File name:

setup.exe

Full analysis: https://app.any.run/tasks/e09bb1da-5b98-4300-a31e-6e615615fd07
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:01:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

8F645A473D66C052DA73D51853CB9B12

SHA1:

304A782D244E7D8CE09F945C2EDFC2C384ECAE05

SHA256:

D353F890A6D20E2A2FA0BD5D4FFEE499E2BC6DC187D7B5ABE1F4100F4CAFD64F

SSDEEP:

49152:1SoQ56OG02xDxB0x5bejwJZRvvUZQiqWPgq7WQuAa+sXadJtbmBUen95TkXoLmVw:8ootZ2xr0x5SjwJZZvlkgkWCRsXadJtW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • LUMMA mutex has been found

      • Else.com (PID: 664)

    • Steals credentials from Web Browsers

      • Else.com (PID: 664)

    • Actions looks like stealing of personal data

      • Else.com (PID: 664)

    • AutoIt loader has been detected (YARA)

      • Else.com (PID: 664)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 6488)
      • cmd.exe (PID: 6964)

    • Get information on the list of running processes

      • cmd.exe (PID: 6964)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 6488)

    • Executing commands from a ".bat" file

      • setup.exe (PID: 6488)

    • Application launched itself

      • cmd.exe (PID: 6964)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6964)

    • The executable file from the user directory is run by the CMD process

      • Else.com (PID: 664)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6964)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6964)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 6488)
      • Else.com (PID: 664)

    • Searches for installed software

      • Else.com (PID: 664)

  • INFO

    • Process checks computer location settings

      • setup.exe (PID: 6488)

    • Checks supported languages

      • setup.exe (PID: 6488)
      • extrac32.exe (PID: 3888)
      • Else.com (PID: 664)

    • Create files in a temporary directory

      • setup.exe (PID: 6488)
      • extrac32.exe (PID: 3888)

    • Reads the computer name

      • setup.exe (PID: 6488)
      • extrac32.exe (PID: 3888)
      • Else.com (PID: 664)

    • Creates a new folder

      • cmd.exe (PID: 4988)

    • Reads mouse settings

      • Else.com (PID: 664)

    • Reads the software policy settings

      • Else.com (PID: 664)
      • slui.exe (PID: 744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs sppextcomobj.exe no specs slui.exe tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA else.com choice.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664Else.com B C:\Users\admin\AppData\Local\Temp\799209\Else.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\799209\else.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
744"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1052cmd /c copy /b 799209\Else.com + Rep + Stockholm + Approximately + Departmental + Reload + Ds + Pete + Gained + Quotes + Highway 799209\Else.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1056C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2568tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3888extrac32 /Y /E Del.accdeC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4040findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4688tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4812findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4988cmd /c md 799209C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 661
Read events
1 661
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
20
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6488setup.exeC:\Users\admin\AppData\Local\Temp\Conflicts.accdebinary
MD5:A80A739B63858A80F349361749FAF808
SHA256:09ED136C7F91C8CDD23FB27EFF685BB830B359A0CA89BCD96B924EF7177C54E4
6488setup.exeC:\Users\admin\AppData\Local\Temp\Licenses.accdebinary
MD5:0772BD33AAE4899CDD61C95B46159E47
SHA256:D5F29CACC9664FD9644F8812B38BD7F7A52C02216829CEF7942642D781079689
6488setup.exeC:\Users\admin\AppData\Local\Temp\Commissioners.accdebinary
MD5:C36C367FBF0B0179B4A3B57AC950D5B6
SHA256:85B2D14069D5C538AED56B7A3D6CA518ED91159F032D6AA398E7BE5FDB743407
3888extrac32.exeC:\Users\admin\AppData\Local\Temp\Dsbinary
MD5:EF9F78108BB019E4E7913E53B0E7A26A
SHA256:AE77C2AA60FC98D7A9CE856D5A41B68269C654E4C25DCA703DC1023BA4059ED8
3888extrac32.exeC:\Users\admin\AppData\Local\Temp\Approximatelybinary
MD5:78300C4AAAF7FBAFB54D913CCCAEEF4D
SHA256:FE21B2B41D8DEE6D9FE90919F9D2858F033F2E9334C663756F486D1671825C47
3888extrac32.exeC:\Users\admin\AppData\Local\Temp\Reloadbinary
MD5:38649D9A5D4A3C390EF484A76F6AB972
SHA256:E8663D0A544BD03DF5A74A56994F9B5DDD37780B915EC4BB701F811B4697102E
6488setup.exeC:\Users\admin\AppData\Local\Temp\Mattress.accdebinary
MD5:7AD9636B5AEBDF77D2196B957379762B
SHA256:E8BD495B8FA1DEB2D6839DF6BE70D4043B539C3A8B621BCAF1C8A7F426954822
6488setup.exeC:\Users\admin\AppData\Local\Temp\Internship.accdebinary
MD5:F8F42C65732F81E44B4CD9C14671A21A
SHA256:ADEBA4DDCA4F754661D63A89508B8402114D4C0348F2C3E113EBAF712C97610A
6488setup.exeC:\Users\admin\AppData\Local\Temp\Style.accdebinary
MD5:24CABBE9D10BF8658E923380B2103356
SHA256:CA11194E2A3DAE68B6022A464DFB924B36779CC12D2CEF57607DCDFD33B6D335
6488setup.exeC:\Users\admin\AppData\Local\Temp\Sms.accdebinary
MD5:E86F111579D9601878545AFF3D2B7AC9
SHA256:82C5ED1ECA8B9D2F6DE754B788C515654E49A9A6D60E0FF76463C7BBBD52E0EF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
26
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.58:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4724
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4724
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.58:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
664
Else.com
104.21.64.1:443
nightloqv.run
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.58
  • 2.16.164.10
  • 2.16.164.107
  • 2.16.164.106
  • 2.16.164.130
  • 2.16.164.120
  • 2.16.164.114
  • 2.16.164.82
  • 2.16.164.40
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
hYNdTCpkwhWzrHoRaRS.hYNdTCpkwhWzrHoRaRS
  • —
unknown
login.live.com
  • 20.190.159.131
  • 20.190.159.128
  • 40.126.31.129
  • 20.190.159.2
  • 40.126.31.3
  • 20.190.159.130
  • 20.190.159.4
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
nightloqv.run
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.32.1
  • 104.21.80.1
  • 104.21.16.1
  • 104.21.48.1
  • 104.21.112.1
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe