File name:

Payloadf.exe

Full analysis: https://app.any.run/tasks/7cc90ec5-96ec-47eb-9b38-246b657a548b
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: June 19, 2025, 09:21:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
auto-reg
rat
njrat
bladabindi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

E377859FB6F0C711C3C177CC7F80B1C0

SHA1:

F9D4E5D299F945BF42823E9CE628929BC872145C

SHA256:

324BA6347C3F414B8D937F59301A8718D1C968DC00AA88642DB6EEC94A6F60F8

SSDEEP:

768:txGZDeWjZVS2GBNzTsyeGbatSsEShmPBc6DHPsV77XJVxI3pmt:tSWNHjlsBMBc6DwXjxI3pmt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Payloadf.exe (PID: 6652)

    • Uses Task Scheduler to run other applications

      • Payloadf.exe (PID: 6652)

    • NJRAT has been detected (YARA)

      • Payloadf.exe (PID: 6652)

    • Changes the autorun value in the registry

      • Payloadf.exe (PID: 6652)

    • NjRAT is detected

      • Payloadf.exe (PID: 6652)

  • SUSPICIOUS

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6700)

    • Executable content was dropped or overwritten

      • Payloadf.exe (PID: 6652)

    • There is functionality for taking screenshot (YARA)

      • Payloadf.exe (PID: 6652)

    • The process executes via Task Scheduler

      • Payloadf.exe (PID: 472)
      • Payloadf.exe (PID: 2628)

    • Connects to unusual port

      • Payloadf.exe (PID: 6652)

  • INFO

    • Checks supported languages

      • Payloadf.exe (PID: 6652)
      • Payloadf.exe (PID: 7048)
      • Payloadf.exe (PID: 472)
      • Payloadf.exe (PID: 2628)

    • Creates files or folders in the user directory

      • Payloadf.exe (PID: 6652)

    • Reads the computer name

      • Payloadf.exe (PID: 6652)
      • Payloadf.exe (PID: 7048)
      • Payloadf.exe (PID: 472)
      • Payloadf.exe (PID: 2628)

    • Launching a file from a Registry key

      • Payloadf.exe (PID: 6652)

    • Launching a file from the Startup directory

      • Payloadf.exe (PID: 6652)

    • Reads the machine GUID from the registry

      • Payloadf.exe (PID: 6652)

    • Manual execution by a user

      • Payloadf.exe (PID: 7048)

    • Checks proxy server information

      • slui.exe (PID: 2348)

    • Reads the software policy settings

      • slui.exe (PID: 2348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(6652) Payloadf.exe
C2pptp.ipjetable.net
Ports4444
BotnetVictim
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\f344f392fd12f545de7360fd49214ebe
SplitterY262SUCZ4UJJ
Version<- NjRAT 0.7d Horror Edition ->
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.7)
.exe | Win32 Executable MS Visual C++ (generic) (19.4)
.exe | Win64 Executable (generic) (17.2)
.scr | Windows screen saver (8.1)
.dll | Win32 Dynamic Link Library (generic) (4.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:19 09:16:00+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 54272
InitializedDataSize: 512
UninitializedDataSize: -
EntryPoint: 0xf20e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
9
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #NJRAT payloadf.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs payloadf.exe no specs payloadf.exe no specs slui.exe payloadf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472"C:\Users\admin\Desktop\Payloadf.exe"C:\Users\admin\Desktop\Payloadf.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\payloadf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
768schtasks /create /sc minute /mo 1 /tn CleanSweepCheck /tr C:\Users\admin\Desktop\Payloadf.exeC:\Windows\SysWOW64\schtasks.exe—Payloadf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1232\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2348C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2628"C:\Users\admin\Desktop\Payloadf.exe"C:\Users\admin\Desktop\Payloadf.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\payloadf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
5060\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6652"C:\Users\admin\Desktop\Payloadf.exe" C:\Users\admin\Desktop\Payloadf.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\payloadf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
NjRat
(PID) Process(6652) Payloadf.exe
C2pptp.ipjetable.net
Ports4444
BotnetVictim
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\f344f392fd12f545de7360fd49214ebe
SplitterY262SUCZ4UJJ
Version<- NjRAT 0.7d Horror Edition ->
6700schtasks /delete /tn CleanSweepCheck /fC:\Windows\SysWOW64\schtasks.exe—Payloadf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7048"C:\Users\admin\Desktop\Payloadf.exe" ..C:\Users\admin\Desktop\Payloadf.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\payloadf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
5 081
Read events
4 783
Write events
298
Delete events
0

Modification events

(PID) Process:(6652) Payloadf.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:SEE_MASK_NOZONECHECKS
Value:
1
(PID) Process:(6652) Payloadf.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:f344f392fd12f545de7360fd49214ebe
Value:
"C:\Users\admin\Desktop\Payloadf.exe" ..
(PID) Process:(6652) Payloadf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:f344f392fd12f545de7360fd49214ebe
Value:
"C:\Users\admin\Desktop\Payloadf.exe" ..
(PID) Process:(6652) Payloadf.exeKey:HKEY_CURRENT_USER\SOFTWARE\f344f392fd12f545de7360fd49214ebe
Operation:writeName:[kl]
Value:
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6652Payloadf.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f344f392fd12f545de7360fd49214ebe.exeexecutable
MD5:E377859FB6F0C711C3C177CC7F80B1C0
SHA256:324BA6347C3F414B8D937F59301A8718D1C968DC00AA88642DB6EEC94A6F60F8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
47
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
888
RUXIMICS.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
888
RUXIMICS.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.159.23:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
20.190.159.23:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
POST
200
20.190.159.75:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
GET
200
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
1520
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
888
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
888
RUXIMICS.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
888
RUXIMICS.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
  • 2.18.121.139
  • 2.18.121.147
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.131
  • 40.126.32.72
  • 40.126.32.76
  • 40.126.32.68
  • 20.190.160.17
  • 40.126.32.138
  • 20.190.160.20
whitelisted
pptp.ipjetable.net
  • 188.121.240.36
  • 188.121.240.37
  • 188.121.240.39
  • 188.121.240.4
  • 188.121.240.6
  • 188.121.240.7
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Payloadf.exe