File name:

njrat.exe

Full analysis: https://app.any.run/tasks/9511c8c6-69da-476f-be50-dcffda30fe73
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 16:12:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
dcrat
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

A9DA4F13D6F4E2B8AF22548A107D8001

SHA1:

590B23477570B02B3C1C3F64968871389ECA6023

SHA256:

493E17F6CDA92E969227B3C3283736652F5EC04BC014A942E1993DAEEF165F9E

SSDEEP:

98304:4FrKdW1rcB281yYlx1qIvYl3FNZeNi8Ru1q59HC3NP1EcmbATD7Wa0iOes6J9cJv:4VoDPC/xA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8864)

    • DCRAT mutex has been found

      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 9744)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 8364)
      • fontdrvhost.exe (PID: 9072)
      • fontdrvhost.exe (PID: 8328)
      • fontdrvhost.exe (PID: 9560)
      • fontdrvhost.exe (PID: 8140)
      • fontdrvhost.exe (PID: 10100)
      • fontdrvhost.exe (PID: 3272)
      • fontdrvhost.exe (PID: 8644)
      • fontdrvhost.exe (PID: 8556)
      • fontdrvhost.exe (PID: 6072)
      • fontdrvhost.exe (PID: 7420)
      • fontdrvhost.exe (PID: 8624)
      • fontdrvhost.exe (PID: 9428)
      • fontdrvhost.exe (PID: 2984)
      • fontdrvhost.exe (PID: 632)

    • Changes Windows Defender settings

      • Hyperblockport.exe (PID: 7232)

    • Adds path to the Windows Defender exclusion list

      • Hyperblockport.exe (PID: 7232)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2644)
      • wscript.exe (PID: 8448)
      • wscript.exe (PID: 9676)
      • wscript.exe (PID: 9644)
      • wscript.exe (PID: 9924)
      • wscript.exe (PID: 9892)
      • wscript.exe (PID: 8896)
      • wscript.exe (PID: 9144)
      • wscript.exe (PID: 8324)
      • wscript.exe (PID: 9256)
      • wscript.exe (PID: 8564)
      • wscript.exe (PID: 7952)
      • wscript.exe (PID: 8424)
      • wscript.exe (PID: 9368)
      • wscript.exe (PID: 7208)
      • wscript.exe (PID: 9008)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 4224)
      • wscript.exe (PID: 9440)
      • wscript.exe (PID: 7200)
      • wscript.exe (PID: 6388)
      • wscript.exe (PID: 872)
      • wscript.exe (PID: 7364)
      • wscript.exe (PID: 684)
      • wscript.exe (PID: 9876)
      • wscript.exe (PID: 4868)
      • wscript.exe (PID: 7848)
      • wscript.exe (PID: 10048)
      • wscript.exe (PID: 5056)
      • wscript.exe (PID: 7956)
      • wscript.exe (PID: 7340)
      • wscript.exe (PID: 10216)
      • wscript.exe (PID: 5952)
      • wscript.exe (PID: 2092)
      • wscript.exe (PID: 8492)
      • wscript.exe (PID: 8216)
      • wscript.exe (PID: 9176)
      • wscript.exe (PID: 5868)
      • wscript.exe (PID: 6112)
      • wscript.exe (PID: 8400)
      • wscript.exe (PID: 7268)
      • wscript.exe (PID: 5744)
      • wscript.exe (PID: 8236)
      • wscript.exe (PID: 7732)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 5344)
      • wscript.exe (PID: 472)
      • wscript.exe (PID: 1568)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 8448)
      • wscript.exe (PID: 9644)
      • wscript.exe (PID: 9892)
      • wscript.exe (PID: 8896)
      • wscript.exe (PID: 8324)
      • wscript.exe (PID: 7952)
      • wscript.exe (PID: 9368)
      • wscript.exe (PID: 7208)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 6388)
      • wscript.exe (PID: 7364)
      • wscript.exe (PID: 684)
      • wscript.exe (PID: 4868)
      • wscript.exe (PID: 7848)
      • wscript.exe (PID: 10216)
      • wscript.exe (PID: 5056)
      • wscript.exe (PID: 5952)
      • wscript.exe (PID: 8216)
      • wscript.exe (PID: 9176)
      • wscript.exe (PID: 6112)
      • wscript.exe (PID: 5744)
      • wscript.exe (PID: 8236)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 1568)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • njrat.exe (PID: 7520)
      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9096)

    • Reads security settings of Internet Explorer

      • njrat.exe (PID: 7520)
      • ShellExperienceHost.exe (PID: 6800)
      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 8364)
      • fontdrvhost.exe (PID: 8328)
      • fontdrvhost.exe (PID: 9560)
      • fontdrvhost.exe (PID: 6072)
      • fontdrvhost.exe (PID: 9428)

    • Executed via WMI

      • schtasks.exe (PID: 4620)
      • schtasks.exe (PID: 1052)
      • schtasks.exe (PID: 920)
      • schtasks.exe (PID: 3240)
      • schtasks.exe (PID: 7548)
      • schtasks.exe (PID: 7540)
      • schtasks.exe (PID: 7596)
      • schtasks.exe (PID: 2096)
      • schtasks.exe (PID: 8008)
      • schtasks.exe (PID: 8096)
      • schtasks.exe (PID: 4980)
      • schtasks.exe (PID: 8160)
      • schtasks.exe (PID: 7992)
      • schtasks.exe (PID: 7236)
      • schtasks.exe (PID: 7084)
      • schtasks.exe (PID: 4692)
      • schtasks.exe (PID: 6668)
      • schtasks.exe (PID: 7648)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7572)
      • wscript.exe (PID: 8448)
      • wscript.exe (PID: 9644)
      • wscript.exe (PID: 9892)
      • wscript.exe (PID: 8896)
      • wscript.exe (PID: 8324)
      • wscript.exe (PID: 7952)
      • wscript.exe (PID: 9368)
      • wscript.exe (PID: 7208)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 6388)
      • wscript.exe (PID: 7364)
      • wscript.exe (PID: 684)
      • wscript.exe (PID: 4868)
      • wscript.exe (PID: 7848)
      • wscript.exe (PID: 10216)
      • wscript.exe (PID: 5952)
      • wscript.exe (PID: 5056)
      • wscript.exe (PID: 8216)
      • wscript.exe (PID: 9176)
      • wscript.exe (PID: 5744)
      • wscript.exe (PID: 8236)
      • wscript.exe (PID: 6112)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 1568)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 7572)
      • Hyperblockport.exe (PID: 7232)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 7572)
      • Hyperblockport.exe (PID: 7232)

    • The process creates files with name similar to system file names

      • Hyperblockport.exe (PID: 7232)

    • Script adds exclusion path to Windows Defender

      • Hyperblockport.exe (PID: 7232)

    • Starts POWERSHELL.EXE for commands execution

      • Hyperblockport.exe (PID: 7232)

    • Reads the date of Windows installation

      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 10104)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 8140)
      • fontdrvhost.exe (PID: 10100)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 7020)

    • The process executes VB scripts

      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 10104)
      • fontdrvhost.exe (PID: 9744)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8364)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 9072)
      • fontdrvhost.exe (PID: 8328)
      • fontdrvhost.exe (PID: 9572)
      • fontdrvhost.exe (PID: 9560)
      • fontdrvhost.exe (PID: 8140)
      • fontdrvhost.exe (PID: 10100)
      • fontdrvhost.exe (PID: 3272)
      • fontdrvhost.exe (PID: 8644)
      • fontdrvhost.exe (PID: 8556)
      • fontdrvhost.exe (PID: 7420)
      • fontdrvhost.exe (PID: 6072)
      • fontdrvhost.exe (PID: 8624)
      • fontdrvhost.exe (PID: 2984)
      • fontdrvhost.exe (PID: 632)
      • fontdrvhost.exe (PID: 9428)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 8448)
      • wscript.exe (PID: 2644)
      • wscript.exe (PID: 9676)
      • wscript.exe (PID: 9644)
      • wscript.exe (PID: 9892)
      • wscript.exe (PID: 9924)
      • wscript.exe (PID: 8896)
      • wscript.exe (PID: 8324)
      • wscript.exe (PID: 9144)
      • wscript.exe (PID: 7952)
      • wscript.exe (PID: 9256)
      • wscript.exe (PID: 8564)
      • wscript.exe (PID: 9368)
      • wscript.exe (PID: 8424)
      • wscript.exe (PID: 9008)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 7208)
      • wscript.exe (PID: 6388)
      • wscript.exe (PID: 9440)
      • wscript.exe (PID: 4224)
      • wscript.exe (PID: 7200)
      • wscript.exe (PID: 684)
      • wscript.exe (PID: 7364)
      • wscript.exe (PID: 872)
      • wscript.exe (PID: 9876)
      • wscript.exe (PID: 4868)
      • wscript.exe (PID: 7848)
      • wscript.exe (PID: 10048)
      • wscript.exe (PID: 10216)
      • wscript.exe (PID: 7340)
      • wscript.exe (PID: 5056)
      • wscript.exe (PID: 7956)
      • wscript.exe (PID: 2092)
      • wscript.exe (PID: 5952)
      • wscript.exe (PID: 8216)
      • wscript.exe (PID: 8492)
      • wscript.exe (PID: 7268)
      • wscript.exe (PID: 9176)
      • wscript.exe (PID: 5868)
      • wscript.exe (PID: 5744)
      • wscript.exe (PID: 8400)
      • wscript.exe (PID: 6112)
      • wscript.exe (PID: 8236)
      • wscript.exe (PID: 7732)
      • wscript.exe (PID: 1568)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 5344)
      • wscript.exe (PID: 472)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 8448)
      • wscript.exe (PID: 9644)
      • wscript.exe (PID: 9892)
      • wscript.exe (PID: 8896)
      • wscript.exe (PID: 8324)
      • wscript.exe (PID: 7952)
      • wscript.exe (PID: 9368)
      • wscript.exe (PID: 7208)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 6388)
      • wscript.exe (PID: 7364)
      • wscript.exe (PID: 684)
      • wscript.exe (PID: 4868)
      • wscript.exe (PID: 7848)
      • wscript.exe (PID: 10216)
      • wscript.exe (PID: 5952)
      • wscript.exe (PID: 5056)
      • wscript.exe (PID: 8216)
      • wscript.exe (PID: 9176)
      • wscript.exe (PID: 5744)
      • wscript.exe (PID: 8236)
      • wscript.exe (PID: 6112)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 1568)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 8448)
      • wscript.exe (PID: 9644)
      • wscript.exe (PID: 9892)
      • wscript.exe (PID: 8896)
      • wscript.exe (PID: 8324)
      • wscript.exe (PID: 7952)
      • wscript.exe (PID: 9368)
      • wscript.exe (PID: 7208)
      • wscript.exe (PID: 6388)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 684)
      • wscript.exe (PID: 7364)
      • wscript.exe (PID: 4868)
      • wscript.exe (PID: 7848)
      • wscript.exe (PID: 5056)
      • wscript.exe (PID: 10216)
      • wscript.exe (PID: 5952)
      • wscript.exe (PID: 8216)
      • wscript.exe (PID: 9176)
      • wscript.exe (PID: 5744)
      • wscript.exe (PID: 6112)
      • wscript.exe (PID: 8236)
      • wscript.exe (PID: 8304)
      • wscript.exe (PID: 1568)

    • The process executes via Task Scheduler

      • csrss.exe (PID: 7192)

  • INFO

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • njrat.exe (PID: 7520)

    • The sample compiled with english language support

      • njrat.exe (PID: 7520)
      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9096)

    • Reads the computer name

      • njrat.exe (PID: 7520)
      • Hyperblockport.exe (PID: 7232)
      • ShellExperienceHost.exe (PID: 6800)
      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 9744)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8328)
      • fontdrvhost.exe (PID: 7420)

    • Checks supported languages

      • njrat.exe (PID: 7520)
      • Hyperblockport.exe (PID: 7232)
      • ShellExperienceHost.exe (PID: 6800)
      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9744)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 10104)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 8364)
      • fontdrvhost.exe (PID: 8328)
      • fontdrvhost.exe (PID: 9560)
      • fontdrvhost.exe (PID: 8140)
      • fontdrvhost.exe (PID: 10100)
      • fontdrvhost.exe (PID: 3272)

    • Process checks computer location settings

      • njrat.exe (PID: 7520)
      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9744)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 10104)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 8364)
      • fontdrvhost.exe (PID: 8140)
      • fontdrvhost.exe (PID: 10100)
      • fontdrvhost.exe (PID: 3272)

    • Reads Environment values

      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9744)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 9072)
      • fontdrvhost.exe (PID: 7420)

    • Process checks whether UAC notifications are on

      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 8556)
      • fontdrvhost.exe (PID: 632)

    • Reads the machine GUID from the registry

      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 9744)
      • fontdrvhost.exe (PID: 10104)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 8364)
      • fontdrvhost.exe (PID: 9072)
      • fontdrvhost.exe (PID: 8328)
      • fontdrvhost.exe (PID: 9572)
      • fontdrvhost.exe (PID: 8140)
      • fontdrvhost.exe (PID: 9560)
      • fontdrvhost.exe (PID: 10100)
      • fontdrvhost.exe (PID: 3272)
      • fontdrvhost.exe (PID: 8644)
      • fontdrvhost.exe (PID: 8556)
      • fontdrvhost.exe (PID: 6072)
      • fontdrvhost.exe (PID: 8624)
      • fontdrvhost.exe (PID: 9428)
      • fontdrvhost.exe (PID: 632)

    • Creates files in the program directory

      • Hyperblockport.exe (PID: 7232)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2136)
      • powershell.exe (PID: 7380)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 7972)
      • powershell.exe (PID: 8052)
      • powershell.exe (PID: 5428)
      • powershell.exe (PID: 7220)
      • powershell.exe (PID: 8088)
      • powershell.exe (PID: 7584)
      • powershell.exe (PID: 2284)
      • powershell.exe (PID: 8156)
      • powershell.exe (PID: 7928)
      • powershell.exe (PID: 7960)
      • powershell.exe (PID: 7592)

