File name:

880af66f46621859f8330e966419e8cf.exe

Full analysis: https://app.any.run/tasks/7c973347-76e0-467b-be29-79a750e4d26e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: March 25, 2025, 06:48:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
lumma
themida
opendir
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

880AF66F46621859F8330E966419E8CF

SHA1:

CE5975E4ECF122B6463F0468E27511FA0EC3F497

SHA256:

FE9333E5BBE2789F4AC7C4F7D084BAF1E4D38D53C3F11CA56116CC6F6DFC9382

SSDEEP:

98304:q8re2hjEAPzqFmoRsDfgDI+TtqwxfkS2s8VIHALYWfylZoQv9j6mHko+kVv+CRK8:df

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • Steals credentials from Web Browsers

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • LUMMA mutex has been found

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
  • SUSPICIOUS

    • Reads the BIOS version

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • Connects to the server without a host name

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • Process requests binary or script from the Internet

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • Searches for installed software

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
  • INFO

    • Reads the software policy settings

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
      • slui.exe (PID: 7232)
    • Reads the machine GUID from the registry

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • Checks supported languages

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • Reads the computer name

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • Themida protector has been detected

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • Create files in a temporary directory

      • 880af66f46621859f8330e966419e8cf.exe (PID: 7612)
    • Checks proxy server information

      • slui.exe (PID: 7232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:24 12:49:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 315904
InitializedDataSize: 46592
UninitializedDataSize: -
EntryPoint: 0x2fe000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #LUMMA 880af66f46621859f8330e966419e8cf.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7232C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7612"C:\Users\admin\Desktop\880af66f46621859f8330e966419e8cf.exe" C:\Users\admin\Desktop\880af66f46621859f8330e966419e8cf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\880af66f46621859f8330e966419e8cf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
6 797
Read events
6 797
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7612880af66f46621859f8330e966419e8cf.exeC:\Users\admin\AppData\Local\Temp\2M8SY5QGNAY7FPQWRXJAPDLGYOREN.exehtml
MD5:24AB81DDB87A8B942605D6563B131F27
SHA256:3A2712E9DF94DA2A2DF2F89A82087B2E644CFE375A053240FFA633BD358CE4A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
26
DNS requests
6
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
POST
200
104.21.96.1:443
https://wxayfarer.live/ALosnz
unknown
binary
60 b
malicious
POST
200
104.21.64.1:443
https://wxayfarer.live/ALosnz
unknown
binary
60 b
malicious
POST
200
104.21.80.1:443
https://wxayfarer.live/ALosnz
unknown
binary
60 b
malicious
POST
200
104.21.32.1:443
https://wxayfarer.live/ALosnz
unknown
binary
60 b
malicious
POST
200
104.21.80.1:443
https://wxayfarer.live/ALosnz
unknown
binary
32.8 Kb
malicious
POST
200
104.21.112.1:443
https://wxayfarer.live/ALosnz
unknown
binary
60 b
malicious
7612
880af66f46621859f8330e966419e8cf.exe
GET
200
176.113.115.7:80
http://176.113.115.7/mine/random.exe
unknown
malicious
POST
200
104.21.48.1:443
https://wxayfarer.live/ALosnz
unknown
binary
104 b
malicious
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6572
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7612
880af66f46621859f8330e966419e8cf.exe
104.21.48.1:443
wxayfarer.live
CLOUDFLARENET
malicious
2104
svchost.exe
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
whitelisted
7612
880af66f46621859f8330e966419e8cf.exe
176.113.115.7:80
Red Bytes LLC
RU
malicious
7528
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7232
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.78
whitelisted
wxayfarer.live
  • 104.21.48.1
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.112.1
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.80.1
malicious
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.42
  • 23.216.77.6
  • 23.216.77.28
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
7612
880af66f46621859f8330e966419e8cf.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 29
7612
880af66f46621859f8330e966419e8cf.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info