download:

/wercjeo/robo.exe

Full analysis: https://app.any.run/tasks/f62a91ee-4df1-46b6-a4de-cd59ace5804f
Verdict: Malicious activity
Threats:

A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet.

Malware Trends Tracker     >>>
Analysis date: July 21, 2024, 17:23:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
botnet
zharkbot
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

133CECE8F596E1C7B89705D4D4C4D5F3

SHA1:

BC9E2CD9B30F4C6D7D20A509D85C8FB0166A9510

SHA256:

DCFF0CE8FAF0BC8555C4213EECF50F8E98A72B9CAC87676239AFD9EB5D7ED8F6

SSDEEP:

6144:u5O3xvcDd26ZHpUNpJivbbTYD8LibvaVb8SF:MO3yDs6ZHKpJiDbTO8ebvaXF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • robo.exe (PID: 5892)

    • Changes the autorun value in the registry

      • robo.exe (PID: 5892)
      • Exploru.exe (PID: 7096)

    • Uses Task Scheduler to run other applications

      • robo.exe (PID: 5892)
      • Exploru.exe (PID: 7096)

    • ZHARKBOT has been detected (SURICATA)

      • Exploru.exe (PID: 7096)

  • SUSPICIOUS

    • Reads the BIOS version

      • robo.exe (PID: 5892)
      • Exploru.exe (PID: 7096)
      • Exploru.exe (PID: 1152)
      • Exploru.exe (PID: 6992)
      • Exploru.exe (PID: 2704)

    • Executable content was dropped or overwritten

      • robo.exe (PID: 5892)

    • Reads security settings of Internet Explorer

      • robo.exe (PID: 5892)
      • Exploru.exe (PID: 7096)

    • Reads the date of Windows installation

      • robo.exe (PID: 5892)

    • Starts itself from another location

      • robo.exe (PID: 5892)

    • The process executes via Task Scheduler

      • Exploru.exe (PID: 1152)
      • Exploru.exe (PID: 6992)
      • Exploru.exe (PID: 2704)

    • Connects to the server without a host name

      • Exploru.exe (PID: 7096)

  • INFO

    • Create files in a temporary directory

      • robo.exe (PID: 5892)

    • Checks supported languages

      • robo.exe (PID: 5892)
      • Exploru.exe (PID: 7096)
      • Exploru.exe (PID: 1152)
      • Exploru.exe (PID: 6992)
      • Exploru.exe (PID: 2704)

    • Reads the computer name

      • robo.exe (PID: 5892)
      • Exploru.exe (PID: 1152)
      • Exploru.exe (PID: 6992)
      • Exploru.exe (PID: 7096)
      • Exploru.exe (PID: 2704)

    • Process checks computer location settings

      • robo.exe (PID: 5892)

    • Checks proxy server information

      • Exploru.exe (PID: 7096)

    • Reads Environment values

      • Exploru.exe (PID: 7096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:21 15:49:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 250368
InitializedDataSize: 86528
UninitializedDataSize: -
EntryPoint: 0x20a0b
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start robo.exe schtasks.exe no specs conhost.exe no specs #ZHARKBOT exploru.exe schtasks.exe no specs conhost.exe no specs slui.exe no specs exploru.exe no specs slui.exe no specs exploru.exe no specs exploru.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1152"C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe"C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\245982232302\exploru.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2704"C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe"C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\245982232302\exploru.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3552C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5724\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5892"C:\Users\admin\Desktop\robo.exe" C:\Users\admin\Desktop\robo.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\robo.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6992"C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe"C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\245982232302\exploru.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7088C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN Exploru.exe /TR "C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe" /FC:\Windows\SysWOW64\schtasks.exe—Exploru.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7096"C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe" C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe
robo.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\245982232302\exploru.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7204C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN Exploru.exe /TR "C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe" /FC:\Windows\SysWOW64\schtasks.exe—robo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 962
Read events
4 901
Write events
61
Delete events
0

Modification events

(PID) Process:(5892) robo.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\245982232302
(PID) Process:(5892) robo.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Exploru.exe
Value:
C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe
(PID) Process:(5892) robo.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5892) robo.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5892) robo.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5892) robo.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7096) Exploru.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\Users\admin\AppData\Local\Temp\245982232302
(PID) Process:(7096) Exploru.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Exploru.exe
Value:
C:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exe
(PID) Process:(7096) Exploru.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7096) Exploru.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5892robo.exeC:\Users\admin\AppData\Local\Temp\245982232302\Exploru.exeexecutable
MD5:133CECE8F596E1C7B89705D4D4C4D5F3
SHA256:DCFF0CE8FAF0BC8555C4213EECF50F8E98A72B9CAC87676239AFD9EB5D7ED8F6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
62
DNS requests
11
Threats
31

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7096
Exploru.exe
GET
200
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
7096
Exploru.exe
GET
—
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
7096
Exploru.exe
GET
200
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
7096
Exploru.exe
GET
200
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
7096
Exploru.exe
GET
200
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
7096
Exploru.exe
GET
200
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
7096
Exploru.exe
GET
200
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
7096
Exploru.exe
GET
200
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
7096
Exploru.exe
GET
200
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
7096
Exploru.exe
GET
200
185.196.10.57:80
http://185.196.10.57/wercjeo/api.php?id=5C9AD63B5D4F8F005E8BA6BDC2B34BCCB4831A8856771EF76ECBD0176D7AB8A5&us=0FCD8A6551&mn=2AECB4476B63BB4C25F8D995BFC93F&os=39C08968505B98415E8FB59C9BF11E8FF1C744CD51&bld=1898C939111C
unknown
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4716
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5620
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7856
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
7096
Exploru.exe
185.196.10.57:80
—
Simple Carrier LLC
US
unknown
2760
svchost.exe
40.115.3.253:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7972
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.22
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.133
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
arc.msn.com
  • 20.86.201.138
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted
www.bing.com
  • 2.20.142.178
  • 2.20.142.187
  • 2.20.142.179
  • 92.122.215.99
  • 92.122.215.98
  • 92.122.215.58
  • 2.20.142.186
  • 92.122.215.56
  • 92.122.215.74
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
7096
Exploru.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
7096
Exploru.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
7096
Exploru.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
7096
Exploru.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
7096
Exploru.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
7096
Exploru.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
7096
Exploru.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
7096
Exploru.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
7096
Exploru.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
7096
Exploru.exe
A Network Trojan was detected
ET MALWARE ZharkBot User-Agent Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/wercjeo/robo.exe