File name:

setup.exe

Full analysis: https://app.any.run/tasks/f492fa47-457d-4dfe-a3ba-06b546cf83b3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: April 15, 2025, 07:52:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
lumma
loader
delphi
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 7 sections
MD5:

A90F3F087193590EC1EDAFCAC135CCF5

SHA1:

128897A2A8EB53B68323018BED071913BBBFBB88

SHA256:

C4BD5207A70B0CA1FBB016E1C367CBD52E89C7201F72DBC9C9D44CCF5A50DEC0

SSDEEP:

49152:H+KBGM1M23lfs2oXVxoodbIA5VxHzZJreHhSH5YkVOsepS/256ELGJXzO9EY642Q:TaFI8X28hI8xIQ7tSGvDaFwy0+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • LUMMA mutex has been found

      • setup.exe (PID: 7760)
    • Steals credentials from Web Browsers

      • setup.exe (PID: 7760)
    • Actions looks like stealing of personal data

      • setup.exe (PID: 7760)
    • Executing a file with an untrusted certificate

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 4736)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • LUMMA has been detected (YARA)

      • setup.exe (PID: 7760)
    • Changes the autorun value in the registry

      • reg.exe (PID: 4944)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup.exe (PID: 7760)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Searches for installed software

      • setup.exe (PID: 7760)
    • There is functionality for taking screenshot (YARA)

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 4736)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Application launched itself

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 4736)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7364)
    • Connects to unusual port

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Starts CMD.EXE for commands execution

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
  • INFO

    • Reads the machine GUID from the registry

      • setup.exe (PID: 7760)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Checks supported languages

      • setup.exe (PID: 7760)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 4736)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Reads the computer name

      • setup.exe (PID: 7760)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 4736)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Create files in a temporary directory

      • setup.exe (PID: 7760)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 4736)
    • Reads the software policy settings

      • setup.exe (PID: 7760)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
      • slui.exe (PID: 4880)
    • The sample compiled with english language support

      • setup.exe (PID: 7760)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Compiled with Borland Delphi (YARA)

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 4736)
      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Detects GO elliptic curve encryption (YARA)

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Creates files in the program directory

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Drops encrypted JS script (Microsoft Script Encoder)

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Application based on Golang

      • 4SRA40PAT844X82HGPIWXQRDGIQ27.exe (PID: 2320)
    • Checks proxy server information

      • slui.exe (PID: 4880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.1)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:01:29 18:38:44+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.23
CodeSize: 677376
InitializedDataSize: 788480
UninitializedDataSize: 4608
EntryPoint: 0x1500
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
8
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #LUMMA setup.exe 4sra40pat844x82hgpiwxqrdgiq27.exe no specs 4sra40pat844x82hgpiwxqrdgiq27.exe slui.exe cmd.exe no specs conhost.exe no specs reg.exe setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2320C:\Users\admin\AppData\Local\Temp\4SRA40PAT844X82HGPIWXQRDGIQ27.exeC:\Users\admin\AppData\Local\Temp\4SRA40PAT844X82HGPIWXQRDGIQ27.exe
4SRA40PAT844X82HGPIWXQRDGIQ27.exe
User:
admin
Company:
Embarcadero Technologies, Inc.
Integrity Level:
HIGH
Description:
Embarcadero FMX Style Viewer
Version:
17.0.4469.47716
Modules
Images
c:\users\admin\appdata\local\temp\ywour
c:\users\admin\appdata\local\temp\4sra40pat844x82hgpiwxqrdgiq27.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4736"C:\Users\admin\AppData\Local\Temp\4SRA40PAT844X82HGPIWXQRDGIQ27.exe"C:\Users\admin\AppData\Local\Temp\4SRA40PAT844X82HGPIWXQRDGIQ27.exesetup.exe
User:
admin
Company:
Embarcadero Technologies, Inc.
Integrity Level:
HIGH
Description:
Embarcadero FMX Style Viewer
Exit code:
0
Version:
17.0.4469.47716
Modules
Images
c:\users\admin\appdata\local\temp\4sra40pat844x82hgpiwxqrdgiq27.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4880C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4944reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v VisageBrowser /t REG_SZ /d C:\ProgramData\VisageBrowser.exe /fC:\Windows\SysWOW64\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7336\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7364cmd /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v VisageBrowser /t REG_SZ /d C:\ProgramData\VisageBrowser.exe /f"C:\Windows\SysWOW64\cmd.exe4SRA40PAT844X82HGPIWXQRDGIQ27.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7640"C:\Users\admin\Desktop\setup.exe" C:\Users\admin\Desktop\setup.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7760"C:\Users\admin\Desktop\setup.exe" C:\Users\admin\Desktop\setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
10 059
Read events
10 058
Write events
1
Delete events
0

Modification events

(PID) Process:(4944) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:VisageBrowser
Value:
C:\ProgramData\VisageBrowser.exe
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
47364SRA40PAT844X82HGPIWXQRDGIQ27.exeC:\Users\admin\AppData\Local\Temp\f445ba13
MD5:
SHA256:
47364SRA40PAT844X82HGPIWXQRDGIQ27.exeC:\Users\admin\AppData\Local\Temp\f486ae82
MD5:
SHA256:
47364SRA40PAT844X82HGPIWXQRDGIQ27.exeC:\Users\admin\AppData\Local\Temp\ywour
MD5:
SHA256:
7760setup.exeC:\Users\admin\AppData\Local\Temp\4SRA40PAT844X82HGPIWXQRDGIQ27.exeexecutable
MD5:4D48955BDFEA89A99375485959C6B743
SHA256:83F00550E753CC9956FCB799796CB5ED9AB422011EA04C57698CA56FF65BB8BD
23204SRA40PAT844X82HGPIWXQRDGIQ27.exeC:\ProgramData\VisageBrowser.exeexecutable
MD5:4D48955BDFEA89A99375485959C6B743
SHA256:83F00550E753CC9956FCB799796CB5ED9AB422011EA04C57698CA56FF65BB8BD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
56
DNS requests
19
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
304
4.245.163.56:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
POST
200
20.190.159.0:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
POST
200
188.114.96.3:443
https://bxattlepath.digital/ogda
unknown
binary
37.6 Kb
unknown
POST
400
20.190.160.14:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
POST
400
20.190.160.128:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
POST
400
40.126.32.140:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
POST
400
20.190.160.5:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
POST
400
40.126.32.76:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
POST
200
188.114.96.3:443
https://bxattlepath.digital/ogda
unknown
binary
67 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
192.168.100.255:137
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
2104
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7760
setup.exe
188.114.97.3:443
bxattlepath.digital
CLOUDFLARENET
NL
unknown
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7760
setup.exe
104.21.48.1:443
h1.dentistdomestic.shop
CLOUDFLARENET
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
  • 2.16.164.9
  • 2.16.164.72
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.65
  • 20.190.160.64
  • 20.190.160.20
  • 20.190.160.132
  • 20.190.160.3
  • 20.190.160.4
  • 20.190.160.17
whitelisted
bxattlepath.digital
  • 188.114.97.3
  • 188.114.96.3
unknown
h1.dentistdomestic.shop
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.80.1
  • 104.21.112.1
  • 104.21.16.1
  • 104.21.96.1
  • 104.21.32.1
unknown
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
2320
4SRA40PAT844X82HGPIWXQRDGIQ27.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
No debug info