
Company:
IncrediMail, Ltd.
Integrity Level:
MEDIUM
Description:
IncrediMail Tray Application
Exit code:
0
Version:
6, 3, 9, 5274
Modules
Images
c:\users\admin\desktop\imapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7116C:\Users\admin\AppData\Roaming\vjl_protect_test\ImApp.exeC:\Users\admin\AppData\Roaming\vjl_protect_test\ImApp.exe—ImApp.exe
User:
admin
Company:
IncrediMail, Ltd.
Integrity Level:
MEDIUM
Description:
IncrediMail Tray Application
Exit code:
1
Version:
6, 3, 9, 5274
Modules
Images
c:\users\admin\appdata\roaming\vjl_protect_test\imapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
2 899
Read events
2 879
Write events
20
Delete events
0

Modification events

(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\4321.zip
(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(5628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
30
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\circumferential.oggabr
MD5:79426BEC52DEBD24D7F2C2D5C579AFE7
SHA256:8267A3EE82CCD1D5C7F4B57A01F0DCB46C4713E4F67E3CEA677F7A4DF2D743C1
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\ImLookExU.dllexecutable
MD5:6527BE4D6A3333DC5A49218C4F80530D
SHA256:908AB22CB8FA1B9125CF5746E5591FD84E4853326A812B9431CA1C0B9E997E1F
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\ImWrappU.dllexecutable
MD5:CBF4827A5920A5F02C50F78ED46D0319
SHA256:7187903A9E4078F4D31F4B709A59D24EB6B417EA289F4F28EABCE1EA2E713DCE
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\ImLookU.dllexecutable
MD5:3EA6D805A18715F7368363DEA3CD3F4C
SHA256:A6766C524497144D585EFA4FE384B516B563203427003508F7C8F6BFFA7C928D
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\IMHttpComm.dllexecutable
MD5:A70D91A9FD7B65BAA0355EE559098BD8
SHA256:96D6264B26DECF6595CA6F0584A1B60589EC5DACDF03DDF5FBB6104A6AFC9E7A
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\ImDbU.dllexecutable
MD5:8AE8BB143301934A023BC5C9BB160B56
SHA256:DB890BB2555E0BF3F82B38DC12ECD581348E40E53F9A51DD512149075C7DF0A4
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\ImApp.exeexecutable
MD5:312707A513F86ED20642F43F8EF4DD14
SHA256:9B398917C796083A6005AB3F9D78243DBC0FAD12BE1E196BE2B01041D4C951A7
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\Microsoft.VC80.CRT.manifestxml
MD5:541423A06EFDCD4E4554C719061F82CF
SHA256:17AD1A64BA1C382ABF89341B40950F9B31F95015C6B0D3E25925BFEBC1B53EB5
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\ImABU.dllexecutable
MD5:2102382908725F195CE2C3703CAA0C5F
SHA256:C56D37F20069E48EADE31236B4D3AA5AFDA2621BD77760E85964F1E6834BE9A6
5628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5628.29892\mfc80u.dllexecutable
MD5:CCC2E312486AE6B80970211DA472268B
SHA256:18BE5D3C656236B7E3CD6D619D62496FE3E7F66BF2859E460F8AC3D1A6BDAA9A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
44
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6208
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2132
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2132
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
372
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.21.110.139:443
www.bing.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.37.237.227
  • 88.221.169.152
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.bing.com
  • 2.21.110.139
  • 2.21.110.146
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.64
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 192.229.221.95
unknown
go.microsoft.com
  • 23.218.210.69
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4321.zip