File name:

SecuriteInfo.com.Win32.Malware-gen.13144.21016

Full analysis: https://app.any.run/tasks/2b82a034-240b-4f38-9d59-729adeb0f2be
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 04, 2025, 07:10:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
stealer
lumma
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

4641A0BEC2101C82F575862F97BE861C

SHA1:

0DD1EE06CDB7BA9EF2AA1DC44C80F1BC2586D33B

SHA256:

FC2AC17498BD7846607110E66426BDAD0AB5302F5C7978DD72C20D99166292E1

SSDEEP:

49152:jmBLhdzYN/vP5IQ4jzx1lbzqWnPIZ39qg5bpEZxBmcEs3D/8mQoNbVR/n6vfXSj+:jIhdzsX54j3xzPnPSb6sY/VQoJVR/6vB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Jordan.com (PID: 7876)

    • Actions looks like stealing of personal data

      • Jordan.com (PID: 7876)

    • Steals credentials from Web Browsers

      • Jordan.com (PID: 7876)

    • LUMMA mutex has been found

      • Jordan.com (PID: 7876)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe (PID: 7344)

    • Application launched itself

      • cmd.exe (PID: 7384)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7384)

    • The executable file from the user directory is run by the CMD process

      • Jordan.com (PID: 7876)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7384)
      • SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe (PID: 7344)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7384)

    • There is functionality for taking screenshot (YARA)

      • Jordan.com (PID: 7876)

    • Searches for installed software

      • Jordan.com (PID: 7876)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Jordan.com (PID: 7876)

    • Executing commands from a ".bat" file

      • SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe (PID: 7344)

    • Get information on the list of running processes

      • cmd.exe (PID: 7384)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7384)

  • INFO

    • Create files in a temporary directory

      • SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe (PID: 7344)
      • extrac32.exe (PID: 7760)

    • Checks supported languages

      • SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe (PID: 7344)
      • Jordan.com (PID: 7876)
      • extrac32.exe (PID: 7760)

    • Reads the computer name

      • SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe (PID: 7344)
      • Jordan.com (PID: 7876)
      • extrac32.exe (PID: 7760)

    • Reads mouse settings

      • Jordan.com (PID: 7876)

    • Reads the software policy settings

      • Jordan.com (PID: 7876)
      • slui.exe (PID: 7676)

    • Creates a new folder

      • cmd.exe (PID: 7700)

    • Attempting to use instant messaging service

      • Jordan.com (PID: 7876)

    • Process checks computer location settings

      • SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe (PID: 7344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:06+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 4094976
UninitializedDataSize: 16896
EntryPoint: 0x33ff
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.win32.malware-gen.13144.21016.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA jordan.com choice.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4488C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7344"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win32.malware-gen.13144.21016.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7384"C:\WINDOWS\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.batC:\Windows\SysWOW64\cmd.exe—SecuriteInfo.com.Win32.Malware-gen.13144.21016.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7392\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7468tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7476findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7584tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7592findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7640C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7676"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 644
Read events
1 644
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
19
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7344SecuriteInfo.com.Win32.Malware-gen.13144.21016.exeC:\Users\admin\AppData\Local\Temp\Nonprofit.psdbinary
MD5:B7F71B0089736EED230DEB70344855D6
SHA256:48DBBABFF94BCE7659BAB2989B43DF8E1315D38B3A7853A518AAB25B9CF3F75F
7344SecuriteInfo.com.Win32.Malware-gen.13144.21016.exeC:\Users\admin\AppData\Local\Temp\Feel.psdbinary
MD5:B379695029DF2C12418DBD3669AD764A
SHA256:3EA1526911EE558BF646CFFE6B80C1223A95C893FBFBFD57B3A525D6F776192A
7344SecuriteInfo.com.Win32.Malware-gen.13144.21016.exeC:\Users\admin\AppData\Local\Temp\Permits.psdbinary
MD5:D317B9294CB5CEA60B48514E9CEDA28D
SHA256:30DDAFF54F671433966349A3A53030001754904CE3A1EFE95B0C958EE91B94AD
7344SecuriteInfo.com.Win32.Malware-gen.13144.21016.exeC:\Users\admin\AppData\Local\Temp\Cattle.psdtext
MD5:EC90ED340E87D540B3B2BFD46026424C
SHA256:80F117D62A42A9C74EFB37E180CC85796F56E3EEDC76C5B8962837FB964F32E0
7344SecuriteInfo.com.Win32.Malware-gen.13144.21016.exeC:\Users\admin\AppData\Local\Temp\Exclusion.psdcompressed
MD5:C060E65E9690C04CEF69A90CD64372B3
SHA256:8E03B1FBE09CBF5CB67A2C7638CD4EA98B1968438110E174AE3630656ADD7D2A
7344SecuriteInfo.com.Win32.Malware-gen.13144.21016.exeC:\Users\admin\AppData\Local\Temp\Customized.psdbinary
MD5:F8BA042977BD625897697D587BE3894B
SHA256:F3C194D85905BEB2E0F6177307BDC53A50C9B95D8C1168A54C27578EE87E6B09
7344SecuriteInfo.com.Win32.Malware-gen.13144.21016.exeC:\Users\admin\AppData\Local\Temp\Shoes.psdbinary
MD5:96C1576EA852A5E67ED19CD7AA36A96F
SHA256:7FD3F98ED83C81F1CED2C52E89B7A787FFECA8C97984BF3CCD456DCE9A7C281F
7384cmd.exeC:\Users\admin\AppData\Local\Temp\Cattle.psd.battext
MD5:EC90ED340E87D540B3B2BFD46026424C
SHA256:80F117D62A42A9C74EFB37E180CC85796F56E3EEDC76C5B8962837FB964F32E0
7760extrac32.exeC:\Users\admin\AppData\Local\Temp\Deadbinary
MD5:05B3413918E544D277F5FF851619E280
SHA256:3704413CDA5DEC53140B9FB21DF828A32C4EB874E8A34BFAC32B1468EA1F7202
7760extrac32.exeC:\Users\admin\AppData\Local\Temp\Pushedbinary
MD5:C5C384CE07970E9FFA5CD5961D08BDC7
SHA256:469845E7267AE3538A946B9A3CE559D13DB80ED83EAA88D1585837E2AABEB08B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
25
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7408
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7408
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7408
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7408
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.72
  • 2.16.164.120
whitelisted
YrOjuzxSQpdrqVJKAQhkZpRwO.YrOjuzxSQpdrqVJKAQhkZpRwO
  • —
unknown
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.73
  • 40.126.31.2
  • 40.126.31.128
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.131
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
7876
Jordan.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Win32.Malware-gen.13144.21016