File name:

2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts.zip

Full analysis: https://app.any.run/tasks/2be697e7-9ce1-4dc7-b60e-42069cea50b7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 24, 2024, 12:58:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
evasion
smartloader
loader
lumma
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

47C12952F2C10FF7C1C2B8E5ED6B01FF

SHA1:

062C3183227BB256933EBF0ED69431A41C803225

SHA256:

9E429649D192264294020BC75426BF48C5F6F5337A51941D6292BF32B40EC75A

SSDEEP:

98304:w7dgR79sn3qT2/0w1Lftx2S1VRIEPNQ3aCVxietohAmMC6hKE9hHzy0ZwzUXX1kt:u9fHTZoxlobRcXIPlnr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • compiler.exe (PID: 6692)
      • svchost.exe (PID: 2172)

    • SMARTLOADER has been detected (SURICATA)

      • compiler.exe (PID: 6692)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2172)

  • SUSPICIOUS

    • Checks for external IP

      • svchost.exe (PID: 2172)
      • compiler.exe (PID: 6692)

    • Application launched itself

      • win.exe (PID: 6704)
      • SentinelOculus.exe (PID: 5948)

    • Connects to the server without a host name

      • compiler.exe (PID: 6692)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2172)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 6200)
      • win.exe (PID: 6704)
      • cmd.exe (PID: 4956)
      • SentinelOculus.exe (PID: 5948)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3648)
      • WinRAR.exe (PID: 6200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:10:03 17:28:42
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: 2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
14
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs winrar.exe sppextcomobj.exe no specs slui.exe win.exe no specs sentineloculus.exe no specs cmd.exe no specs conhost.exe no specs #SMARTLOADER compiler.exe #LUMMA svchost.exe win.exe sentineloculus.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
764\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3648"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4956C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\Launcher.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
5948"C:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\SentinelOculus.exe" C:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\SentinelOculus.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.4.0.0
Modules
Images
c:\users\admin\desktop\2024-10-03-smartloader-to-lumma-stealer-malware-and-artifacts\2024-10-03-smartloader-to-lumma-stealer-malware-and-artifacts\sentineloculus.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6196"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6200"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\Nezur.zip" C:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6224"C:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\win.exe"C:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\win.exe
win.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.4.0.0
Modules
Images
c:\users\admin\desktop\2024-10-03-smartloader-to-lumma-stealer-malware-and-artifacts\2024-10-03-smartloader-to-lumma-stealer-malware-and-artifacts\win.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6232C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6376C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
4 124
Read events
4 083
Write events
28
Delete events
13

Modification events

(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts.zip
(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:13
Value:
(PID) Process:(3648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:12
Value:
Executable files
4
Suspicious files
6
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3648WinRAR.exeC:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\SentinelOculus.exe —
MD5:—
SHA256:—
3648WinRAR.exeC:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-https___github.com_user-attachments_files_17160709_error.json.txt —
MD5:—
SHA256:—
3648WinRAR.exeC:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\win.exe —
MD5:—
SHA256:—
6704win.exeC:\Users\admin\Music\MoonpayUpdater\SentinelOculus.exe —
MD5:—
SHA256:—
3648WinRAR.exeC:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-example-of-registry-update-for-Lumma-Stealer.txttext
MD5:93F2FE86DC41FD33C9AEB3AC4E205481
SHA256:819B746A27EBB942E4D92DB16F25D32122E3FC6D0F1C6222EAA634A22CED01D5
3648WinRAR.exeC:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\Nezur.zipcompressed
MD5:CA0DDCFDC2FF6C02BFFA74BBB9035F50
SHA256:CBD9226C470EFD29143F357E9EE0F6B2D20456041A0B4CB74912CCCE9E37F97D
3648WinRAR.exeC:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-IOCs-for-SmartLoader-to-Lumma-Stealer.txttext
MD5:539CFB01D3E9A8F80E31DFB94F979A31
SHA256:E6A81D7D29B5D8AB517BFE57DE817EA50D66C9A6D2FA943D483C0D63199C08D6
3648WinRAR.exeC:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-example-of-scheduled-task-for-Lumma-Stealer-d2luODA1.txtxml
MD5:478DF799BEC3CB468D439CE0E5E2B60F
SHA256:0DA5D6B8E16E62BC4D379C218272BC09C5A70086A6FC65897E8144278F9658E9
6200WinRAR.exeC:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\lua51.dllexecutable
MD5:1261FCFECAD381AEBA01EC6102648F3D
SHA256:473276EA7CD546B7D10DADBFE6D071710695E7C12D3D43D4C97E91999674B896
6200WinRAR.exeC:\Users\admin\Desktop\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts\Launcher.battext
MD5:0CE155488691610AC271DA90164C0F60
SHA256:CF31E682396556B5CFC16E660417B9C52DA38E543229CCD0430C59C6A6227B79
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
80
DNS requests
44
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.48.23.173:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5624
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5624
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5048
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6692
compiler.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
shared
6692
compiler.exe
PUT
200
212.193.4.66:80
http://212.193.4.66/api/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms
unknown
—
—
malicious
6692
compiler.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1880
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6944
svchost.exe
23.48.23.173:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1880
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.48.23.173
  • 23.48.23.156
  • 23.48.23.167
  • 23.48.23.143
  • 23.48.23.177
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
  • 23.52.120.96
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.131
  • 104.126.37.137
  • 104.126.37.185
  • 104.126.37.136
  • 104.126.37.128
  • 2.16.110.123
  • 2.16.110.193
  • 2.16.110.195
  • 2.16.110.121
  • 2.16.110.176
  • 2.16.110.168
  • 2.16.110.170
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.136
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.140
  • 20.190.160.22
whitelisted
th.bing.com
  • 104.126.37.128
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.131
  • 104.126.37.137
  • 104.126.37.185
  • 104.126.37.136
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2172
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6692
compiler.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
6692
compiler.exe
A Network Trojan was detected
LOADER [ANY.RUN] SmartLoader Check-in
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)
2172
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)
—
—
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2024-10-03-SmartLoader-to-Lumma-Stealer-malware-and-artifacts.zip