File name:

AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe

Full analysis: https://app.any.run/tasks/f1ae947b-56a7-4d43-a396-5bc56034b492
Verdict: Malicious activity
Threats:

Lumma is an information stealer, developed using the C programming language. It is offered for sale as a malware-as-a-service, with several plans available. It usually targets cryptocurrency wallets, login credentials, and other sensitive information on a compromised system. The malicious software regularly gets updates that improve and expand its functionality, making it a serious stealer threat.

Malware Trends Tracker     >>>
Analysis date: April 07, 2025, 17:51:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
stealer
lumma
autoit-loader
attachments
attc-unc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

3618028B3F53A9BA8A2979839F590337

SHA1:

7372695E6C4F58C512C48022942199971DEF123A

SHA256:

09614DA3434B6797114BB17928356771A58D82859A1C8D9EBE6D8EC718D5F072

SSDEEP:

49152:tdS4xI40X3YZKjKC/8qRll0f48b1gSM6IgRrhGSJ4IZ8zyo4JDJE7F7PSMNgO+IG:z0HlEqRo/ZgSM634SF8zytNC1qMOO+IG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Doug.com (PID: 2152)

    • LUMMA mutex has been found

      • Doug.com (PID: 2152)

    • Actions looks like stealing of personal data

      • Doug.com (PID: 2152)

    • Steals credentials from Web Browsers

      • Doug.com (PID: 2152)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)

    • Executing commands from a ".bat" file

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)

    • Starts CMD.EXE for commands execution

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)
      • cmd.exe (PID: 2236)

    • Get information on the list of running processes

      • cmd.exe (PID: 2236)

    • Application launched itself

      • cmd.exe (PID: 2236)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2236)

    • The executable file from the user directory is run by the CMD process

      • Doug.com (PID: 2152)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2236)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 2236)

    • There is functionality for taking screenshot (YARA)

      • Doug.com (PID: 2152)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Doug.com (PID: 2152)

  • INFO

    • Create files in a temporary directory

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)
      • expand.exe (PID: 2908)
      • extrac32.exe (PID: 1196)

    • Reads the computer name

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)
      • extrac32.exe (PID: 1196)
      • Doug.com (PID: 2152)

    • Checks supported languages

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)
      • expand.exe (PID: 2908)
      • extrac32.exe (PID: 1196)
      • Doug.com (PID: 2152)

    • Process checks computer location settings

      • AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe (PID: 5864)

    • Creates a new folder

      • cmd.exe (PID: 5868)

    • Reads the machine GUID from the registry

      • Doug.com (PID: 2152)

    • Reads the software policy settings

      • Doug.com (PID: 2152)
      • slui.exe (PID: 1128)

    • Manual execution by a user

      • OpenWith.exe (PID: 5868)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 5868)

    • Checks proxy server information

      • slui.exe (PID: 1128)

    • Reads mouse settings

      • Doug.com (PID: 2152)

    • Attempting to use instant messaging service

      • Doug.com (PID: 2152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:35+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 27136
InitializedDataSize: 3803648
UninitializedDataSize: 2048
EntryPoint: 0x364b
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
18
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start aminecraftmovie2025.1080p.hd.x264.dual.yg.exe no specs cmd.exe no specs conhost.exe no specs expand.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA doug.com choice.exe no specs svchost.exe openwith.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1128C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1196extrac32 /Y /E Rule.docxC:\Windows\SysWOW64\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1616cmd /c copy /b 98418\Doug.com + Referred + Expressed + Distributions + Enjoyed + Breath + Substances + Mention + Search + Cum + Occasions 98418\Doug.comC:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2136findstr /V "DESCRIBES" Gentleman C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2152Doug.com g C:\Users\admin\AppData\Local\Temp\98418\Doug.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\98418\doug.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2236"C:\WINDOWS\system32\cmd.exe" /c expand Antonio.docx Antonio.docx.bat & Antonio.docx.batC:\Windows\SysWOW64\cmd.exe—AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2564tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2908expand Antonio.docx Antonio.docx.bat C:\Windows\SysWOW64\expand.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
LZ Expansion Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
7 811
Read events
7 811
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
22
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Plastics.docxbinary
MD5:E4AA1FB21BACD59D914C30B66E3EBBC3
SHA256:C8E11D4F34B19022C8978771CAA98C9FD89DDD573A1AA6A01A6E89E321246959
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Coming.docxbinary
MD5:1DF6FDF470299F09F216C8802FE782C3
SHA256:DFF12E765DF6212D79FCFEFDD7F2A4C650CB596E4E54213BF2EAA4B377EBEACF
2908expand.exeC:\Users\admin\AppData\Local\Temp\antonio.docx.battext
MD5:0E22EA30428C7D238D36FB2B0B5E3A55
SHA256:B3EC562C8A6BB2DEA0DA9E00FB754575B143706BC1686FF3B769AAB61580CF70
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Minute.docxbinary
MD5:8F18FC9BDBE722252F0CF9877ADB3480
SHA256:AC815F2707D8F5282434E4F0E4C84464CFA417B97C49A41598D8E353F23CEAF7
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Fx.docxbinary
MD5:E9E82F0F3CA5CB74136E82AA1DA059BD
SHA256:9389E22E1BF3342B34C2EF4634F94EB6B50E34936FF4BB067AE01207B5B207F6
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\nssC9CB.tmpbinary
MD5:183339765B784CD42615B7339E9569E5
SHA256:C9E97F4D2152086AFAEA4AEEB663076E3361D600740807A3A91394EED3E73F5A
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Penny.docxbinary
MD5:A38272C8639E1482D5BE2DB20B1C76B7
SHA256:063E43A4BA55D4DD84CC9B07AA71BBA73C919B163C7102AA64C88DF1338E9DE2
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Bleeding.docxbinary
MD5:43AB8DE23F8528A0BDE5D99F70DEFCFA
SHA256:F3294EEADD3C7DDFD2D4E6EAB4170C693F34117BC65284D1F932BEE45C97DBA5
1196extrac32.exeC:\Users\admin\AppData\Local\Temp\Occasionsbinary
MD5:AD6FEDB8E99947A0B2057B1BD30B88DD
SHA256:F3448D943A1BD39CF6988E0AF849D2AA966493BBCB6AFF34F1B1376B5F78FC8E
5864AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exeC:\Users\admin\AppData\Local\Temp\Fought.docxbinary
MD5:CC4D0D2557AF01BF5B611E206146153A
SHA256:E38C9A9C9F84F965FBA004316C6364A7BA74EF48BB66F31CC74989E6E738DE62
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
49
DNS requests
15
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
149.154.167.99:443
https://t.me/bzvrip
unknown
—
—
—
—
—
GET
304
4.175.87.197:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
1164
SIHClient.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
1164
SIHClient.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2152
Doug.com
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
whitelisted
1164
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2152
Doug.com
188.114.97.3:443
compgonentco.top
CLOUDFLARENET
NL
unknown
1164
SIHClient.exe
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1164
SIHClient.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
trOBbIWypqMzohkbZkTpcgQJvNQZ.trOBbIWypqMzohkbZkTpcgQJvNQZ
  • —
unknown
t.me
  • 149.154.167.99
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
compgonentco.top
  • 188.114.97.3
  • 188.114.96.3
unknown
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.10
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2152
Doug.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AMinecraftMovie2025.1080p.HD.X264.Dual.YG.exe