File name:

๐’Ÿ๐‘œ๐“Œ๐“ƒ๐“@๐‘œ๐’ถ๐’น#$_๐’ฎ๐‘’๐“‰3๐“Š๐“…+๐น๐’พ๐“๐‘’-๐’ซ๐“ˆ๐“ˆ๐“Œ๐‘œ๐“‡๐’น_1123.tar

Full analysis: https://app.any.run/tasks/51e7c96d-786c-4048-aa38-5ba75a06aecc
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Trackerย ย ย ย ย >>>
Analysis date: June 15, 2025, 22:09:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/x-tar
File info: POSIX tar archive (GNU)
MD5:

389EF8E3731241DB0F2088564BAC9ECD

SHA1:

73588BF1EAB137C84164E59D0D251D4F5B023AAF

SHA256:

A4429FCF47807BAA3A3682782E64B757FDF356A3D8E13570053D07F69D4F70F4

SSDEEP:

49152:QzDwdsYbpZlVPRSESXr4fe5pfJyqDRiAgP+gL/VzZK1PjdF1aX65iTM5N7/Ak611:QzDKDHPiraoHyIi1PPL/Vt0sX65V5N7Q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • setup.exe (PID: 3908)
      • setup.exe (PID: 1268)

    • Connects to the CnC server

      • svchost.exe (PID: 2200)

    • AutoIt loader has been detected (YARA)

      • Word.com (PID: 2288)
      • Word.com (PID: 5116)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2200)
      • Word.com (PID: 2288)
      • Word.com (PID: 5116)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2528)
      • WinRAR.exe (PID: 3948)
      • setup.exe (PID: 3908)

    • The executable file from the user directory is run by the CMD process

      • Word.com (PID: 2288)
      • Word.com (PID: 5116)

    • Get information on the list of running processes

      • cmd.exe (PID: 1816)
      • cmd.exe (PID: 3608)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1816)
      • cmd.exe (PID: 3608)

    • Application launched itself

      • WinRAR.exe (PID: 3948)
      • WinRAR.exe (PID: 2528)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 1816)
      • cmd.exe (PID: 3608)

    • There is functionality for taking screenshot (YARA)

      • Word.com (PID: 2288)
      • setup.exe (PID: 3908)
      • setup.exe (PID: 1268)
      • Word.com (PID: 5116)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2200)
      • Word.com (PID: 2288)
      • Word.com (PID: 5116)

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 1268)
      • setup.exe (PID: 3908)

    • Executing commands from a ".bat" file

      • setup.exe (PID: 1268)
      • setup.exe (PID: 3908)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 1816)

  • INFO

    • Create files in a temporary directory

      • extrac32.exe (PID: 6256)
      • setup.exe (PID: 3908)

    • Checks supported languages

      • extrac32.exe (PID: 6256)
      • Word.com (PID: 2288)
      • setup.exe (PID: 3908)

    • Manual execution by a user

      • setup.exe (PID: 3908)
      • Taskmgr.exe (PID: 4216)
      • msinfo32.exe (PID: 4172)
      • setup.exe (PID: 1268)
      • Taskmgr.exe (PID: 4084)

    • Reads the computer name

      • setup.exe (PID: 3908)
      • Word.com (PID: 2288)
      • extrac32.exe (PID: 6256)

    • Process checks computer location settings

      • setup.exe (PID: 3908)

    • Reads mouse settings

      • Word.com (PID: 2288)
Find more information about signature artifacts and mapping to MITRE ATT&CKโ„ข MATRIX at the full report
No Malware configuration.

TRiD

.tar | TAR - Tape ARchive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
31
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs winrar.exe no specs setup.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs #LUMMA word.com choice.exe no specs #LUMMA svchost.exe slui.exe taskmgr.exe no specs taskmgr.exe msinfo32.exe no specs setup.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs #LUMMA word.com choice.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exeโ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
640findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exeโ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
984findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exeโ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1036C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1100tasklist C:\Windows\SysWOW64\tasklist.exeโ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1128tasklist C:\Windows\SysWOW64\tasklist.exeโ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1268"C:\Users\admin\Desktop\setup.exe" C:\Users\admin\Desktop\setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1644tasklist C:\Windows\SysWOW64\tasklist.exeโ€”cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1816"C:\WINDOWS\system32\cmd.exe" /c copy About.xll About.xll.bat & About.xll.batC:\Windows\SysWOW64\cmd.exeโ€”setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
9ย 749
Read events
9ย 692
Write events
56
Delete events
1

