File name:

Minebot.rar

Full analysis: https://app.any.run/tasks/a4c46242-02a4-46a2-9f7f-7c652926e669
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: March 04, 2020, 21:53:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
orcus
loader
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E4785A322C00E5B4A118F82086ECE480

SHA1:

7D70BDEDB4303194451DB68CF18E4091F10DFB07

SHA256:

28D5FE5F4EFE347B724BBFA089D0B045CC2EF0EEA870000D3998F0E0AA8E5DA6

SSDEEP:

98304:c7n5C1xlG1C7wzEtZfZU4v1XR08hpWP5+XaIqCf78BUpTayxO/Ky:c7ncxGYhtZm4f0WWxOTf7rp2yx+Ky

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • OQ.MineBot.GUI.exe (PID: 3564)
    • Application was dropped or rewritten from another process

      • OQ.MineBot.GUI.exe (PID: 3564)
      • minebot.ggexploit.exe (PID: 3372)
      • run.exe (PID: 1932)
      • crasher.exe (PID: 2220)
      • jscript.exe (PID: 3808)
      • jscript.exe (PID: 968)
      • svchost32.exe (PID: 3736)
      • svchost32.exe (PID: 2380)
      • jscript.exe (PID: 2556)
      • jscript.exe (PID: 2588)
      • svchost32.exe (PID: 3552)
      • svchost32.exe (PID: 1468)
    • ORCUS was detected

      • crasher.exe (PID: 2220)
      • jscript.exe (PID: 3808)
      • jscript.exe (PID: 968)
      • svchost32.exe (PID: 2380)
      • jscript.exe (PID: 2556)
      • jscript.exe (PID: 2588)
      • svchost32.exe (PID: 3552)
    • Downloads executable files from the Internet

      • OQ.MineBot.GUI.exe (PID: 3564)
    • Changes the autorun value in the registry

      • jscript.exe (PID: 3808)
      • jscript.exe (PID: 2556)
    • Downloads executable files from IP

      • OQ.MineBot.GUI.exe (PID: 3564)
    • Loads the Task Scheduler COM API

      • jscript.exe (PID: 3808)
      • jscript.exe (PID: 2556)
    • Actions looks like stealing of personal data

      • jscript.exe (PID: 2556)
    • Changes settings of System certificates

      • jscript.exe (PID: 2556)
      • OQ.MineBot.GUI.exe (PID: 3564)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3768)
      • minebot.ggexploit.exe (PID: 3372)
      • run.exe (PID: 1932)
      • OQ.MineBot.GUI.exe (PID: 3564)
      • crasher.exe (PID: 2220)
      • jscript.exe (PID: 3808)
      • jscript.exe (PID: 2556)
    • Reads Environment values

      • OQ.MineBot.GUI.exe (PID: 3564)
      • jscript.exe (PID: 3808)
      • jscript.exe (PID: 2556)
    • Connects to unusual port

      • OQ.MineBot.GUI.exe (PID: 3564)
      • jscript.exe (PID: 3808)
      • jscript.exe (PID: 2556)
    • Starts CMD.EXE for commands execution

      • minebot.ggexploit.exe (PID: 3372)
    • Creates files in the user directory

      • OQ.MineBot.GUI.exe (PID: 3564)
      • jscript.exe (PID: 3808)
      • jscript.exe (PID: 2556)
    • Starts itself from another location

      • crasher.exe (PID: 2220)
    • Executed via Task Scheduler

      • jscript.exe (PID: 968)
      • jscript.exe (PID: 2588)
    • Application launched itself

      • jscript.exe (PID: 3808)
      • svchost32.exe (PID: 2380)
    • Reads the cookies of Google Chrome

      • jscript.exe (PID: 2556)
    • Reads the cookies of Mozilla Firefox

      • jscript.exe (PID: 2556)
    • Adds / modifies Windows certificates

      • OQ.MineBot.GUI.exe (PID: 3564)
  • INFO

    • Reads settings of System Certificates

      • OQ.MineBot.GUI.exe (PID: 3564)
      • jscript.exe (PID: 3808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
14
Malicious processes
14
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start winrar.exe oq.minebot.gui.exe minebot.ggexploit.exe cmd.exe no specs run.exe #ORCUS crasher.exe #ORCUS jscript.exe #ORCUS jscript.exe no specs #ORCUS svchost32.exe no specs svchost32.exe no specs #ORCUS jscript.exe #ORCUS jscript.exe no specs #ORCUS svchost32.exe no specs svchost32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
968C:\Users\admin\.temp\Microsoft\Edge\js\jscript.exe C:\Users\admin\.temp\Microsoft\Edge\js\jscript.exe
taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\.temp\microsoft\edge\js\jscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1468"C:\Users\admin\AppData\Roaming\svchost32.exe" /watchProcess "C:\Users\admin\.temp\Microsoft\Edge\js\jscript.exe" 2556 "/protectFile"C:\Users\admin\AppData\Roaming\svchost32.exesvchost32.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1932run.exe -p0110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101011010011010101010110100110101010101101001101010101C:\Users\admin\AppData\Local\Temp\RarSFX0\run.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\run.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2220"C:\Users\admin\AppData\Local\Temp\RarSFX1\crasher.exe" C:\Users\admin\AppData\Local\Temp\RarSFX1\crasher.exe
run.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\crasher.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2380"C:\Users\admin\AppData\Roaming\svchost32.exe" /launchSelfAndExit "C:\Users\admin\.temp\Microsoft\Edge\js\jscript.exe" 3808 /protectFileC:\Users\admin\AppData\Roaming\svchost32.exe
jscript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3736
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2556"C:\Users\admin\.temp\Microsoft\Edge\js\jscript.exe" /waitC:\Users\admin\.temp\Microsoft\Edge\js\jscript.exe
jscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\.temp\microsoft\edge\js\jscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2588C:\Users\admin\.temp\Microsoft\Edge\js\jscript.exe C:\Users\admin\.temp\Microsoft\Edge\js\jscript.exe
taskeng.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\.temp\microsoft\edge\js\jscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3372"C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\minebot.ggexploit.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\minebot.ggexploit.exe
OQ.MineBot.GUI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3768.35858\minebot.ggexploit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3552"C:\Users\admin\AppData\Roaming\svchost32.exe" /launchSelfAndExit "C:\Users\admin\.temp\Microsoft\Edge\js\jscript.exe" 2556 /protectFileC:\Users\admin\AppData\Roaming\svchost32.exe
jscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1468
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3564"C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\OQ.MineBot.GUI.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\OQ.MineBot.GUI.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
OQ.MineBot
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3768.35858\oq.minebot.gui.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 296
Read events
3 592
Write events
2 517
Delete events
1 187

Modification events

(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3768) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Minebot.rar
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3768) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
25
Suspicious files
26
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\OQ.MineBot.GUI.exeexecutable
MD5:
SHA256:
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\plugin_license.PLLbinary
MD5:
SHA256:
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\OQ.MineBot.PluginBase.dllexecutable
MD5:
SHA256:
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\plugins\Chatbot.dllbinary
MD5:
SHA256:
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\plugins\Aurora.dllbinary
MD5:
SHA256:
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\plugins\New Server Crasher .dllbinary
MD5:
SHA256:
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\NCalc.dllexecutable
MD5:8FE3C9B031FB8F581014046C1ABEEFDA
SHA256:7F48487D0FEDBFD70C00293C6C1559BD17CEFC0CBE6F08AE8F089096BA8847CE
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\plugins\KnockBack.dllbinary
MD5:
SHA256:
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\plugins\OQ.Anti Cheat Compliance.dllbinary
MD5:
SHA256:
3768WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3768.35858\Newtonsoft.Json.dllexecutable
MD5:A94583EE47F673118B0BF822BF8E425D
SHA256:030E739CBA60C3B4604EE1574497AEBC892B7CEB0CE44DD39FD1EF7767A2F134
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
9
DNS requests
2
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2556
jscript.exe
GET
304
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
whitelisted
3564
OQ.MineBot.GUI.exe
GET
200
45.88.110.217:80
http://45.88.110.217/crasher.exe
unknown
executable
1.00 Mb
suspicious
3808
jscript.exe
GET
304
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
whitelisted
3564
OQ.MineBot.GUI.exe
GET
304
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.7 Kb
whitelisted
3564
OQ.MineBot.GUI.exe
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.7 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3564
OQ.MineBot.GUI.exe
144.217.162.188:49248
app.host.minecraftbot.com
OVH SAS
CA
unknown
3564
OQ.MineBot.GUI.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3564
OQ.MineBot.GUI.exe
45.88.110.217:80
suspicious
3808
jscript.exe
91.218.65.24:10134
malicious
3808
jscript.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2556
jscript.exe
91.218.65.24:10134
malicious
2556
jscript.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
app.host.minecraftbot.com
  • 144.217.162.188
unknown
www.download.windowsupdate.com
  • 205.185.216.10
  • 205.185.216.42
whitelisted

Threats

PID
Process
Class
Message
3564
OQ.MineBot.GUI.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3564
OQ.MineBot.GUI.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3564
OQ.MineBot.GUI.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3564
OQ.MineBot.GUI.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2 ETPRO signatures available at the full report
No debug info