File name:

Minecraft 1.20.1 Alpha.exe

Full analysis: https://app.any.run/tasks/2187af83-8d60-4d53-bb34-b74def5d9f3d
Verdict: Malicious activity
Threats:

DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim.

Malware Trends Tracker     >>>
Analysis date: April 09, 2025, 12:27:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
darkcomet
rat
njrat
delphi
bladabindi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

BE7E715D686C2B6F295D0DC444AED305

SHA1:

9C23BF29BCEF82702E199811AEF4887609C9D7E8

SHA256:

177DEC75821166A12737075A4D800DCADB588C3248823A75A583899748015E62

SSDEEP:

12288:c9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hbJxRY5:wZ1xuVVjfFoynPaVBUR8f+kN10EBVy5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • 2.EXE (PID: 2212)

    • NJRAT has been detected (YARA)

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)
      • 2.EXE (PID: 2212)
      • svchost.exe (PID: 1824)

    • NJRAT mutex has been found

      • 2.EXE (PID: 2212)

    • DARKCOMET has been detected (YARA)

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 1824)

    • NjRAT is detected

      • svchost.exe (PID: 1824)

    • DARKCOMET mutex has been found

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)
      • 1.EXE (PID: 2236)

    • Reads security settings of Internet Explorer

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)
      • 1.EXE (PID: 2236)

    • Executable content was dropped or overwritten

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)
      • 1.EXE (PID: 2236)

    • Connects to unusual port

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)
      • 2.EXE (PID: 2212)
      • svchost.exe (PID: 1824)

    • There is functionality for taking screenshot (YARA)

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)

    • The process creates files with name similar to system file names

      • 1.EXE (PID: 2236)

    • There is functionality for communication over UDP network (YARA)

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)

    • Starts itself from another location

      • 1.EXE (PID: 2236)

    • Uses TASKKILL.EXE to kill process

      • svchost.exe (PID: 1824)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • svchost.exe (PID: 1824)

  • INFO

    • Checks supported languages

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)
      • svchost.exe (PID: 1824)
      • 1.EXE (PID: 2236)
      • 2.EXE (PID: 2212)

    • The sample compiled with english language support

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)

    • Reads the computer name

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)
      • 1.EXE (PID: 2236)
      • svchost.exe (PID: 1824)
      • 2.EXE (PID: 2212)

    • Create files in a temporary directory

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)
      • 1.EXE (PID: 2236)

    • Compiled with Borland Delphi (YARA)

      • Minecraft 1.20.1 Alpha.exe (PID: 2168)

    • Reads the machine GUID from the registry

      • 1.EXE (PID: 2236)
      • svchost.exe (PID: 1824)
      • 2.EXE (PID: 2212)

    • Reads Environment values

      • 2.EXE (PID: 2212)
      • svchost.exe (PID: 1824)

    • Creates files or folders in the user directory

      • 2.EXE (PID: 2212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(2212) 2.EXE
C26.tcp.eu.ngrok.io
Ports15929
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows
Splitter|-F-|
Versionnull
(PID) Process(1824) svchost.exe
C20.tcp.eu.ngrok.io
Ports14882
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\3aa584e6e259e0ee8ac5b5e9136b4b7a
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (37.4)
.scr | Windows screen saver (34.5)
.exe | Win32 Executable (generic) (11.9)
.exe | Win16/32 Executable Delphi generic (5.4)
.exe | Generic Win/DOS Executable (5.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:06:07 15:59:53+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 586752
InitializedDataSize: 281088
UninitializedDataSize: -
EntryPoint: 0x8f888
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.0.0.0
ProductVersionNumber: 4.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Remote Service Application
CompanyName: Microsoft Corp.
FileDescription: Remote Service Application
FileVersion: 1, 0, 0, 1
InternalName: MSRSAAPP
LegalCopyright: Copyright (C) 1999
OriginalFileName: MSRSAAP.EXE
ProductName: Remote Service Application
ProductVersion: 4, 0, 0, 0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DARKCOMET minecraft 1.20.1 alpha.exe 1.exe #NJRAT 2.exe svchost.exe #NJRAT svchost.exe netsh.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLEC:\Windows\System32\netsh.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1824"C:\Users\admin\AppData\Local\Temp\svchost.exe" C:\Users\admin\AppData\Local\Temp\svchost.exe
1.EXE
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(1824) svchost.exe
C20.tcp.eu.ngrok.io
Ports14882
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\3aa584e6e259e0ee8ac5b5e9136b4b7a
Splitter|'|'|
Versionim523
2168"C:\Users\admin\Desktop\Minecraft 1.20.1 Alpha.exe" C:\Users\admin\Desktop\Minecraft 1.20.1 Alpha.exe
explorer.exe
User:
admin
Company:
Microsoft Corp.
Integrity Level:
MEDIUM
Description:
Remote Service Application
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\minecraft 1.20.1 alpha.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2212"C:\Users\admin\AppData\Local\Temp\2.EXE" C:\Users\admin\AppData\Local\Temp\2.EXE
Minecraft 1.20.1 Alpha.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2212) 2.EXE
C26.tcp.eu.ngrok.io
Ports15929
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows
Splitter|-F-|
Versionnull
2236"C:\Users\admin\AppData\Local\Temp\1.EXE" C:\Users\admin\AppData\Local\Temp\1.EXE
Minecraft 1.20.1 Alpha.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2304taskkill /F /IM Exsample.exeC:\Windows\System32\taskkill.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
2 564
Read events
2 455
Write events
109
Delete events
0