Modification events

(PID) Process:(2528)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2528)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2528)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2528)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\๐’Ÿ๐‘œ๐“Œ๐“ƒ๐“@๐‘œ๐’ถ๐’น#$_๐’ฎ๐‘’๐“‰3๐“Š๐“…+๐น๐’พ๐“๐‘’-๐’ซ๐“ˆ๐“ˆ๐“Œ๐‘œ๐“‡๐’น_1123.tar
(PID) Process:(2528)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2528)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2528)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2528)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3948)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(3948)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
Executable files
0
Suspicious files
22
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3800WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3800.20782\setup.exe โ€”
MD5:โ€”
SHA256:โ€”
2528WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2528.19973\๐——๐—ข๐—ช@๐—ก๐—Ÿ๐—ข๐—”๐——$_๐—–๐—ข๐— ๐—ฃ๐—Ÿ๐—˜๐—ง๐—˜โโค–๐—ฆ๐—˜๐—ง3๐—จ๐—ฃโœท๐—–๐—ข2๐——๐—˜1#$!.7zcompressed
MD5:C4CCD79A36B1D5A27D05D166C65BEA23
SHA256:9F555B89B92DCB7315CEE2C97E3BA23D30B829EE0B372C53FEE65B5310166375
3908setup.exeC:\Users\admin\AppData\Local\Temp\Bring.xllbinary
MD5:47502726850949B29D12E072E50F5E0B
SHA256:C5069EC294EEBF2CC6C9DA4C7A415C11EB40308FB81FE4A6974A6815CAB5E46F
3908setup.exeC:\Users\admin\AppData\Local\Temp\Adsl.xllbinary
MD5:330680A5756EB9249C077F1B19B62B0A
SHA256:50FE5D5872E84A7E3C151D9441C0B9C0BB163DDFFCDC1A424ABB7485E4115A0E
3908setup.exeC:\Users\admin\AppData\Local\Temp\Cow.xllcompressed
MD5:D7AD543584A702753965100A657BA587
SHA256:CE70BF53234E2B579CFA8BCCC4CF5BFD4A509277AE6BE7D3A7D14DDF339AB7BD
3908setup.exeC:\Users\admin\AppData\Local\Temp\Landscape.xllbinary
MD5:A3BABF7605F0D6B799033536ADBC10CD
SHA256:886D88B7E30AF30D60FA25CAD416DB8A0227112088687D051F2928D914D80657
3948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb3948.20497\SETUP.zipcompressed
MD5:80721A621DB4E82DC50074EA2FB9B800
SHA256:A8ADEC359F6D5C7BC417E71C76948431F8193D03703D106D5541D1633C66D367
3908setup.exeC:\Users\admin\AppData\Local\Temp\Horrible.xllbinary
MD5:00C196F0187EA4D609DA4FEC975D548B
SHA256:DBABB467B26AACD8BC23BFF3797495B3EACBB3F9306748B015C8282AC0C7EC6F
6256extrac32.exeC:\Users\admin\AppData\Local\Temp\Menubinary
MD5:F8A9382FCB7CBEB7CD3C6D1763828E8A
SHA256:610A7F615BCE3BB4F01636BB86FAF0DADDC93C066FABFDA7A210587C47DBBBC9
6256extrac32.exeC:\Users\admin\AppData\Local\Temp\Beginnersbinary
MD5:78FA0D7E8EE024A6BEB6F1F141BB3B00
SHA256:98B99DCD1E5C1CC5EE29A02345FF630346476B6CFCEE52441F342751EF95DC35
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
47
DNS requests
27
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3576
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
โ€”
โ€”
whitelisted
1268
svchost.exe
GET
200
184.24.77.7:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
โ€”
โ€”
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
โ€”
โ€”
whitelisted
5708
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
โ€”
โ€”
whitelisted
5708
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
โ€”
โ€”
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
โ€”
โ€”
whitelisted
5328
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
โ€”
โ€”
whitelisted
5040
SystemSettings.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
โ€”
โ€”
whitelisted
5040
SystemSettings.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
โ€”
โ€”
whitelisted
5328
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
โ€”
โ€”
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
โ€”
โ€”
โ€”
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6356
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
โ€”
โ€”
โ€”
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3576
svchost.exe
20.190.160.5:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3576
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
184.24.77.7:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.5
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.76
  • 20.190.160.128
  • 20.190.160.65
  • 20.190.160.64
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 184.24.77.7
  • 184.24.77.6
  • 184.24.77.41
  • 184.24.77.10
  • 184.24.77.29
  • 184.24.77.23
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2200
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (battlefled .top)
2288
Word.com
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 42
2288
Word.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (battlefled .top) in TLS SNI
2288
Word.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (battlefled .top) in TLS SNI
2288
Word.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (battlefled .top) in TLS SNI
5116
Word.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (battlefled .top) in TLS SNI
5116
Word.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (battlefled .top) in TLS SNI
5116
Word.com
Domain Observed Used for C2 Detected
ET MALWARE Observed Win32/Lumma Stealer Related Domain (battlefled .top) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
ยฉ 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
๐’Ÿ๐‘œ๐“Œ๐“ƒ๐“@๐‘œ๐’ถ๐’น#$_๐’ฎ๐‘’๐“‰3๐“Š๐“…+๐น๐’พ๐“๐‘’-๐’ซ๐“ˆ๐“ˆ๐“Œ๐‘œ๐“‡๐’น_1123.tar