File name:

setup.exe

Full analysis: https://app.any.run/tasks/e09bb1da-5b98-4300-a31e-6e615615fd07
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:01:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

8F645A473D66C052DA73D51853CB9B12

SHA1:

304A782D244E7D8CE09F945C2EDFC2C384ECAE05

SHA256:

D353F890A6D20E2A2FA0BD5D4FFEE499E2BC6DC187D7B5ABE1F4100F4CAFD64F

SSDEEP:

49152:1SoQ56OG02xDxB0x5bejwJZRvvUZQiqWPgq7WQuAa+sXadJtbmBUen95TkXoLmVw:8ootZ2xr0x5SjwJZZvlkgkWCRsXadJtW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • Else.com (PID: 664)

    • LUMMA mutex has been found

      • Else.com (PID: 664)

    • Actions looks like stealing of personal data

      • Else.com (PID: 664)

    • AutoIt loader has been detected (YARA)

      • Else.com (PID: 664)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • cmd.exe (PID: 6964)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 6488)

    • Executing commands from a ".bat" file

      • setup.exe (PID: 6488)

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 6488)
      • cmd.exe (PID: 6964)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6964)

    • Get information on the list of running processes

      • cmd.exe (PID: 6964)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 6488)
      • Else.com (PID: 664)

    • Searches for installed software

      • Else.com (PID: 664)

    • The executable file from the user directory is run by the CMD process

      • Else.com (PID: 664)

    • Application launched itself

      • cmd.exe (PID: 6964)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6964)

  • INFO

    • Create files in a temporary directory

      • setup.exe (PID: 6488)
      • extrac32.exe (PID: 3888)

    • Reads the computer name

      • setup.exe (PID: 6488)
      • extrac32.exe (PID: 3888)
      • Else.com (PID: 664)

    • Process checks computer location settings

      • setup.exe (PID: 6488)

    • Checks supported languages

      • setup.exe (PID: 6488)
      • extrac32.exe (PID: 3888)
      • Else.com (PID: 664)

    • Creates a new folder

      • cmd.exe (PID: 4988)

    • Reads the software policy settings

      • Else.com (PID: 664)
      • slui.exe (PID: 744)

    • Reads mouse settings

      • Else.com (PID: 664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs sppextcomobj.exe no specs slui.exe tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA else.com choice.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664Else.com B C:\Users\admin\AppData\Local\Temp\799209\Else.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\799209\else.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
744"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1052cmd /c copy /b 799209\Else.com + Rep + Stockholm + Approximately + Departmental + Reload + Ds + Pete + Gained + Quotes + Highway 799209\Else.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1056C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2568tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3888extrac32 /Y /E Del.accdeC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4040findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4688tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4812findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4988cmd /c md 799209C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 661
Read events
1 661
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
20
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6488setup.exeC:\Users\admin\AppData\Local\Temp\Aid.accdetext
MD5:AF3255F9AB439BBA19204E0FD7AB2D52
SHA256:B596ABC8238F660B9F0ACE0E68849955A641DA4065F47A0B8301345D58FA40A7
6488setup.exeC:\Users\admin\AppData\Local\Temp\Commissioners.accdebinary
MD5:C36C367FBF0B0179B4A3B57AC950D5B6
SHA256:8C9591C0D226627B4FA21F4E9DEC1188F4501BB17D3C76953B146ABB92FF6385
6488setup.exeC:\Users\admin\AppData\Local\Temp\Del.accdecompressed
MD5:43162F0F70CC457A744473973D6507AA
SHA256:AAE36FD1852050D6F3ADD181481026C4E29D1B54B7DD6297BEA8C03C185E4796
3888extrac32.exeC:\Users\admin\AppData\Local\Temp\Approximatelybinary
MD5:78300C4AAAF7FBAFB54D913CCCAEEF4D
SHA256:95C6E6EB4E1FE87F8678945314BB1FC655AFE679A801A62F2D7845CD4D2A6F6A
6488setup.exeC:\Users\admin\AppData\Local\Temp\Licenses.accdebinary
MD5:0772BD33AAE4899CDD61C95B46159E47
SHA256:FDE333C20198B8E563AFC28E6F0757EBAED6B2056C4DA18747E88263D63A47D3
6488setup.exeC:\Users\admin\AppData\Local\Temp\Mattress.accdebinary
MD5:7AD9636B5AEBDF77D2196B957379762B
SHA256:D15F7514E5CB64B1CB063CFF02646FF2BF666BF0022FCC56BEE00C01387F5964
6964cmd.exeC:\Users\admin\AppData\Local\Temp\Aid.accde.battext
MD5:AF3255F9AB439BBA19204E0FD7AB2D52
SHA256:B596ABC8238F660B9F0ACE0E68849955A641DA4065F47A0B8301345D58FA40A7
3888extrac32.exeC:\Users\admin\AppData\Local\Temp\Dsbinary
MD5:EF9F78108BB019E4E7913E53B0E7A26A
SHA256:5E3B42AECC6ADD8D5E955EF129DD07BDE184B74DB71EF5670DA11D42285AA519
6488setup.exeC:\Users\admin\AppData\Local\Temp\Internship.accdebinary
MD5:F8F42C65732F81E44B4CD9C14671A21A
SHA256:AE1361CFFFB050271FE6465F62D16B831979BB89FCF03C6FA4800F3135EB8C08
3888extrac32.exeC:\Users\admin\AppData\Local\Temp\Departmentalbinary
MD5:4E517AA754A70F4BC4008F28DCADCF1F
SHA256:D10D847ACFE4E96BCFC6F184A48237A5DF3BE76F9532A132F354456B0E2E37E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.58:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4724
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4724
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.58:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
664
Else.com
104.21.64.1:443
nightloqv.run
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.58
  • 2.16.164.10
  • 2.16.164.107
  • 2.16.164.106
  • 2.16.164.130
  • 2.16.164.120
  • 2.16.164.114
  • 2.16.164.82
  • 2.16.164.40
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
hYNdTCpkwhWzrHoRaRS.hYNdTCpkwhWzrHoRaRS
  • —
unknown
login.live.com
  • 20.190.159.131
  • 20.190.159.128
  • 40.126.31.129
  • 20.190.159.2
  • 40.126.31.3
  • 20.190.159.130
  • 20.190.159.4
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
nightloqv.run
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.32.1
  • 104.21.80.1
  • 104.21.16.1
  • 104.21.48.1
  • 104.21.112.1
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe