File name:

setup.exe

Full analysis: https://app.any.run/tasks/1dd9122e-81bb-45f7-9bdc-f08fbcad412d
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 13, 2025, 20:32:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

E344D8C0281839E4A6CE59EFE076EE72

SHA1:

0FF088DD8BA3FA924D8506309BA2B1CAB0CEFAA8

SHA256:

8F58115D21C5420E61C5F54A65B9310DAB5BE1F196EB1697B4E1C77222A1E203

SSDEEP:

49152:N75W6kNn2XvnHmkYJvw4EUMkIwxaaPWxEC/Q/Bza6QVxpUd2loOYp22Wdduv1gQg:N75Olemry4EUMkIi7PW//Q/BzqVxpUdq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • cmd.exe (PID: 1072)

    • LUMMA mutex has been found

      • Mattress.com (PID: 1164)

    • Actions looks like stealing of personal data

      • Mattress.com (PID: 1164)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2852)

    • Steals credentials from Web Browsers

      • Mattress.com (PID: 1164)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 4688)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6640)

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 4688)
      • cmd.exe (PID: 6640)

    • Executing commands from a ".bat" file

      • setup.exe (PID: 4688)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 4688)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6640)

    • Application launched itself

      • cmd.exe (PID: 6640)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6640)

    • The executable file from the user directory is run by the CMD process

      • Mattress.com (PID: 1164)

    • Executable content was dropped or overwritten

      • Mattress.com (PID: 1164)

    • Searches for installed software

      • Mattress.com (PID: 1164)

    • Get information on the list of running processes

      • cmd.exe (PID: 6640)

  • INFO

    • Create files in a temporary directory

      • setup.exe (PID: 4688)
      • extrac32.exe (PID: 4944)

    • Checks supported languages

      • setup.exe (PID: 4688)
      • extrac32.exe (PID: 4944)
      • Mattress.com (PID: 1164)

    • Reads the computer name

      • extrac32.exe (PID: 4944)
      • Mattress.com (PID: 1164)
      • setup.exe (PID: 4688)

    • Creates a new folder

      • cmd.exe (PID: 3268)

    • Reads mouse settings

      • Mattress.com (PID: 1164)

    • Creates files or folders in the user directory

      • Mattress.com (PID: 1164)

    • Reads the software policy settings

      • Mattress.com (PID: 1164)

    • Manual execution by a user

      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 2852)

    • The sample compiled with english language support

      • Mattress.com (PID: 1164)

    • Process checks computer location settings

      • setup.exe (PID: 4688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
21
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA mattress.com choice.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe schtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052cmd /c copy /b 166010\Mattress.com + Portugal + Layout + Og + Carry + Mono + Upset + Bottle + Firmware 166010\Mattress.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1072cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SquirrelSync.url" & echo URL="C:\Users\admin\AppData\Local\DataSync Dynamics\SquirrelSync.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SquirrelSync.url" & exitC:\Windows\SysWOW64\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1088findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1164Mattress.com I C:\Users\admin\AppData\Local\Temp\166010\Mattress.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\166010\mattress.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1512findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2852cmd /c schtasks.exe /create /tn "Appliances" /tr "wscript //B 'C:\Users\admin\AppData\Local\DataSync Dynamics\SquirrelSync.js'" /sc minute /mo 5 /FC:\Windows\SysWOW64\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 298
Read events
1 298
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
20
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4688setup.exeC:\Users\admin\AppData\Local\Temp\Floors.difbinary
MD5:3F9B8B85121DF90E276E27717C51DD01
SHA256:BC1B26A99F54997A5FAB17BAE9DE610BA3D6D9E18BAECC982ECA41DFF158CA6E
4688setup.exeC:\Users\admin\AppData\Local\Temp\Carolina.difbinary
MD5:FD5C6A6F2D5FA7DB0471C6450C374FEF
SHA256:B293BEADD271AA79A7A17A106E7C99FF8B9D6AF7932B881E13BC3113CCDE9F90
4688setup.exeC:\Users\admin\AppData\Local\Temp\Reaching.difbinary
MD5:725E5EF5A12BAAB702D3CA14C9892F07
SHA256:94255B8B945B899C6A9EFC7E67A154F9347FC79D30D61B5E7FBB3A7F6A38A708
4688setup.exeC:\Users\admin\AppData\Local\Temp\Bit.difbinary
MD5:11D615110229CBD5C32DDF3834B13FD9
SHA256:B6FDD14C24CFF0F0E37D6AFCBE46163F8114D2A26145400D62CF5ECA3DAD7077
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Upsetbinary
MD5:8C3C5D62E3FE3BCEF68132E65DAE93BE
SHA256:A298C01278510F043A4739F22F9D9A50A8F96597132E4D2BD08B32B35D353E02
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Firmwarebinary
MD5:9B02564E34CFF666785B18415F103D3D
SHA256:B6DE2D9B1E9279ED852F51BB154D392789819A9C25338F0AEBE4E1AF3FE2D329
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Carrybinary
MD5:915F121035DD4B6350B32713ACE03689
SHA256:52D59C311A068E0F203068F33F0956503E9FC3B4BB1D3F740C91CFC82152CD83
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Layoutbinary
MD5:8AFC793623CBADF6A88227F639087F32
SHA256:09F2C4460FDE744C882943B2C23B5E499387C81CA1D87B40E502036544A65CE9
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Firebinary
MD5:1756B479F68A4D41330D9676340FD995
SHA256:1E40C9EB79F4610DC5C3035163BF41DE1F177403C78B9A568ACD18AE7C0763D5
4944extrac32.exeC:\Users\admin\AppData\Local\Temp\Bottlebinary
MD5:FDE391AA3009155EEEA35C184FAC0A00
SHA256:4F7C27510CF2EAC0A138DE53E5DE4BBA8275BE0422E6623559476C6717D46A23
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.24.77.13:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2268
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
184.24.77.13:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2268
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 184.24.77.13
  • 184.24.77.7
  • 184.24.77.22
  • 184.24.77.6
  • 184.24.77.9
  • 184.24.77.11
  • 184.24.77.16
  • 184.24.77.18
  • 184.24.77.15
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.132
  • 20.190.160.128
  • 20.190.160.5
  • 20.190.160.130
  • 40.126.32.68
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
sHkewrDUDYtr.sHkewrDUDYtr
  • —
unknown
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe