File name:

bot na vse quests.zip

Full analysis: https://app.any.run/tasks/4501ea28-ff2f-40e4-bbb8-f20bfc81d0fa
Verdict: Malicious activity
Analysis date: October 22, 2024, 05:44:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

F50252C3AE9EA8539B64E47707EDE435

SHA1:

3F147B9E1572E9A5F4535C865D9D725CC3C71AA6

SHA256:

F9D7BE5C4E3E6F4D4E4ECD9B070827DFF8CD05CD2FC1FF2F7BE6E65C79B835AC

SSDEEP:

98304:IlIYYwKkg1a9cIXYPnoWWCNEd9jcAEsBkDTZnVVFgDFqzzYKkygl25uD+DRpPBxa:e7CbQTOoZsG7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6596)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • RakSAMP Lite.exe (PID: 1952)
      • RakSAMP Lite.exe (PID: 6264)
      • RakSAMP Lite.exe (PID: 5788)
      • RakSAMP Lite.exe (PID: 3276)
      • RakSAMP Lite.exe (PID: 616)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6596)

    • Manual execution by a user

      • RakLaunch Lite.exe (PID: 6344)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:08:29 07:30:42
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: bot na vse quests/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
27
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs sppextcomobj.exe no specs slui.exe openwith.exe no specs raklaunch lite.exe raksamp lite.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs raksamp lite.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs slui.exe no specs raksamp lite.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs raksamp lite.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs raksamp lite.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Users\admin\Desktop\bot na vse quests\RakSAMP Lite.exe" -h 185.169.134.5 -p 7777 -n Lesbia_Danilejko -z C:\Users\admin\Desktop\bot na vse quests\RakSAMP Lite.exe
RakLaunch Lite.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\bot na vse quests\raksamp lite.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
692C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1744"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1952"C:\Users\admin\Desktop\bot na vse quests\RakSAMP Lite.exe" -h 185.169.134.5 -p 7777 -n Quinesha_Nedostupkin -z C:\Users\admin\Desktop\bot na vse quests\RakSAMP Lite.exe
RakLaunch Lite.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\bot na vse quests\raksamp lite.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2084C:\WINDOWS\system32\cmd.exe /c color 0C:\Windows\SysWOW64\cmd.exe—RakSAMP Lite.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—RakSAMP Lite.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2444C:\WINDOWS\system32\cmd.exe /c color 0C:\Windows\SysWOW64\cmd.exe—RakSAMP Lite.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2660C:\WINDOWS\system32\cmd.exe /c color 0C:\Windows\SysWOW64\cmd.exe—RakSAMP Lite.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3276"C:\Users\admin\Desktop\bot na vse quests\RakSAMP Lite.exe" -h 185.169.134.5 -p 7777 -n Krystalynn_Klejmenyh -z C:\Users\admin\Desktop\bot na vse quests\RakSAMP Lite.exe
RakLaunch Lite.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\bot na vse quests\raksamp lite.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—RakSAMP Lite.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 236
Read events
5 229
Write events
7
Delete events
0

Modification events

(PID) Process:(6596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\bot na vse quests.zip
(PID) Process:(6596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6596) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4432) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dll\OpenWithProgids
Operation:writeName:dllfile
Value:
Executable files
75
Suspicious files
15
Text files
95
Unknown types
0

Dropped files

PID
Process
Filename
Type
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\routes\avtobus.rttext
MD5:CE60E4B491E754E00A1EBD65235342B5
SHA256:2FF38A6F895869194CC8AD82590E10C938A549380EBBDED6891E46D5CE10A644
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\routes\edemgdetopodlv.rt —
MD5:—
SHA256:—
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\lua51.dllexecutable
MD5:3DFF7448B43FCFB4DC65E0040B0FFB88
SHA256:FF976F6E965E3793E278FA9BF5E80B9B226A0B3932B9DA764BFFC8E41E6CDB60
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\routes\cr-lavkapokypOhka.rttext
MD5:CCA82678C99EEA473898EB8360252252
SHA256:C0D427329D9D1A58905C124FE27D9B7DBE6BEDA8C686ADA17CFB467034951E12
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\routes\crafter-route1.rttext
MD5:675357EE15CCC95DD2DA55E333F36827
SHA256:86D9A9598F8348FE9163E7FEB4EA5089F693A296857C655D774C37A0D497C377
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\reload_window.pytext
MD5:487662B992241576C941061284499863
SHA256:7F6860F695E768DD471C6545B3406188798B290E1C78DBDC78C9DB910263ACB4
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\RakSAMP Lite.exeexecutable
MD5:9802AC594BD6245E31C5E640A23F1652
SHA256:0C1AEEAB9ADCF23318A04837CCB1D4EA1210DA2943AC1AF4A9D94A450F733D87
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\quest\settings.txtini
MD5:891C1BF0FCB7200F2ACE466F4D720A23
SHA256:734143541AB014C85C1E1E7EEF46992F9AFC704BC55C52954128DA9CA9DED161
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\routes\crafter-crchick.rttext
MD5:1B16D403AD399DF2696EEB5D6C72B2F3
SHA256:FEAE315A06AE81FCF150F5B334890A61C3390A3D6EF8FBA9076B8989637D047A
6596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6596.20153\bot na vse quests\routes\ab-buycar.rttext
MD5:41BDAFF543A92962D0A68F6B4EFC27FB
SHA256:9AA5E3CD98D13B5E8C1E7AD74E5E325CDA1F3B51B7B2FF0E5CA9743172D5A4FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
201
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4376
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4088
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4088
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3912
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3524
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
104.126.37.147:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4376
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4376
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4360
SearchApp.exe
104.126.37.179:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 4.231.128.59
whitelisted
www.bing.com
  • 104.126.37.147
  • 104.126.37.163
  • 104.126.37.153
  • 104.126.37.171
  • 104.126.37.177
  • 104.126.37.176
  • 104.126.37.154
  • 104.126.37.160
  • 104.126.37.161
  • 104.126.37.179
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.123
  • 104.126.37.185
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 216.58.206.78
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.68
  • 20.190.159.4
  • 20.190.159.2
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.71
whitelisted
th.bing.com
  • 104.126.37.179
  • 104.126.37.171
  • 104.126.37.176
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.123
  • 104.126.37.177
  • 104.126.37.185
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bot na vse quests.zip