| File name: | Server3.exe |
| Full analysis: | https://app.any.run/tasks/11caf86c-2b1b-40e0-9bf6-0d62f8b14eab |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | December 21, 2020, 16:04:03 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 419B66286BC502EC43B67F8DE6C96EC6 |
| SHA1: | 37AC4994140E0BD831F98273785C482B014C641A |
| SHA256: | 376E89646A3D6FE30564A0044C5C148EFE0FBD857CDE6DEE35B145B29D8E37B8 |
| SSDEEP: | 384:hZymNX7xdW/IUyNZa55EFiTYMWM7bV56l9C9D9O5UE5QzwBlpJNakkjh/TzF7pWI:z1rxIghNZk5EFiTVxbC3vQO+Gut+L |
MALICIOUS
Writes to a start menu file
- Server3.exe (PID: 1376)
Connects to CnC server
- Server3.exe (PID: 1376)
NJRAT was detected
- Server3.exe (PID: 1376)
Application was dropped or rewritten from another process
- .exe (PID: 3908)
Changes the autorun value in the registry
- Server3.exe (PID: 1376)
SUSPICIOUS
Creates files in the user directory
- Server3.exe (PID: 1376)
Drops a file with a compile date too recent
- Server3.exe (PID: 1376)
Executable content was dropped or overwritten
- Server3.exe (PID: 1376)
Drops a file with too old compile date
- Server3.exe (PID: 1376)
Executed via COM
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3856)
Starts Internet Explorer
- Server3.exe (PID: 1376)
INFO
Changes internet zones settings
- iexplore.exe (PID: 2376)
Application launched itself
- iexplore.exe (PID: 2376)
Creates files in the user directory
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3856)
Reads internet explorer settings
- iexplore.exe (PID: 1176)
- iexplore.exe (PID: 3028)
Reads settings of System Certificates
- iexplore.exe (PID: 2376)
Changes settings of System certificates
- iexplore.exe (PID: 2376)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:12:21 16:55:31+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 41984 |
| InitializedDataSize: | 1536 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xc2be |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 21-Dec-2020 15:55:31 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 21-Dec-2020 15:55:31 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00002000 | 0x0000A2C4 | 0x0000A400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.67665 |
.rsrc | 0x0000E000 | 0x00000400 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.51607 |
.reloc | 0x00010000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.0776332 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.00112 | 490 | UNKNOWN | UNKNOWN | RT_MANIFEST |
Imports
mscoree.dll |
Total processes
46
Monitored processes
7
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1176 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2376 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 1376 | "C:\Users\admin\AppData\Local\Temp\Server3.exe" | C:\Users\admin\AppData\Local\Temp\Server3.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1073807364 Modules
| |||||||||||||||
| 1844 | shutdown -s -t 00 | C:\Windows\system32\shutdown.exe | — | Server3.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Shutdown and Annotation Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2376 | "C:\Program Files\Internet Explorer\iexplore.exe" http://www.upload.ee/image/2971847/scare4.swf | C:\Program Files\Internet Explorer\iexplore.exe | Server3.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1073807364 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3028 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2376 CREDAT:4068620 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 3856 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Exit code: 1073807364 Version: 26,0,0,131 Modules
| |||||||||||||||
| 3908 | "C:\Users\admin\AppData\Local\Temp\.exe" | C:\Users\admin\AppData\Local\Temp\.exe | — | Server3.exe | |||||||||||
User: admin Company: Andy Feys Integrity Level: MEDIUM Description: Slider Exit code: 1073807364 Version: 1.0.0.0 Modules
| |||||||||||||||
Total events
1 425
Read events
1 183
Write events
241
Delete events
1
Modification events
| (PID) Process: | (1376) Server3.exe | Key: | HKEY_CURRENT_USER |
| Operation: | write | Name: | di |
Value: ! | |||
| (PID) Process: | (1376) Server3.exe | Key: | HKEY_CURRENT_USER\Environment |
| Operation: | write | Name: | SEE_MASK_NOZONECHECKS |
Value: 1 | |||
| (PID) Process: | (1376) Server3.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Windows Update |
Value: "C:\Users\admin\AppData\Local\Temp\Server3.exe" .. | |||
| (PID) Process: | (1376) Server3.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (1376) Server3.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (1376) Server3.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached |
| Operation: | write | Name: | {17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF |
Value: 01000000000000000E2F5E3DB3D7D601 | |||
| (PID) Process: | (2376) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: 1332395106 | |||
| (PID) Process: | (2376) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30857139 | |||
| (PID) Process: | (2376) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2376) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
Executable files
2
Suspicious files
11
Text files
3
Unknown types
24
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1176 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar258F.tmp | — | |
MD5:— | SHA256:— | |||
| 3856 | FlashUtil32_26_0_0_131_ActiveX.exe | C:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx:Zone.Identifier | — | |
MD5:— | SHA256:— | |||
| 3856 | FlashUtil32_26_0_0_131_ActiveX.exe | C:\Users\admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx | — | |
MD5:— | SHA256:— | |||
| 2376 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Cab32EC.tmp | — | |
MD5:— | SHA256:— | |||
| 2376 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Cab32ED.tmp | — | |
MD5:— | SHA256:— | |||
| 2376 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Tar32FD.tmp | — | |
MD5:— | SHA256:— | |||
| 2376 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Tar32FE.tmp | — | |
MD5:— | SHA256:— | |||
| 2376 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3028 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab4153.tmp | — | |
MD5:— | SHA256:— | |||
| 3028 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar4154.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
15
DNS requests
7
Threats
22
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3028 | iexplore.exe | GET | 302 | 37.187.167.53:80 | http://www.upload.ee/image/2299952/facey.swf | FR | — | — | whitelisted |
1176 | iexplore.exe | GET | 302 | 37.187.167.53:80 | http://www.upload.ee/image/2971847/scare4.swf | FR | — | — | whitelisted |
1176 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAilokbNS1yMg9cCtLurU0k%3D | US | der | 471 b | whitelisted |
2376 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
1176 | iexplore.exe | GET | 200 | 93.184.220.29:80 | http://status.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEAffP8uXPz%2BbuVistZM%2BMKI%3D | US | der | 471 b | shared |
3028 | iexplore.exe | GET | 302 | 37.187.167.53:80 | http://www.upload.ee/image/2299952/facey.swf | FR | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1376 | Server3.exe | 3.134.39.220:19457 | 0.tcp.ngrok.io | — | US | shared |
1176 | iexplore.exe | 37.187.167.53:80 | www.upload.ee | OVH SAS | FR | suspicious |
1176 | iexplore.exe | 37.187.167.53:443 | www.upload.ee | OVH SAS | FR | suspicious |
1176 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2376 | iexplore.exe | 37.187.167.53:443 | www.upload.ee | OVH SAS | FR | suspicious |
2376 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3028 | iexplore.exe | 37.187.167.53:80 | www.upload.ee | OVH SAS | FR | suspicious |
3028 | iexplore.exe | 37.187.167.53:443 | www.upload.ee | OVH SAS | FR | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
0.tcp.ngrok.io |
| malicious |
www.upload.ee |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
status.rapidssl.com |
| shared |
www.bing.com |
| whitelisted |
api.bing.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1052 | svchost.exe | Potential Corporate Privacy Violation | ET POLICY DNS Query to a *.ngrok domain (ngrok.io) |
1376 | Server3.exe | A Network Trojan was detected | ET TROJAN Bladabindi/njRAT CnC Command (ll) |
1376 | Server3.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT/Bladabindi |
1376 | Server3.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT.Gen RAT outbound connection |
3028 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY Outdated Flash Version M1 |
17 ETPRO signatures available at the full report