File name:

setup.exe

Full analysis: https://app.any.run/tasks/e09bb1da-5b98-4300-a31e-6e615615fd07
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:01:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

8F645A473D66C052DA73D51853CB9B12

SHA1:

304A782D244E7D8CE09F945C2EDFC2C384ECAE05

SHA256:

D353F890A6D20E2A2FA0BD5D4FFEE499E2BC6DC187D7B5ABE1F4100F4CAFD64F

SSDEEP:

49152:1SoQ56OG02xDxB0x5bejwJZRvvUZQiqWPgq7WQuAa+sXadJtbmBUen95TkXoLmVw:8ootZ2xr0x5SjwJZZvlkgkWCRsXadJtW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Else.com (PID: 664)

    • Steals credentials from Web Browsers

      • Else.com (PID: 664)

    • Actions looks like stealing of personal data

      • Else.com (PID: 664)

    • AutoIt loader has been detected (YARA)

      • Else.com (PID: 664)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 6488)

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 6488)
      • cmd.exe (PID: 6964)

    • Executing commands from a ".bat" file

      • setup.exe (PID: 6488)

    • Get information on the list of running processes

      • cmd.exe (PID: 6964)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6964)

    • Application launched itself

      • cmd.exe (PID: 6964)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6964)

    • The executable file from the user directory is run by the CMD process

      • Else.com (PID: 664)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6964)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 6488)
      • Else.com (PID: 664)

    • Searches for installed software

      • Else.com (PID: 664)

  • INFO

    • Create files in a temporary directory

      • setup.exe (PID: 6488)
      • extrac32.exe (PID: 3888)

    • Reads the computer name

      • setup.exe (PID: 6488)
      • extrac32.exe (PID: 3888)
      • Else.com (PID: 664)

    • Checks supported languages

      • setup.exe (PID: 6488)
      • extrac32.exe (PID: 3888)
      • Else.com (PID: 664)

    • Process checks computer location settings

      • setup.exe (PID: 6488)

    • Creates a new folder

      • cmd.exe (PID: 4988)

    • Reads mouse settings

      • Else.com (PID: 664)

    • Reads the software policy settings

      • Else.com (PID: 664)
      • slui.exe (PID: 744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs sppextcomobj.exe no specs slui.exe tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA else.com choice.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664Else.com B C:\Users\admin\AppData\Local\Temp\799209\Else.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\799209\else.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
744"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1052cmd /c copy /b 799209\Else.com + Rep + Stockholm + Approximately + Departmental + Reload + Ds + Pete + Gained + Quotes + Highway 799209\Else.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1056C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2568tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3888extrac32 /Y /E Del.accdeC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4040findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4688tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4812findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4988cmd /c md 799209C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 661
Read events
1 661
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
20
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6488setup.exeC:\Users\admin\AppData\Local\Temp\Conflicts.accdebinary
MD5:A80A739B63858A80F349361749FAF808
SHA256:09ED136C7F91C8CDD23FB27EFF685BB830B359A0CA89BCD96B924EF7177C54E4
6488setup.exeC:\Users\admin\AppData\Local\Temp\Commissioners.accdebinary
MD5:C36C367FBF0B0179B4A3B57AC950D5B6
SHA256:85B2D14069D5C538AED56B7A3D6CA518ED91159F032D6AA398E7BE5FDB743407
3888extrac32.exeC:\Users\admin\AppData\Local\Temp\Gainedbinary
MD5:EB1514724CF8D99002725787E50EABAF
SHA256:98C0002161D3B6EEEC7C98F28CB681C269E794888A02E8E394B6179F0F1876B1
6488setup.exeC:\Users\admin\AppData\Local\Temp\Aid.accdetext
MD5:AF3255F9AB439BBA19204E0FD7AB2D52
SHA256:B596ABC8238F660B9F0ACE0E68849955A641DA4065F47A0B8301345D58FA40A7
3888extrac32.exeC:\Users\admin\AppData\Local\Temp\Dictionariesbinary
MD5:198B16F8D4ABE8F52302967A9EE5A796
SHA256:D508928AFF9612C65400B243D3E07B18A457E9D8A250BD5ABE2B658CEB471921
3888extrac32.exeC:\Users\admin\AppData\Local\Temp\Reloadbinary
MD5:38649D9A5D4A3C390EF484A76F6AB972
SHA256:E8663D0A544BD03DF5A74A56994F9B5DDD37780B915EC4BB701F811B4697102E
6488setup.exeC:\Users\admin\AppData\Local\Temp\Style.accdebinary
MD5:24CABBE9D10BF8658E923380B2103356
SHA256:CA11194E2A3DAE68B6022A464DFB924B36779CC12D2CEF57607DCDFD33B6D335
6488setup.exeC:\Users\admin\AppData\Local\Temp\Del.accdecompressed
MD5:43162F0F70CC457A744473973D6507AA
SHA256:2A7922F95D2E0325080A848A157D718BEBF5C5006E27D868EE4478DF0C93D978
6964cmd.exeC:\Users\admin\AppData\Local\Temp\Aid.accde.battext
MD5:AF3255F9AB439BBA19204E0FD7AB2D52
SHA256:B596ABC8238F660B9F0ACE0E68849955A641DA4065F47A0B8301345D58FA40A7
6488setup.exeC:\Users\admin\AppData\Local\Temp\Mattress.accdebinary
MD5:7AD9636B5AEBDF77D2196B957379762B
SHA256:E8BD495B8FA1DEB2D6839DF6BE70D4043B539C3A8B621BCAF1C8A7F426954822
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.58:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4724
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4724
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.58:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
664
Else.com
104.21.64.1:443
nightloqv.run
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.58
  • 2.16.164.10
  • 2.16.164.107
  • 2.16.164.106
  • 2.16.164.130
  • 2.16.164.120
  • 2.16.164.114
  • 2.16.164.82
  • 2.16.164.40
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
hYNdTCpkwhWzrHoRaRS.hYNdTCpkwhWzrHoRaRS
  • —
unknown
login.live.com
  • 20.190.159.131
  • 20.190.159.128
  • 40.126.31.129
  • 20.190.159.2
  • 40.126.31.3
  • 20.190.159.130
  • 20.190.159.4
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
nightloqv.run
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.32.1
  • 104.21.80.1
  • 104.21.16.1
  • 104.21.48.1
  • 104.21.112.1
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe