File name:

SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469

Full analysis: https://app.any.run/tasks/775c2ba4-9251-4cfc-9acb-dee55cb899ed
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: October 08, 2023, 17:06:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
opendir
lumma
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

74F28E28DF4386BEFA5B4167FA511B33

SHA1:

76900B7A8D1D63F04912C2C7A8D2D284E81C134F

SHA256:

9554E7EF83F9C1AABED52BE7A308D7E25C99E7D71E006146AEE045D29784F92D

SSDEEP:

49152:AzRt3OiddajazTdIabTt8rgzhJ+VJ5wLrSBhEQ1GwSDWVaUimKoWQ8Gk+BvD58fO:AzRkOa2zTdIkWMzhJ8SSowSiEpmvjjxE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469.exe (PID: 2092)
      • lastsciiencepro.exe (PID: 2076)

    • Application was dropped or rewritten from another process

      • lastscience.exe (PID: 2952)
      • lastsciiencepro.exe (PID: 2076)
      • lastscience.exe (PID: 2832)
      • lastscience.exe (PID: 1308)
      • lastsciience.exe (PID: 2828)
      • lastscience.exe (PID: 2764)

    • LUMMA was detected

      • lastscience.exe (PID: 1308)

    • Connects to the CnC server

      • lastscience.exe (PID: 1308)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469.exe (PID: 2092)

    • Reads the Internet Settings

      • lastscience.exe (PID: 2952)
      • lastscience.exe (PID: 1308)
      • lastsciience.exe (PID: 2828)

    • Connects to the server without a host name

      • lastscience.exe (PID: 2952)
      • lastsciience.exe (PID: 2828)

    • Application launched itself

      • lastscience.exe (PID: 2952)

  • INFO

    • Create files in a temporary directory

      • SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469.exe (PID: 2092)
      • lastsciiencepro.exe (PID: 2076)

    • Checks supported languages

      • SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469.exe (PID: 2092)
      • lastsciiencepro.exe (PID: 2076)
      • lastscience.exe (PID: 2952)
      • lastscience.exe (PID: 1308)
      • lastsciience.exe (PID: 2828)

    • Reads the computer name

      • lastscience.exe (PID: 2952)
      • lastsciience.exe (PID: 2828)
      • lastscience.exe (PID: 1308)

    • Reads Environment values

      • lastscience.exe (PID: 2952)
      • lastsciience.exe (PID: 2828)

    • Reads the machine GUID from the registry

      • lastscience.exe (PID: 2952)
      • lastsciience.exe (PID: 2828)
      • lastscience.exe (PID: 1308)

    • Checks proxy server information

      • lastscience.exe (PID: 1308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2062:07:25 14:18:00+02:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.2
CodeSize: 31744
InitializedDataSize: 1619456
UninitializedDataSize: -
EntryPoint: 0x8200
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.4.10.5
ProductVersionNumber: 1.4.10.5
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: SoFi
FileDescription: POPSUGAR powers the optimism and dreams of women around the
FileVersion: 1.4.10.5
InternalName: SendEffectively
ProductName: Process Prevailing
ProductVersion: 1.4.10.5
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
7
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start securiteinfo.com.w32.msil_kryptik.fjl.gen.eldorado.20998.18469.exe no specs lastsciiencepro.exe no specs lastscience.exe #LUMMA lastscience.exe lastscience.exe no specs lastscience.exe no specs lastsciience.exe

Process information

PID
CMD
Path
Indicators
Parent process
1308C:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastscience.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastscience.exe
lastscience.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\lastscience.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2076C:\Users\admin\AppData\Local\Temp\IXP000.TMP\lastsciiencepro.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\lastsciiencepro.exe—SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\lastsciiencepro.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2092"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469.exe—explorer.exe
User:
admin
Company:
SoFi
Integrity Level:
MEDIUM
Description:
POPSUGAR powers the optimism and dreams of women around the
Exit code:
0
Version:
1.4.10.5
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.w32.msil_kryptik.fjl.gen.eldorado.20998.18469.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2764C:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastscience.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastscience.exe—lastscience.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\lastscience.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2828C:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastsciience.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastsciience.exe
lastsciiencepro.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\lastsciience.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shlwapi.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
2832C:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastscience.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastscience.exe—lastscience.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\lastscience.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2952C:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastscience.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastscience.exe
lastsciiencepro.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\lastscience.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\mscoree.dll
Total events
901
Read events
889
Write events
12
Delete events
0

Modification events

(PID) Process:(1308) lastscience.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1308) lastscience.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1308) lastscience.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1308) lastscience.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000BD000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1308) lastscience.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1308) lastscience.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1308) lastscience.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1308) lastscience.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
4
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2092SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\watchprevailing.exeexecutable
MD5:0A258548C05C1F8BADED9CCFBD4B6896
SHA256:81917C705392768FFC709D098A64C2928E323762D1A67DF441DBE207B9CDDC85
2092SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\lastsciiencepro.exeexecutable
MD5:81D34D81C4B40BA209760C61BAAAD458
SHA256:257891B32E5B952CF172A11AFFD291E4964EC9C1B24E51E174A4146503F8164A
2076lastsciiencepro.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastsciience.exeexecutable
MD5:EA0A13D98986C220A8273E407D805A46
SHA256:CFBD7B968B4C2A063A2A7FA144810B46D10632760743FD049074EF2B578AB69E
2076lastsciiencepro.exeC:\Users\admin\AppData\Local\Temp\IXP001.TMP\lastscience.exeexecutable
MD5:5118CBA991F9D9DA1BF691826EE94B91
SHA256:7262D0BC1D9B48C5CA8CFF8DA3C0060AFFCFC3792651083D18D07936AF30F238
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
9
DNS requests
1
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1308
lastscience.exe
GET
200
188.114.96.3:80
http://blessdeckite.fun/
unknown
html
4.61 Kb
unknown
2952
lastscience.exe
GET
200
172.86.98.101:80
http://172.86.98.101/xs12pro/Czbzftdagy.mp4
unknown
binary
486 Kb
unknown
2828
lastsciience.exe
GET
200
172.86.98.101:80
http://172.86.98.101/xs12pro/Hcubzvylx.pdf
unknown
binary
1.00 Mb
unknown
1308
lastscience.exe
POST
200
188.114.96.3:80
http://blessdeckite.fun/api
unknown
html
4.62 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2952
lastscience.exe
172.86.98.101:80
—
QUICKPACKET
CA
unknown
1308
lastscience.exe
188.114.96.3:80
blessdeckite.fun
CLOUDFLARENET
NL
unknown
2828
lastsciience.exe
172.86.98.101:80
—
QUICKPACKET
CA
unknown

DNS requests

Domain
IP
Reputation
blessdeckite.fun
  • 188.114.96.3
  • 188.114.97.3
malicious

Threats

PID
Process
Class
Message
1308
lastscience.exe
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Check-In
1308
lastscience.exe
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Check-In
2828
lastsciience.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host PDF Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.W32.MSIL_Kryptik.FJL.gen.Eldorado.20998.18469