File name:

install.exe

Full analysis: https://app.any.run/tasks/e3294be3-0eee-4450-a4eb-4c39c97fce8a
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: July 06, 2025, 02:07:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
autoit-loader
lumma
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

155881952C6818189BCC9DAE5CC1D9BC

SHA1:

77EBDF95EB0662A405C6464C59BAB3BD180E003B

SHA256:

9A48A3E567E0B4CE2D04A4B2B71477B9C40C99F6887258F0A5C0E89D41D6D646

SSDEEP:

49152:1HRjhabl7pDWy6O1kEdqTLcEfBRVNANiyPSUoZ3GGmAJI5XAEpv1BQiHv9nCOORh:1xtGvZiEELZ7yPdB5QEpIIWypZPCEVpM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • install.exe (PID: 7156)

    • AutoIt loader has been detected (YARA)

      • Dead.com (PID: 2080)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • install.exe (PID: 7156)

    • Executing commands from a ".bat" file

      • install.exe (PID: 7156)

    • Starts CMD.EXE for commands execution

      • install.exe (PID: 7156)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 1732)

    • Get information on the list of running processes

      • cmd.exe (PID: 1732)

    • The executable file from the user directory is run by the CMD process

      • Dead.com (PID: 2080)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1732)

    • There is functionality for taking screenshot (YARA)

      • install.exe (PID: 7156)
      • Dead.com (PID: 2080)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 1732)

    • The process checks if it is being run in the virtual environment

      • Dead.com (PID: 2080)

    • Executes application which crashes

      • Dead.com (PID: 2080)

  • INFO

    • Checks supported languages

      • install.exe (PID: 7156)
      • extrac32.exe (PID: 4948)
      • Dead.com (PID: 2080)

    • Reads the computer name

      • install.exe (PID: 7156)
      • extrac32.exe (PID: 4948)
      • Dead.com (PID: 2080)

    • Process checks computer location settings

      • install.exe (PID: 7156)

    • Create files in a temporary directory

      • install.exe (PID: 7156)
      • extrac32.exe (PID: 4948)

    • Reads mouse settings

      • Dead.com (PID: 2080)

    • Reads the machine GUID from the registry

      • Dead.com (PID: 2080)

    • Manual execution by a user

      • OOBE-Maintenance.exe (PID: 6768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
15
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start install.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs dead.com choice.exe no specs slui.exe no specs oobe-maintenance.exe conhost.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1352C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2080 -s 1232C:\Windows\SysWOW64\WerFault.exe—Dead.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1732"C:\WINDOWS\system32\cmd.exe" /c copy Vic.docx Vic.docx.bat & Vic.docx.batC:\Windows\SysWOW64\cmd.exe—install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
2044findstr /V "Ohio" Affairs C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2080Dead.com T C:\Users\admin\AppData\Local\Temp\726762\Dead.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
3221225477
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\726762\dead.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
2432findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3908tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4380choice /d n /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4500findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—OOBE-Maintenance.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 732
Read events
1 732
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
25
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7156install.exeC:\Users\admin\AppData\Local\Temp\Cellular.docxbinary
MD5:A857742E36C8A26DB8F73E1B64D94CD7
SHA256:D45BC8601DB15BBA8AEEEB9A271D72E4750742BDE7888478274B584E1F58B40A
7156install.exeC:\Users\admin\AppData\Local\Temp\Null.docxbinary
MD5:C78B4EFB3BC5CAC9C5F25BC9BBD0C737
SHA256:1FE0D7C8E5DB9DB469C92FF8ECC595A65B1646C512F17DC8C294A8CC5DCA4948
7156install.exeC:\Users\admin\AppData\Local\Temp\Foreign.docxbinary
MD5:95CEF98670EE59E57BC2DC7A1CC469C1
SHA256:7D58FC707812BA812A0D32A5AEDAEC8067D8C9DAF76B071F0F769D6DE719CA27
7156install.exeC:\Users\admin\AppData\Local\Temp\Ross.docxbinary
MD5:92EDBC326AC97CBCF4A013E4B9CF4260
SHA256:258252798B82F2B2038A180DB9AA59F078E0C564B79C591AFB85FA306DD51B85
7156install.exeC:\Users\admin\AppData\Local\Temp\Prison.docxbinary
MD5:24AF2855EED8D543FF2CB86CD592BCE7
SHA256:1C645CA04D031E56B3153A4BD0E1CAAD7F17D923F5DBDC3EE843188313EC2BAF
7156install.exeC:\Users\admin\AppData\Local\Temp\Wisconsin.docxbinary
MD5:BD2B288D0948A8E7D72ECD827E4733BF
SHA256:EDE0763830931D3A1B1B931E7EF22569E3849F6C64B360EF9A2EBECC1CEE3CDA
7156install.exeC:\Users\admin\AppData\Local\Temp\Fundamentals.docxcompressed
MD5:0F552ADD42F17255ACA771FA1829F3EE
SHA256:26F286863521CCB228444839A009BA5451788B04F37EE787867B97B3D4F4FE02
7156install.exeC:\Users\admin\AppData\Local\Temp\Vic.docxtext
MD5:51C91C9A832294520BD4C62ADE94E363
SHA256:CAD4D48791B96A35C23AC892C8AE5D39E435E50B19686EA3EFFE4B78C63856DD
7156install.exeC:\Users\admin\AppData\Local\Temp\Network.docxbinary
MD5:D77410A277029D4BF8D4A64EC455162E
SHA256:EAF38B91BA9BE1F9FF2B92CC452789B44D175341DB4D0E439112602F24F256F0
7156install.exeC:\Users\admin\AppData\Local\Temp\Revolutionary.docxbinary
MD5:07A6C413EBF98ADFE713CF50BF3CB0DE
SHA256:DC968A3E4B54548EB8E0B67CE53ACC1AE82012DDC7F0AE3BB6F7F9D0F7A48489
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2272
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2272
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2292
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2272
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2272
SIHClient.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2272
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
NgfeoUjanXmxvKtoQqtFViOY.NgfeoUjanXmxvKtoQqtFViOY
  • —
unknown
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
login.live.com
  • 40.126.31.128
  • 40.126.31.67
  • 20.190.159.131
  • 40.126.31.2
  • 20.190.159.23
  • 40.126.31.131
  • 20.190.159.75
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
install.exe