| File name: | vNvf9HHV.exe |
| Full analysis: | https://app.any.run/tasks/f4bd2ced-c91d-4ea3-9818-07a587b9a2d9 |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | December 03, 2023, 02:33:58 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 111F39F7FA96299A15AAB4535A90F072 |
| SHA1: | EFE53D1ECD32A91E0D5551149C74D68B245419CC |
| SHA256: | 284683096B38777775A6F3ADFB86EF322803BD687F161A40FA87AEA99DB14433 |
| SSDEEP: | 768:wUJ7GQb8dmYYm19ivKxyUplwaRKRDDPJQHr5hwp30AYHV5jgJZPkZfsGQ+Pka1f5:wsKOvKxyUplwaRKRWHr5WqHUwZfsNwk |
MALICIOUS
Drops the executable file immediately after the start
- vNvf9HHV.exe (PID: 280)
- Picom System.exe (PID: 2128)
Create files in the Startup directory
- Picom System.exe (PID: 2128)
NjRAT is detected
- Picom System.exe (PID: 2128)
NJRAT has been detected (SURICATA)
- Picom System.exe (PID: 2128)
Connects to the CnC server
- Picom System.exe (PID: 2128)
Changes the autorun value in the registry
- Picom System.exe (PID: 2128)
SUSPICIOUS
The process creates files with name similar to system file names
- vNvf9HHV.exe (PID: 280)
- Picom System.exe (PID: 2128)
Reads the Internet Settings
- vNvf9HHV.exe (PID: 280)
Starts itself from another location
- vNvf9HHV.exe (PID: 280)
Uses NETSH.EXE to add a firewall rule or allowed programs
- Picom System.exe (PID: 2128)
Connects to unusual port
- Picom System.exe (PID: 2128)
INFO
Checks supported languages
- vNvf9HHV.exe (PID: 280)
- Picom System.exe (PID: 2128)
Reads the computer name
- vNvf9HHV.exe (PID: 280)
- Picom System.exe (PID: 2128)
Create files in a temporary directory
- vNvf9HHV.exe (PID: 280)
- Picom System.exe (PID: 2128)
Reads the machine GUID from the registry
- vNvf9HHV.exe (PID: 280)
- Picom System.exe (PID: 2128)
Creates files or folders in the user directory
- Picom System.exe (PID: 2128)
Reads Environment values
- Picom System.exe (PID: 2128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:12:03 03:14:23+01:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 42496 |
| InitializedDataSize: | 1536 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xc51e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
36
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 280 | "C:\Users\admin\AppData\Local\Temp\vNvf9HHV.exe" | C:\Users\admin\AppData\Local\Temp\vNvf9HHV.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 1612 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\Picom System.exe" "Picom System.exe" ENABLE | C:\Windows\SysWOW64\netsh.exe | — | Picom System.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2128 | "C:\Users\admin\AppData\Local\Temp\Picom System.exe" | C:\Users\admin\AppData\Local\Temp\Picom System.exe | vNvf9HHV.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
1 658
Read events
1 599
Write events
59
Delete events
0
Modification events
| (PID) Process: | (280) vNvf9HHV.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (280) vNvf9HHV.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (280) vNvf9HHV.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (280) vNvf9HHV.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (1612) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2128) Picom System.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | 216481850790939efdf785121bb0b6af |
Value: "C:\Users\admin\AppData\Local\Temp\Picom System.exe" .. | |||
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2128 | Picom System.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\216481850790939efdf785121bb0b6af.exe | executable | |
MD5:111F39F7FA96299A15AAB4535A90F072 | SHA256:284683096B38777775A6F3ADFB86EF322803BD687F161A40FA87AEA99DB14433 | |||
| 280 | vNvf9HHV.exe | C:\Users\admin\AppData\Local\Temp\Picom System.exe | executable | |
MD5:111F39F7FA96299A15AAB4535A90F072 | SHA256:284683096B38777775A6F3ADFB86EF322803BD687F161A40FA87AEA99DB14433 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
13
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1956 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
324 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2128 | Picom System.exe | 141.255.146.115:288 | berlin1415.bounceme.net | Ielo-liazo Services SAS | FR | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
berlin1415.bounceme.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
324 | svchost.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.bounceme .net |
2128 | Picom System.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 13 |
2128 | Picom System.exe | Malware Command and Control Activity Detected | ET MALWARE Bladabindi/njrat CnC Checkin |
2128 | Picom System.exe | Malware Command and Control Activity Detected | ET MALWARE Bladabindi/njrat CnC Keep-Alive (INBOUND) |
2128 | Picom System.exe | Malware Command and Control Activity Detected | ET MALWARE Bladabindi/njrat CnC Keep-Alive (OUTBOUND) |
2128 | Picom System.exe | Malware Command and Control Activity Detected | ET MALWARE Bladabindi/njrat CnC Keep-Alive (INBOUND) |
2128 | Picom System.exe | Malware Command and Control Activity Detected | ET MALWARE Bladabindi/njrat CnC Keep-Alive (OUTBOUND) |
2128 | Picom System.exe | Malware Command and Control Activity Detected | ET MALWARE Bladabindi/njrat CnC Keep-Alive (INBOUND) |
2128 | Picom System.exe | Malware Command and Control Activity Detected | ET MALWARE Bladabindi/njrat CnC Keep-Alive (OUTBOUND) |
2128 | Picom System.exe | Malware Command and Control Activity Detected | ET MALWARE Bladabindi/njrat CnC Keep-Alive (INBOUND) |