File name:

AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe

Full analysis: https://app.any.run/tasks/f1ae947b-56a7-4d43-a396-5bc56034b492
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 07, 2025, 17:51:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
stealer
lumma
autoit-loader
attachments
attc-unc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

3618028B3F53A9BA8A2979839F590337

SHA1:

7372695E6C4F58C512C48022942199971DEF123A

SHA256:

09614DA3434B6797114BB17928356771A58D82859A1C8D9EBE6D8EC718D5F072

SSDEEP:

49152:tdS4xI40X3YZKjKC/8qRll0f48b1gSM6IgRrhGSJ4IZ8zyo4JDJE7F7PSMNgO+IG:z0HlEqRo/ZgSM634SF8zytNC1qMOO+IG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Doug.com (PID: 2152)

    • Actions looks like stealing of personal data

      • Doug.com (PID: 2152)

    • LUMMA mutex has been found

      • Doug.com (PID: 2152)

    • Steals credentials from Web Browsers

      • Doug.com (PID: 2152)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)
      • cmd.exe (PID: 2236)

    • Reads security settings of Internet Explorer

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)

    • Application launched itself

      • cmd.exe (PID: 2236)

    • Executing commands from a ".bat" file

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2236)

    • The executable file from the user directory is run by the CMD process

      • Doug.com (PID: 2152)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 2236)

    • There is functionality for taking screenshot (YARA)

      • Doug.com (PID: 2152)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Doug.com (PID: 2152)

    • Get information on the list of running processes

      • cmd.exe (PID: 2236)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2236)

  • INFO

    • Checks supported languages

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)
      • expand.exe (PID: 2908)
      • extrac32.exe (PID: 1196)
      • Doug.com (PID: 2152)

    • Reads the computer name

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)
      • extrac32.exe (PID: 1196)
      • Doug.com (PID: 2152)

    • Create files in a temporary directory

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)
      • expand.exe (PID: 2908)
      • extrac32.exe (PID: 1196)

    • Process checks computer location settings

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)

    • Reads mouse settings

      • Doug.com (PID: 2152)

    • Reads the machine GUID from the registry

      • Doug.com (PID: 2152)

    • Reads the software policy settings

      • Doug.com (PID: 2152)
      • slui.exe (PID: 1128)

    • Attempting to use instant messaging service

      • Doug.com (PID: 2152)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 5868)

    • Manual execution by a user

      • OpenWith.exe (PID: 5868)

    • Checks proxy server information

      • slui.exe (PID: 1128)

    • Creates a new folder

      • cmd.exe (PID: 5868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:35+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 3803648
UninitializedDataSize: 2048
EntryPoint: 0x364b
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
18
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start aminecraftmovie2025.1080p.hd.x264.dual.yg.exe no specs cmd.exe no specs conhost.exe no specs expand.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA doug.com choice.exe no specs svchost.exe openwith.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1128C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1196extrac32 /Y /E Rule.docxC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1616cmd /c copy /b 98418\Doug.com + Referred + Expressed + Distributions + Enjoyed + Breath + Substances + Mention + Search + Cum + Occasions 98418\Doug.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2136findstr /V "DESCRIBES" Gentleman C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2152Doug.com g C:\Users\admin\AppData\Local\Temp\98418\Doug.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\98418\doug.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2236"C:\WINDOWS\system32\cmd.exe" /c expand Antonio.docx Antonio.docx.bat & Antonio.docx.batC:\Windows\SysWOW64\cmd.exe—AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2564tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2908expand Antonio.docx Antonio.docx.bat C:\Windows\SysWOW64\expand.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
LZ Expansion Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
7 811
Read events
7 811
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
22
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Fought.docxbinary
MD5:CC4D0D2557AF01BF5B611E206146153A
SHA256:E38C9A9C9F84F965FBA004316C6364A7BA74EF48BB66F31CC74989E6E738DE62
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Rule.docxcompressed
MD5:FC3898384BA27095F2E3FDD37D7AFD5B
SHA256:1219813455371C89D34A8509C0BC7C2EA63C033F39CEDE595C27DAB707C5F7D3
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Nfl.docxbinary
MD5:E3EFF81A543A569E10DAB0502FDC1D6C
SHA256:A45583AA0821815A9ABA4CE241C998FE36979B2B98C24015E5E0EF835E2C1FE6
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Minute.docxbinary
MD5:8F18FC9BDBE722252F0CF9877ADB3480
SHA256:AC815F2707D8F5282434E4F0E4C84464CFA417B97C49A41598D8E353F23CEAF7
1196extrac32.exeC:\Users\admin\AppData\Local\Temp\Cumbinary
MD5:9FE966E5D9DD8B4A6F377B663D5DA7D7
SHA256:3DADE3945250003A003C1E90E8ACB7C1FDB148309466C1A84C71E8C0470640DD
2908expand.exeC:\Users\admin\AppData\Local\Temp\antonio.docx.battext
MD5:0E22EA30428C7D238D36FB2B0B5E3A55
SHA256:B3EC562C8A6BB2DEA0DA9E00FB754575B143706BC1686FF3B769AAB61580CF70
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Bleeding.docxbinary
MD5:43AB8DE23F8528A0BDE5D99F70DEFCFA
SHA256:F3294EEADD3C7DDFD2D4E6EAB4170C693F34117BC65284D1F932BEE45C97DBA5
1196extrac32.exeC:\Users\admin\AppData\Local\Temp\Occasionsbinary
MD5:AD6FEDB8E99947A0B2057B1BD30B88DD
SHA256:F3448D943A1BD39CF6988E0AF849D2AA966493BBCB6AFF34F1B1376B5F78FC8E
1196extrac32.exeC:\Users\admin\AppData\Local\Temp\Enjoyedbinary
MD5:5335EADF78F0E7F515808D296241B875
SHA256:B0E5B34BA16DE0CA676D44C4E83CB4793E4A7D0D4B4FE326B18D5B0AECCC246F
1196extrac32.exeC:\Users\admin\AppData\Local\Temp\Distributionsbinary
MD5:7D2FC66BAAAB04AB51EC15BDC23BFC10
SHA256:17945FA221129E047A67B62FF3A68AB59B7F66E77C4C249E5307FF66C3326BB1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
49
DNS requests
15
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
149.154.167.99:443
https://t.me/bzvrip
unknown
—
—
unknown
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
1164
SIHClient.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
unknown
1164
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
1164
SIHClient.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2152
Doug.com
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
whitelisted
1164
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2152
Doug.com
188.114.97.3:443
compgonentco.top
CLOUDFLARENET
NL
unknown
1164
SIHClient.exe
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1164
SIHClient.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
trOBbIWypqMzohkbZkTpcgQJvNQZ.trOBbIWypqMzohkbZkTpcgQJvNQZ
  • —
unknown
t.me
  • 149.154.167.99
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
compgonentco.top
  • 188.114.97.3
  • 188.114.96.3
unknown
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.10
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2152
Doug.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe