| File name: | mta.rar |
| Full analysis: | https://app.any.run/tasks/cf2e875e-88b4-4dc9-9dc5-d08888e7f6fb |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | April 01, 2023, 09:41:49 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | 85C690A940EBE4FAF66452A10EF20CB8 |
| SHA1: | FE111328DBD9A07F6511CBD78C3BF030C369437D |
| SHA256: | 43AE67F3D7AD97327C5B77AA18B7E80804B16F5EECE3792FC963AC07B60E4DCF |
| SSDEEP: | 384:kPPtZEdfJM0xkS5LbvA10FXqFgd6V1Wwxfb86owT/k0muCJO0e/:kPPrGBM3S5LLAyqFgd6V1VjbT/k02pe/ |
MALICIOUS
Application was dropped or rewritten from another process
- mta.exe (PID: 3384)
Create files in the Startup directory
- mta.exe (PID: 3384)
NjRAT is detected
- mta.exe (PID: 3384)
Changes the autorun value in the registry
- mta.exe (PID: 3384)
NJRAT detected by memory dumps
- mta.exe (PID: 3384)
Starts CMD.EXE for self-deleting
- mta.exe (PID: 3384)
NJRAT was detected
- mta.exe (PID: 3384)
Connects to the CnC server
- mta.exe (PID: 3384)
SUSPICIOUS
Uses NETSH.EXE to add a firewall rule or allowed programs
- mta.exe (PID: 3384)
Executable content was dropped or overwritten
- mta.exe (PID: 3384)
Starts CMD.EXE for commands execution
- mta.exe (PID: 3384)
Uses NETSH.EXE to delete a firewall rule or allowed programs
- mta.exe (PID: 3384)
Connects to unusual port
- mta.exe (PID: 3384)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2064)
Checks supported languages
- mta.exe (PID: 3384)
- wmpnscfg.exe (PID: 2592)
Creates files or folders in the user directory
- mta.exe (PID: 3384)
The process checks LSA protection
- netsh.exe (PID: 3668)
- mta.exe (PID: 3384)
- wmpnscfg.exe (PID: 2592)
- netsh.exe (PID: 3416)
Reads the machine GUID from the registry
- mta.exe (PID: 3384)
- wmpnscfg.exe (PID: 2592)
Reads Environment values
- mta.exe (PID: 3384)
Reads the computer name
- mta.exe (PID: 3384)
- wmpnscfg.exe (PID: 2592)
[YARA] Firewall manipulation strings were found
- mta.exe (PID: 3384)
Manual execution by a user
- wmpnscfg.exe (PID: 2592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
NjRat
(PID) Process(3384) mta.exe
C2147.185.221.181
Ports24308
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\edaab890a6da9d9cf96cc12743e7184b
Splitter|'|'|
Versionim523
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
45
Monitored processes
7
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2064 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\mta.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2592 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3384 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2064.10351\mta.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2064.10351\mta.exe | WinRAR.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
NjRat(PID) Process(3384) mta.exe C2147.185.221.181 Ports24308 BotnetHacKed Options Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\edaab890a6da9d9cf96cc12743e7184b Splitter|'|'| Versionim523 | |||||||||||||||
| 3416 | netsh firewall delete allowedprogram "C:\Users\admin\AppData\Local\Temp\Rar$EXa2064.10351\mta.exe" | C:\Windows\System32\netsh.exe | — | mta.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3532 | cmd.exe /k ping 0 & del "C:\Users\admin\AppData\Local\Temp\Rar$EXa2064.10351\mta.exe" & exit | C:\Windows\System32\cmd.exe | — | mta.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3668 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\Rar$EXa2064.10351\mta.exe" "mta.exe" ENABLE | C:\Windows\System32\netsh.exe | — | mta.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3936 | ping 0 | C:\Windows\System32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
5 180
Read events
4 920
Write events
250
Delete events
10
Modification events
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\phacker.zip | |||
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2064) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
Executable files
4
Suspicious files
0
Text files
6
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2064 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2064.10351\mta.exe | executable | |
MD5:— | SHA256:— | |||
| 2064 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2064.10351\esp.dll | text | |
MD5:— | SHA256:— | |||
| 2064 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2064.10351\dperg.dll | text | |
MD5:— | SHA256:— | |||
| 3384 | mta.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edaab890a6da9d9cf96cc12743e7184b.exe | executable | |
MD5:— | SHA256:— | |||
| 2064 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2064.10351\aimdr.dll | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
3
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3384 | mta.exe | 147.185.221.181:24308 | — | PLAYIT-GG | US | malicious |
DNS requests
Threats
PID | Process | Class | Message |
|---|---|---|---|
3384 | mta.exe | Unknown Classtype | ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) |
2 ETPRO signatures available at the full report