Modification events

(PID) Process:(2168) Minecraft 1.20.1 Alpha.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2168) Minecraft 1.20.1 Alpha.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2168) Minecraft 1.20.1 Alpha.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2168) Minecraft 1.20.1 Alpha.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2236) 1.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2236) 1.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2236) 1.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2236) 1.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2212) 2.EXEKey:HKEY_CURRENT_USER\Environment
Operation:writeName:SEE_MASK_NOZONECHECKS
Value:
1
(PID) Process:(1824) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:3aa584e6e259e0ee8ac5b5e9136b4b7a
Value:
"C:\Users\admin\AppData\Local\Temp\svchost.exe" ..
Executable files
3
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
22361.EXEC:\Users\admin\AppData\Local\Temp\svchost.exeexecutable
MD5:6E40D29AE0383EB2097264214D14667B
SHA256:A0CBE2891E5032C1BEA977A789C0382225FD2073ECAC9E12651B5F6E63402468
2168Minecraft 1.20.1 Alpha.exeC:\Users\admin\AppData\Local\Temp\2.EXEexecutable
MD5:160FCFEE2E3801463CFBFAD88E143189
SHA256:18E884DD6A49A69080FBEBB54C4A20FA1A37E50C21C9024369D0AB902C08B3BB
22122.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnkbinary
MD5:0BBF8B5C7BB547288F77898FEBE53999
SHA256:0494B3C5ED0E3D4AE9D8659A8D46DFA4B5D78D8A4287DDFE4AA00CDE2B978FFE
22122.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnkbinary
MD5:EADDF8DD7CEEFFF2DE8B265970ADD314
SHA256:8920494EA918C0D1D4CA61C94211ECC84F7504D1C6310E85A1F1942E52452218
2168Minecraft 1.20.1 Alpha.exeC:\Users\admin\AppData\Local\Temp\1.EXEexecutable
MD5:6E40D29AE0383EB2097264214D14667B
SHA256:A0CBE2891E5032C1BEA977A789C0382225FD2073ECAC9E12651B5F6E63402468
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
96
DNS requests
4
Threats
5

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2168
Minecraft 1.20.1 Alpha.exe
147.185.221.211:24677
association-secondary.at.ply.gg
PLAYIT-GG
US
malicious
2212
2.EXE
3.66.38.117:15929
6.tcp.eu.ngrok.io
AMAZON-02
DE
malicious
1824
svchost.exe
18.153.198.123:14882
0.tcp.eu.ngrok.io
AMAZON-02
DE
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.110
whitelisted
association-secondary.at.ply.gg
  • 147.185.221.211
malicious
6.tcp.eu.ngrok.io
  • 3.66.38.117
malicious
0.tcp.eu.ngrok.io
  • 18.153.198.123
malicious

Threats

PID
Process
Class
Message
1080
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
1080
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
1080
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
1080
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
1080
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Minecraft 1.20.1 Alpha.exe