File name:

setup.exe

Full analysis: https://app.any.run/tasks/1dd9122e-81bb-45f7-9bdc-f08fbcad412d
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 13, 2025, 20:32:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

E344D8C0281839E4A6CE59EFE076EE72

SHA1:

0FF088DD8BA3FA924D8506309BA2B1CAB0CEFAA8

SHA256:

8F58115D21C5420E61C5F54A65B9310DAB5BE1F196EB1697B4E1C77222A1E203

SSDEEP:

49152:N75W6kNn2XvnHmkYJvw4EUMkIwxaaPWxEC/Q/Bza6QVxpUd2loOYp22Wdduv1gQg:N75Olemry4EUMkIi7PW//Q/BzqVxpUdq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2852)

    • Create files in the Startup directory

      • cmd.exe (PID: 1072)

    • Actions looks like stealing of personal data

      • Mattress.com (PID: 1164)

    • Steals credentials from Web Browsers

      • Mattress.com (PID: 1164)

    • LUMMA mutex has been found

      • Mattress.com (PID: 1164)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 4688)

    • Get information on the list of running processes

      • cmd.exe (PID: 6640)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6640)

    • Executing commands from a ".bat" file

      • setup.exe (PID: 4688)

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 4688)
      • cmd.exe (PID: 6640)

    • Application launched itself

      • cmd.exe (PID: 6640)

    • The executable file from the user directory is run by the CMD process

      • Mattress.com (PID: 1164)

    • Executable content was dropped or overwritten

      • Mattress.com (PID: 1164)

    • Searches for installed software

      • Mattress.com (PID: 1164)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 4688)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6640)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6640)

  • INFO

    • Reads the computer name

      • setup.exe (PID: 4688)
      • extrac32.exe (PID: 4944)
      • Mattress.com (PID: 1164)

    • Checks supported languages

      • setup.exe (PID: 4688)
      • extrac32.exe (PID: 4944)
      • Mattress.com (PID: 1164)

    • Process checks computer location settings

      • setup.exe (PID: 4688)

    • Create files in a temporary directory

      • setup.exe (PID: 4688)
      • extrac32.exe (PID: 4944)

    • Creates a new folder

      • cmd.exe (PID: 3268)

    • Manual execution by a user

      • cmd.exe (PID: 2852)
      • cmd.exe (PID: 1072)

    • The sample compiled with english language support

      • Mattress.com (PID: 1164)

    • Creates files or folders in the user directory

      • Mattress.com (PID: 1164)

    • Reads the software policy settings

      • Mattress.com (PID: 1164)

    • Reads mouse settings

      • Mattress.com (PID: 1164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
21
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA mattress.com choice.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe schtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052cmd /c copy /b 166010\Mattress.com + Portugal + Layout + Og + Carry + Mono + Upset + Bottle + Firmware 166010\Mattress.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1072cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SquirrelSync.url" & echo URL="C:\Users\admin\AppData\Local\DataSync Dynamics\SquirrelSync.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SquirrelSync.url" & exitC:\Windows\SysWOW64\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1088findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1164Mattress.com I C:\Users\admin\AppData\Local\Temp\166010\Mattress.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\166010\mattress.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1512findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2852cmd /c schtasks.exe /create /tn "Appliances" /tr "wscript //B 'C:\Users\admin\AppData\Local\DataSync Dynamics\SquirrelSync.js'" /sc minute /mo 5 /FC:\Windows\SysWOW64\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 298
Read events
1 298
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
20
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4688setup.exeC:\Users\admin\AppData\Local\Temp\Floors.difbinary
MD5:3F9B8B85121DF90E276E27717C51DD01
SHA256:BC1B26A99F54997A5FAB17BAE9DE610BA3D6D9E18BAECC982ECA41DFF158CA6E
4688setup.exeC:\Users\admin\AppData\Local\Temp\Naked.difbinary
MD5:7BF0CA1E576EBE0440094A92F48B7BAF
SHA256:1E8F9E5718249F708F474B884122A3041855FA6A40F78B04168AA4B09124657F
4688setup.exeC:\Users\admin\AppData\Local\Temp\Bit.difbinary
MD5:11D615110229CBD5C32DDF3834B13FD9
SHA256:B6FDD14C24CFF0F0E37D6AFCBE46163F8114D2A26145400D62CF5ECA3DAD7077
4688setup.exeC:\Users\admin\AppData\Local\Temp\Dictionary.difbinary
MD5:B7EEF4F140EDF36DBC73409F4C0A19B6
SHA256:F5EC6549220A70A910CDEA58523C30770AD2D72B67CF6AE69117CB9E35031EF5
6640cmd.exeC:\Users\admin\AppData\Local\Temp\Passion.dif.battext
MD5:3200B8D4D4A0D420FD7F062D0393A377
SHA256:C682349F5A3FF3D6A902335D3B07FAAC02B261E9945791DD3BDF01C7EB2B86AC
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Upsetbinary
MD5:8C3C5D62E3FE3BCEF68132E65DAE93BE
SHA256:A298C01278510F043A4739F22F9D9A50A8F96597132E4D2BD08B32B35D353E02
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Layoutbinary
MD5:8AFC793623CBADF6A88227F639087F32
SHA256:09F2C4460FDE744C882943B2C23B5E499387C81CA1D87B40E502036544A65CE9
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Ogbinary
MD5:733687B9162D3C477FBFADA9C20346FE
SHA256:61D149F1B5FA8A6E6DCB594C272727ABE2E2BD24AF748608B7274886F1F70167
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Firebinary
MD5:1756B479F68A4D41330D9676340FD995
SHA256:1E40C9EB79F4610DC5C3035163BF41DE1F177403C78B9A568ACD18AE7C0763D5
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Firmwarebinary
MD5:9B02564E34CFF666785B18415F103D3D
SHA256:B6DE2D9B1E9279ED852F51BB154D392789819A9C25338F0AEBE4E1AF3FE2D329
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.24.77.13:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
184.24.77.13:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2268
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 184.24.77.13
  • 184.24.77.7
  • 184.24.77.22
  • 184.24.77.6
  • 184.24.77.9
  • 184.24.77.11
  • 184.24.77.16
  • 184.24.77.18
  • 184.24.77.15
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.132
  • 20.190.160.128
  • 20.190.160.5
  • 20.190.160.130
  • 40.126.32.68
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
sHkewrDUDYtr.sHkewrDUDYtr
  • —
unknown
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe