File name:

install.exe

Full analysis: https://app.any.run/tasks/e3294be3-0eee-4450-a4eb-4c39c97fce8a
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: July 06, 2025, 02:07:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
autoit-loader
lumma
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

155881952C6818189BCC9DAE5CC1D9BC

SHA1:

77EBDF95EB0662A405C6464C59BAB3BD180E003B

SHA256:

9A48A3E567E0B4CE2D04A4B2B71477B9C40C99F6887258F0A5C0E89D41D6D646

SSDEEP:

49152:1HRjhabl7pDWy6O1kEdqTLcEfBRVNANiyPSUoZ3GGmAJI5XAEpv1BQiHv9nCOORh:1xtGvZiEELZ7yPdB5QEpIIWypZPCEVpM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • install.exe (PID: 7156)

    • AutoIt loader has been detected (YARA)

      • Dead.com (PID: 2080)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • install.exe (PID: 7156)

    • There is functionality for taking screenshot (YARA)

      • Dead.com (PID: 2080)
      • install.exe (PID: 7156)

    • Reads security settings of Internet Explorer

      • install.exe (PID: 7156)

    • Starts CMD.EXE for commands execution

      • install.exe (PID: 7156)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 1732)

    • Get information on the list of running processes

      • cmd.exe (PID: 1732)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 1732)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1732)

    • The executable file from the user directory is run by the CMD process

      • Dead.com (PID: 2080)

    • Executes application which crashes

      • Dead.com (PID: 2080)

    • The process checks if it is being run in the virtual environment

      • Dead.com (PID: 2080)

  • INFO

    • Process checks computer location settings

      • install.exe (PID: 7156)

    • Reads the computer name

      • install.exe (PID: 7156)
      • extrac32.exe (PID: 4948)
      • Dead.com (PID: 2080)

    • Checks supported languages

      • install.exe (PID: 7156)
      • extrac32.exe (PID: 4948)
      • Dead.com (PID: 2080)

    • Create files in a temporary directory

      • install.exe (PID: 7156)
      • extrac32.exe (PID: 4948)

    • Reads mouse settings

      • Dead.com (PID: 2080)

    • Reads the machine GUID from the registry

      • Dead.com (PID: 2080)

    • Manual execution by a user

      • OOBE-Maintenance.exe (PID: 6768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
15
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start install.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs dead.com choice.exe no specs slui.exe no specs oobe-maintenance.exe conhost.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1352C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2080 -s 1232C:\Windows\SysWOW64\WerFault.exe—Dead.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1732"C:\WINDOWS\system32\cmd.exe" /c copy Vic.docx Vic.docx.bat & Vic.docx.batC:\Windows\SysWOW64\cmd.exe—install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
2044findstr /V "Ohio" Affairs C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2080Dead.com T C:\Users\admin\AppData\Local\Temp\726762\Dead.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
3221225477
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\726762\dead.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
2432findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3908tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4380choice /d n /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4500findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—OOBE-Maintenance.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 732
Read events
1 732
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
25
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7156install.exeC:\Users\admin\AppData\Local\Temp\Earned.docxbinary
MD5:8FE1D5DF6F5B80C2863838D6363B00B2
SHA256:50DB2EBFC4FA3B7772C7279829A6CD15B1DCCDE4EC4A6DFAA9442DA62F9DE69D
7156install.exeC:\Users\admin\AppData\Local\Temp\Fundamentals.docxcompressed
MD5:0F552ADD42F17255ACA771FA1829F3EE
SHA256:26F286863521CCB228444839A009BA5451788B04F37EE787867B97B3D4F4FE02
7156install.exeC:\Users\admin\AppData\Local\Temp\Prison.docxbinary
MD5:24AF2855EED8D543FF2CB86CD592BCE7
SHA256:1C645CA04D031E56B3153A4BD0E1CAAD7F17D923F5DBDC3EE843188313EC2BAF
7156install.exeC:\Users\admin\AppData\Local\Temp\Cellular.docxbinary
MD5:A857742E36C8A26DB8F73E1B64D94CD7
SHA256:D45BC8601DB15BBA8AEEEB9A271D72E4750742BDE7888478274B584E1F58B40A
7156install.exeC:\Users\admin\AppData\Local\Temp\Zus.docxbinary
MD5:07E27C66D333E9A7776DCA312F070905
SHA256:516B75516C7537FE86ED4A7AFCF1B2E52B1C4D52FFD399DE30B6B3F0AAFF32A0
7156install.exeC:\Users\admin\AppData\Local\Temp\Belong.docxbinary
MD5:CB645704A5CFF397936639C961F2E2C8
SHA256:8DB36A60695F2F47F2A3DB2EF4E6633F97D517B27614E77004070C6CBA49B8BB
7156install.exeC:\Users\admin\AppData\Local\Temp\Wisconsin.docxbinary
MD5:BD2B288D0948A8E7D72ECD827E4733BF
SHA256:EDE0763830931D3A1B1B931E7EF22569E3849F6C64B360EF9A2EBECC1CEE3CDA
7156install.exeC:\Users\admin\AppData\Local\Temp\Ross.docxbinary
MD5:92EDBC326AC97CBCF4A013E4B9CF4260
SHA256:258252798B82F2B2038A180DB9AA59F078E0C564B79C591AFB85FA306DD51B85
7156install.exeC:\Users\admin\AppData\Local\Temp\Revolutionary.docxbinary
MD5:07A6C413EBF98ADFE713CF50BF3CB0DE
SHA256:DC968A3E4B54548EB8E0B67CE53ACC1AE82012DDC7F0AE3BB6F7F9D0F7A48489
7156install.exeC:\Users\admin\AppData\Local\Temp\Md.docxbinary
MD5:B0D15A191D074B7FEB7A94BC208FC32D
SHA256:2BE7D87232EF27320902237D430B9EEFFD763E4E1AB92F81BB444BAEFCAB9F3C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2272
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2272
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2292
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2272
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2272
SIHClient.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2272
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
NgfeoUjanXmxvKtoQqtFViOY.NgfeoUjanXmxvKtoQqtFViOY
  • —
unknown
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
login.live.com
  • 40.126.31.128
  • 40.126.31.67
  • 20.190.159.131
  • 40.126.31.2
  • 20.190.159.23
  • 40.126.31.131
  • 20.190.159.75
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
install.exe