File name:

Ethelium.exe

Full analysis: https://app.any.run/tasks/6f986a5f-4ac4-4e53-a0ce-78ce5204995f
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: February 13, 2025, 09:00:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
exfiltration
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections
MD5:

B2E412D2873D39C1B478263587101BAB

SHA1:

869239D88C31B29746E47118DC649B097C8BDE17

SHA256:

BD4EC6D01B586E67FD0E666435A192AA4CED888F1067388DB12EBFA72AD6ACA7

SSDEEP:

12288:A2lcMSKir4KwBLojN0c5NzxPmVUhhevUVmWXPUZ3Be:A2lcPKir4zJWN06NdPmVUhhevUQWXPUC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Ethelium.exe (PID: 4592)

    • Steals credentials from Web Browsers

      • Ethelium.exe (PID: 4592)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2192)

    • Connects to the CnC server

      • svchost.exe (PID: 2192)

    • Actions looks like stealing of personal data

      • Ethelium.exe (PID: 4592)

    • LUMMA has been detected (YARA)

      • Ethelium.exe (PID: 4592)

  • SUSPICIOUS

    • Application launched itself

      • Ethelium.exe (PID: 444)

    • Executes application which crashes

      • Ethelium.exe (PID: 444)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2192)

    • Searches for installed software

      • Ethelium.exe (PID: 4592)

    • There is functionality for taking screenshot (YARA)

      • Ethelium.exe (PID: 4592)

  • INFO

    • Checks supported languages

      • Ethelium.exe (PID: 444)
      • Ethelium.exe (PID: 4592)

    • Reads the computer name

      • Ethelium.exe (PID: 444)
      • Ethelium.exe (PID: 4592)

    • Reads the machine GUID from the registry

      • Ethelium.exe (PID: 444)
      • Ethelium.exe (PID: 4592)

    • .NET Reactor protector has been detected

      • Ethelium.exe (PID: 444)
      • Ethelium.exe (PID: 4592)

    • Checks proxy server information

      • WerFault.exe (PID: 1448)

    • Reads the software policy settings

      • WerFault.exe (PID: 1448)
      • Ethelium.exe (PID: 4592)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 1448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (81)
.dll | Win32 Dynamic Link Library (generic) (7.2)
.exe | Win32 Executable (generic) (4.9)
.exe | Win16/32 Executable Delphi generic (2.2)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2080:01:23 07:16:34+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 36352
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xad0e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Acquire
FileVersion: 1.0.0.0
InternalName: Acquire.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: Acquire.exe
ProductName: Acquire
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
124
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ethelium.exe ethelium.exe no specs #LUMMA ethelium.exe werfault.exe #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Users\admin\AppData\Local\Temp\Ethelium.exe" C:\Users\admin\AppData\Local\Temp\Ethelium.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Acquire
Exit code:
3221226505
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ethelium.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1448C:\WINDOWS\SysWOW64\WerFault.exe -u -p 444 -s 1088C:\Windows\SysWOW64\WerFault.exe
Ethelium.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4592"C:\Users\admin\AppData\Local\Temp\Ethelium.exe"C:\Users\admin\AppData\Local\Temp\Ethelium.exe
Ethelium.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Acquire
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ethelium.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5432"C:\Users\admin\AppData\Local\Temp\Ethelium.exe"C:\Users\admin\AppData\Local\Temp\Ethelium.exe—Ethelium.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Acquire
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ethelium.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
9 545
Read events
9 545
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1448WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Ethelium.exe_5b0daac39939fd67d82b6534b7d8f2f293b4f2e_617f8889_a21bc19d-e5d6-44dc-b3fe-64bb0e1a22e1\Report.wer —
MD5:—
SHA256:—
1448WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Ethelium.exe.444.dmp —
MD5:—
SHA256:—
1448WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER9426.tmp.WERInternalMetadata.xmlbinary
MD5:44AD937213A6530B8BA4CA7F9FB55146
SHA256:9691723A8E5BAAFB5FB38A8A9106B263160D6D2BF0DE7839157E2C2131DFF50B
1448WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER90F8.tmp.dmpbinary
MD5:9AB458BBABDE76322BB8AD9E43605CEF
SHA256:4FE68E0A78AB56B96E94BD4EB9E1EA22CCF1FFAF6D975AB802ACC6A28954F02D
1448WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER94C3.tmp.xmlxml
MD5:3F75E1B80605A6151F610DABA62A0A81
SHA256:83EE984E3CC774FBA994A07364912A45F62FC5CCF40AAE333E6B5190AD7F4F41
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
25
DNS requests
6
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
403
188.114.97.3:443
https://mercharena.biz/api
unknown
html
4.44 Kb
malicious
—
—
POST
200
188.114.96.3:443
https://mercharena.biz/api
unknown
text
18.3 Kb
malicious
—
—
POST
200
188.114.96.3:443
https://mercharena.biz/api
unknown
text
16 b
malicious
—
—
POST
200
188.114.97.3:443
https://mercharena.biz/api
unknown
—
—
malicious
—
—
POST
200
188.114.97.3:443
https://mercharena.biz/api
unknown
text
16 b
malicious
—
—
POST
200
188.114.96.3:443
https://mercharena.biz/api
unknown
—
—
malicious
—
—
POST
200
188.114.97.3:443
https://mercharena.biz/api
unknown
text
13.6 Kb
malicious
—
—
POST
200
188.114.96.3:443
https://mercharena.biz/api
unknown
text
16 b
malicious
—
—
POST
200
188.114.97.3:443
https://mercharena.biz/api
unknown
text
16 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4592
Ethelium.exe
188.114.96.3:443
mercharena.biz
CLOUDFLARENET
NL
malicious
1448
WerFault.exe
20.42.73.29:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3976
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6068
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
ignoredshee.com
  • —
malicious
importenptoc.com
  • —
malicious
mercharena.biz
  • 188.114.96.3
  • 188.114.97.3
malicious
watson.events.data.microsoft.com
  • 20.42.73.29
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (importenptoc .com)
2192
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ignoredshee .com)
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer CnC Host Checkin
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer CnC Host Checkin
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Check-In
—
—
A Network Trojan was detected
ET MALWARE Lumma Stealer Related Activity M2
—
—
Malware Command and Control Activity Detected
ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Exfiltration
—
—
Malware Command and Control Activity Detected
STEALER [ANY.RUN] Win32/Lumma Stealer Check-In
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ethelium.exe