| File name: | imRAT v0.4 final version.rar |
| Full analysis: | https://app.any.run/tasks/095afc9f-5dc5-4549-8af4-c1c876fe1b04 |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | August 03, 2024, 14:35:45 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 59465CD54D78DEED18706974B3A8F6AD |
| SHA1: | 79EEA5669792993091F888A154CE78F8C6407402 |
| SHA256: | 19CC34E522C9F74A35E5C37084C90BE12ED2645E42019238A7DCCBF62281429E |
| SSDEEP: | 24576:vI6ITtxf/fGINtd8vGtw44MRW/+kyTMEIQOQ3OsY9SjvH27FsD4bpHHdLmSoP5h:vI6IRxf/fGINtd8vGtw44MRW/+kyTME7 |
MALICIOUS
Drops the executable file immediately after the start
- WinRAR.exe (PID: 1488)
- imRAT.exe (PID: 2088)
- Server.exe (PID: 1916)
- Zombie.exe (PID: 2504)
Create files in the Startup directory
- Zombie.exe (PID: 2504)
Changes the autorun value in the registry
- Zombie.exe (PID: 2504)
NjRAT is detected
- Zombie.exe (PID: 2504)
Starts CMD.EXE for self-deleting
- Zombie.exe (PID: 2504)
SUSPICIOUS
Process drops legitimate windows executable
- WinRAR.exe (PID: 1488)
Reads the Internet Settings
- imRAT.exe (PID: 2088)
- Server.exe (PID: 1916)
The process creates files with name similar to system file names
- WinRAR.exe (PID: 1488)
Reads security settings of Internet Explorer
- imRAT.exe (PID: 2088)
- Server.exe (PID: 1916)
Reads Internet Explorer settings
- imRAT.exe (PID: 2088)
Executable content was dropped or overwritten
- imRAT.exe (PID: 2088)
- Server.exe (PID: 1916)
- Zombie.exe (PID: 2504)
Starts itself from another location
- Server.exe (PID: 1916)
Uses NETSH.EXE to add a firewall rule or allowed programs
- Zombie.exe (PID: 2504)
Uses NETSH.EXE to delete a firewall rule or allowed programs
- Zombie.exe (PID: 2504)
Starts CMD.EXE for commands execution
- Zombie.exe (PID: 2504)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 1488)
Reads Environment values
- imRAT.exe (PID: 2088)
- Zombie.exe (PID: 2504)
Reads the machine GUID from the registry
- imRAT.exe (PID: 2088)
- plg.exe (PID: 3424)
- Server.exe (PID: 1916)
- Zombie.exe (PID: 2504)
Checks supported languages
- imRAT.exe (PID: 2088)
- plg.exe (PID: 3424)
- wmpnscfg.exe (PID: 3528)
- Server.exe (PID: 1916)
- Zombie.exe (PID: 2504)
Manual execution by a user
- imRAT.exe (PID: 2088)
- wmpnscfg.exe (PID: 3528)
- Server.exe (PID: 1916)
Reads the computer name
- imRAT.exe (PID: 2088)
- plg.exe (PID: 3424)
- wmpnscfg.exe (PID: 3528)
- Server.exe (PID: 1916)
- Zombie.exe (PID: 2504)
Creates files or folders in the user directory
- Zombie.exe (PID: 2504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
55
Monitored processes
10
Malicious processes
2
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1264 | netsh firewall add allowedprogram "C:\Users\admin\Zombie.exe" "Zombie.exe" ENABLE | C:\Windows\System32\netsh.exe | — | Zombie.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1488 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\imRAT v0.4 final version.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 1916 | "C:\Users\admin\Desktop\Server.exe" | C:\Users\admin\Desktop\Server.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2088 | "C:\Users\admin\Desktop\imRAT.exe" | C:\Users\admin\Desktop\imRAT.exe | explorer.exe | ||||||||||||
User: admin Company: im523 Integrity Level: MEDIUM Description: imRAT v0.4 final version Version: 1.0.0.0 Modules
| |||||||||||||||
| 2180 | netsh firewall delete allowedprogram "C:\Users\admin\Zombie.exe" | C:\Windows\System32\netsh.exe | — | Zombie.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2504 | "C:\Users\admin\Zombie.exe" | C:\Users\admin\Zombie.exe | Server.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2880 | ping 0 | C:\Windows\System32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3328 | cmd.exe /k ping 0 & del "C:\Users\admin\Zombie.exe" & exit | C:\Windows\System32\cmd.exe | — | Zombie.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3424 | "C:\Users\admin\Desktop\Plugin\plg.exe" | C:\Users\admin\Desktop\Plugin\plg.exe | — | imRAT.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: WindowsApplication1 Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3528 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
12 735
Read events
12 557
Write events
171
Delete events
7
Modification events
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\imRAT v0.4 final version.rar | |||
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1488) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
Executable files
14
Suspicious files
1
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\imRAT.vshost.exe | executable | |
MD5:B4D5137244BB4259A208B815E7C9F7B9 | SHA256:7E2CAB589582F46FF463D9DCBC659DF25128CE23BD896184F5F6F6233818B249 | |||
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\imRAT.xml | xml | |
MD5:DE967CB9FE7AB1C6E4CBFC48E47020A0 | SHA256:BB4929D99752FDD4C7FB817AF99D1E16B1E689F9740C8534E3CA38F1E5F46B87 | |||
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\imRAT.exe | executable | |
MD5:8B468075A85BE99C92359B7DB5746D76 | SHA256:8D5B913C238C77C59A05B8111BAA72CC784F94FAABB3573853DEEA34BE1B32F9 | |||
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\Plugin\proc.dll | executable | |
MD5:0B2F09F5E4C2B9B94F2FC54BBEB509A5 | SHA256:951E537CA810AD5DB1B13ECF092D18CFAB3001FEB266EB33A371C5DD5E3B5B29 | |||
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\imRAT.vshost.exe.manifest | xml | |
MD5:A19A2658BA69030C6AC9D11FD7D7E3C1 | SHA256:C0085EB467D2FC9C9F395047E057183B3CD1503A4087D0DB565161C13527A76F | |||
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\Plugin\cam.dll | executable | |
MD5:3572E88B68EBFA1DD46A886E763499DE | SHA256:9097D4EDFDBDAA57F0F1177F325E8C1394D84D402355AECF29BD5C574790D597 | |||
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\Mono.Cecil.dll | executable | |
MD5:851EC9D84343FBD089520D420348A902 | SHA256:CDADC26C09F869E21053EE1A0ACF3B2D11DF8EDD599FE9C377BD4D3CE1C9CDA9 | |||
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\Plugin\fm.dll | executable | |
MD5:2CB7C35BBCA55CCC50B11FAE2BA37C97 | SHA256:BBF43894F913DDF014B09B0EAD4CF9EDBCBF7F1A728884FFFDF2AF8B84BF2F67 | |||
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\Plugin\sc2.dll | executable | |
MD5:70AC2237257012E013331E749D42A70B | SHA256:E728AFC5D081EAABE3297D0DDD8387D0DF0BBED0F73EE3B04C4588CB89EFEA51 | |||
| 1488 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1488.6595\Plugin\stub.exe | executable | |
MD5:F553354FB355BB0EDB0755082BC8E5B6 | SHA256:7CC7696AB1B2119884EBA04DA27831F698B793947B6DF25A44B0064CCFF20EC2 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
9
DNS requests
6
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1372 | svchost.exe | GET | 200 | 23.48.23.141:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1372 | svchost.exe | GET | 304 | 23.50.131.200:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33 | unknown | — | — | whitelisted |
1372 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1060 | svchost.exe | GET | 304 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f69642324cc87bd | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1372 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1372 | svchost.exe | 23.50.131.200:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 23.48.23.141:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
1060 | svchost.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | EDGECAST | GB | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |