File name:

DarkMine.rar

Full analysis: https://app.any.run/tasks/a6e95289-ea2d-47d3-8246-c93550c91427
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 06, 2021, 21:11:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

8741E9F6946EB4412954B9136BEC1558

SHA1:

F5325A939A336C2B35A5E29E7B3C90A1EC2C6FFF

SHA256:

5B390F822986AFFDBC32FDAE42E283465907F5FD657129AB9230472A890DCF52

SSDEEP:

24576:moprMFAXYw1sU+Bv+lkqJVOhIZ11LLoax1smS4R/UcRd8FyFO/rP:muajw1sV0lZEIZ1NEMSI/UgYyFO/rP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DarkStart.exe (PID: 2188)
      • Ch2.exe (PID: 2076)
      • DrivercrtdhcpDriverdll.exe (PID: 3072)
      • Ch2.exe (PID: 2548)
      • DriverUpdate.exe (PID: 464)
      • DarkStart.exe (PID: 3732)

    • Drops executable file immediately after starts

      • DarkStart.exe (PID: 2188)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3684)
      • schtasks.exe (PID: 2552)
      • schtasks.exe (PID: 1516)
      • schtasks.exe (PID: 3948)

    • Changes the autorun value in the registry

      • DrivercrtdhcpDriverdll.exe (PID: 3072)

    • Disables Windows Defender

      • Ch2.exe (PID: 2548)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3476)
      • Ch2.exe (PID: 2076)
      • DrivercrtdhcpDriverdll.exe (PID: 3072)
      • dw20.exe (PID: 628)
      • Ch2.exe (PID: 2548)
      • DriverUpdate.exe (PID: 464)
      • powershell.exe (PID: 2836)
      • DarkStart.exe (PID: 2188)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3476)
      • DarkStart.exe (PID: 2188)
      • DrivercrtdhcpDriverdll.exe (PID: 3072)

    • Reads the computer name

      • DarkStart.exe (PID: 2188)
      • dw20.exe (PID: 628)
      • DrivercrtdhcpDriverdll.exe (PID: 3072)
      • WinRAR.exe (PID: 3476)
      • Ch2.exe (PID: 2548)
      • DriverUpdate.exe (PID: 464)
      • powershell.exe (PID: 2836)

    • Drops a file that was compiled in debug mode

      • DarkStart.exe (PID: 2188)

    • Drops a file with a compile date too recent

      • DarkStart.exe (PID: 2188)
      • WinRAR.exe (PID: 3476)
      • DrivercrtdhcpDriverdll.exe (PID: 3072)
      • DriverUpdate.exe (PID: 464)

    • Creates files in the Windows directory

      • DrivercrtdhcpDriverdll.exe (PID: 3072)

    • Executed via WMI

      • schtasks.exe (PID: 3684)
      • schtasks.exe (PID: 3948)
      • schtasks.exe (PID: 2552)
      • schtasks.exe (PID: 1516)

    • Creates executable files which already exist in Windows

      • DrivercrtdhcpDriverdll.exe (PID: 3072)

    • Reads Environment values

      • DrivercrtdhcpDriverdll.exe (PID: 3072)
      • DriverUpdate.exe (PID: 464)
      • Ch2.exe (PID: 2548)

    • Starts itself from another location

      • DrivercrtdhcpDriverdll.exe (PID: 3072)

    • Reads the date of Windows installation

      • powershell.exe (PID: 2836)

    • Creates files in the user directory

      • powershell.exe (PID: 2836)
      • DarkStart.exe (PID: 2188)

    • Creates files in the program directory

      • dw20.exe (PID: 628)

    • Executes PowerShell scripts

      • Ch2.exe (PID: 2548)

  • INFO

    • Manual execution by user

      • DarkStart.exe (PID: 3732)
      • DriverUpdate.exe (PID: 464)
      • NOTEPAD.EXE (PID: 1792)
      • DarkStart.exe (PID: 2188)

    • Reads the computer name

      • schtasks.exe (PID: 3684)
      • schtasks.exe (PID: 2552)
      • schtasks.exe (PID: 1516)
      • schtasks.exe (PID: 3948)

    • Checks supported languages

      • schtasks.exe (PID: 3684)
      • schtasks.exe (PID: 3948)
      • schtasks.exe (PID: 2552)
      • schtasks.exe (PID: 1516)
      • NOTEPAD.EXE (PID: 1792)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
14
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe darkstart.exe no specs darkstart.exe ch2.exe no specs drivercrtdhcpdriverdll.exe dw20.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs ch2.exe powershell.exe no specs driverupdate.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
464"C:\Users\admin\Desktop\DarkMine\DriverUpdate.exe" C:\Users\admin\Desktop\DarkMine\DriverUpdate.exe
Explorer.EXE
User:
admin
Company:
FileZilla 3
Integrity Level:
MEDIUM
Description:
FileZilla Project
Exit code:
0
Version:
3.55.0.0
Modules
Images
c:\users\admin\desktop\darkmine\driverupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
628dw20.exe -x -s 848C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe—DarkStart.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Error Reporting Shim
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1516schtasks.exe /create /tn "DarkStart" /sc ONLOGON /tr "'C:\Users\admin\Desktop\DarkMine\DarkStart\DarkStart.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
1792"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\DarkMine\Result.txtC:\Windows\system32\NOTEPAD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\notepad.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2076"C:\Users\admin\AppData\Roaming\Ch2.exe" C:\Users\admin\AppData\Roaming\Ch2.exe—DarkStart.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
Modules
Images
c:\users\admin\appdata\roaming\ch2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2188"C:\Users\admin\Desktop\DarkMine\DarkStart.exe" C:\Users\admin\Desktop\DarkMine\DarkStart.exe
Explorer.EXE
User:
admin
Company:
attribute
Integrity Level:
HIGH
Description:
beardivyhundred
Exit code:
3762507597
Version:
10.15.68.7
Modules
Images
c:\users\admin\desktop\darkmine\darkstart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2548"C:\Users\Default User\Ch2.exe" C:\Users\Default User\Ch2.exe
DrivercrtdhcpDriverdll.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\default\ch2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2552schtasks.exe /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0407-0000-0000000FF1CE}-C\SearchFilterHost.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\user32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2836"powershell" Get-MpPreference -verboseC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Ch2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3072"C:\Users\admin\AppData\Roaming\DrivercrtdhcpDriverdll.exe" C:\Users\admin\AppData\Roaming\DrivercrtdhcpDriverdll.exe
DarkStart.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\drivercrtdhcpdriverdll.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\shlwapi.dll
Total events
3 990
Read events
3 866
Write events
124
Delete events
0

Modification events

(PID) Process:(3476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3476) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3476) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\DarkMine.rar
(PID) Process:(3476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3476) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
9
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
628dw20.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_darkstart.exe_1f844102284519937e988b21f595eb5c688dc8d_027f342a\Report.wer —
MD5:—
SHA256:—
3476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3476.49303\DarkMine\DriverUpdate.exeexecutable
MD5:—
SHA256:—
3072DrivercrtdhcpDriverdll.exeC:\Users\Default\Ch2.exeexecutable
MD5:—
SHA256:—
2188DarkStart.exeC:\Users\admin\AppData\Roaming\DrivercrtdhcpDriverdll.exeexecutable
MD5:—
SHA256:—
2188DarkStart.exeC:\Users\admin\AppData\Roaming\Ch2.exeexecutable
MD5:—
SHA256:—
3072DrivercrtdhcpDriverdll.exeC:\Users\Default\92b6e49b10dc7bc63a3f9d3bec13ecf3b0a8c80btext
MD5:—
SHA256:—
2188DarkStart.exeC:\Users\admin\AppData\Roaming\DriverUpdate.exeexecutable
MD5:—
SHA256:—
3072DrivercrtdhcpDriverdll.exeC:\Windows\System32\cscobj\services.exeexecutable
MD5:—
SHA256:—
3072DrivercrtdhcpDriverdll.exeC:\MSOCache\All Users\{90140000-00BA-0407-0000-0000000FF1CE}-C\SearchFilterHost.exeexecutable
MD5:—
SHA256:—
3072DrivercrtdhcpDriverdll.exeC:\Windows\System32\cscobj\c5b4cb5e9653cce737f29f72ba880dd4c4bab27dtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
0
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2548
Ch2.exe
GET
200
141.95.28.201:80
http://141.95.28.201/Eternalgeolongpoll.php?rRxNQ2nLcbs3shHWg91DVnswhB=HgPrDhQDX5JKZ3X0hB9QaGOR1wzc&iBpO=foMuoWceuaXybJ7xLuivdAR8zRry9y4&6bXtnxXmy6Wx4DUp=QXQHdffWO4Xonf5g&86283da538984625b0c0b7a1d601a43c=ba9080f7f667b6e443a9c41f6ee90437&d58ad9b66d8bd761c3897f13d132f6a0=wN2kjM1YjYlVWOygTYjBjN2YTZwQTN1M2M4IzY0IzYwEDZ1kTNmhDO&rRxNQ2nLcbs3shHWg91DVnswhB=HgPrDhQDX5JKZ3X0hB9QaGOR1wzc&iBpO=foMuoWceuaXybJ7xLuivdAR8zRry9y4&6bXtnxXmy6Wx4DUp=QXQHdffWO4Xonf5g
GB
text
384 b
malicious
464
DriverUpdate.exe
GET
200
194.226.139.141:80
http://194.226.139.141/DriverUpdate.exe
RU
executable
264 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1360
svchost.exe
20.73.194.208:443
—
—
US
whitelisted
—
—
20.73.194.208:443
—
—
US
whitelisted
2548
Ch2.exe
141.95.28.201:80
—
—
GB
malicious
464
DriverUpdate.exe
194.226.139.141:80
—
Cross Tel Ltd
RU
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
464
DriverUpdate.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
464
DriverUpdate.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
464
DriverUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
464
DriverUpdate.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
464
DriverUpdate.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DarkMine.rar