    • Create files in a temporary directory

      • Hyperblockport.exe (PID: 7232)
      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 9744)
      • fontdrvhost.exe (PID: 10104)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8364)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 9072)
      • fontdrvhost.exe (PID: 8328)
      • fontdrvhost.exe (PID: 9572)
      • fontdrvhost.exe (PID: 8140)
      • fontdrvhost.exe (PID: 9560)
      • fontdrvhost.exe (PID: 10100)
      • fontdrvhost.exe (PID: 3272)
      • fontdrvhost.exe (PID: 8644)
      • fontdrvhost.exe (PID: 8556)
      • fontdrvhost.exe (PID: 6072)
      • fontdrvhost.exe (PID: 8624)
      • fontdrvhost.exe (PID: 9428)

    • Reads Microsoft Office registry keys

      • fontdrvhost.exe (PID: 9096)
      • fontdrvhost.exe (PID: 9500)
      • fontdrvhost.exe (PID: 9744)
      • fontdrvhost.exe (PID: 10104)
      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8244)
      • fontdrvhost.exe (PID: 8328)
      • fontdrvhost.exe (PID: 9572)
      • fontdrvhost.exe (PID: 9560)
      • fontdrvhost.exe (PID: 2984)
      • fontdrvhost.exe (PID: 9428)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2136)
      • powershell.exe (PID: 5428)
      • powershell.exe (PID: 8052)
      • powershell.exe (PID: 7972)
      • powershell.exe (PID: 8088)
      • powershell.exe (PID: 7584)
      • powershell.exe (PID: 7220)
      • powershell.exe (PID: 7592)
      • powershell.exe (PID: 7960)
      • powershell.exe (PID: 7928)
      • powershell.exe (PID: 8156)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 7380)
      • powershell.exe (PID: 2284)

    • Disables trace logs

      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8864)
      • fontdrvhost.exe (PID: 3272)

    • Checks proxy server information

      • fontdrvhost.exe (PID: 8524)
      • fontdrvhost.exe (PID: 960)
      • fontdrvhost.exe (PID: 8364)
      • fontdrvhost.exe (PID: 3272)
      • fontdrvhost.exe (PID: 632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 18:00:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 75776
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
273
Monitored processes
133
Malicious processes
53
Suspicious processes
24

Behavior graph

Click at the process to see the details
start njrat.exe wscript.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs #DCRAT hyperblockport.exe shellexperiencehost.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs w32tm.exe no specs #DCRAT fontdrvhost.exe wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs slui.exe #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs #DCRAT fontdrvhost.exe no specs wscript.exe no specs wscript.exe no specs csrss.exe no specs fontdrvhost.exe no specs njrat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\e2ae5d03-1ce2-4f2d-b50a-53de7da13406.vbs" C:\Windows\System32\wscript.exe—fontdrvhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632C:\Windows\SchCache\fontdrvhost.exeC:\Windows\SchCache\fontdrvhost.exe
wscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\windows\schcache\fontdrvhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
684"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\81cd128c-4547-4777-a2a7-9ab560b701cc.vbs" C:\Windows\System32\wscript.exe—fontdrvhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
872"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\2ec064ae-c073-4e06-92b9-9e1843ccfbb0.vbs" C:\Windows\System32\wscript.exe—fontdrvhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\containerperf\backgroundTaskHost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
960C:\Windows\SchCache\fontdrvhost.exeC:\Windows\SchCache\fontdrvhost.exe
wscript.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\windows\schcache\fontdrvhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1052schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\containerperf\backgroundTaskHost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\15f42484-c5ae-4aa5-83bd-33344043b1d5.vbs" C:\Windows\System32\wscript.exe—fontdrvhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2092"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\bfb66429-1b4b-4199-896c-60333192ad4c.vbs" C:\Windows\System32\wscript.exe—fontdrvhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2096schtasks.exe /create /tn "sluis" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\slui.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
153 122
Read events
152 953
Write events
169
Delete events
0

Modification events

(PID) Process:(7520) njrat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(7232) Hyperblockport.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(7232) Hyperblockport.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
0
(PID) Process:(7232) Hyperblockport.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:PromptOnSecureDesktop
Value:
0
(PID) Process:(7232) Hyperblockport.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F00620000000000000000000000010000000000000000000000
(PID) Process:(6800) ShellExperienceHost.exeKey:\REGISTRY\A\{2e58ef82-5248-5666-74ac-1c13c365f231}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D000000691D0A95D79CDB01
(PID) Process:(7232) Hyperblockport.exeKey:HKEY_CURRENT_USER\SOFTWARE\da431eb9c000e6cba951a6bfebaefc180d56e39c
Operation:writeName:d7841ab09fc04dab22ac067994e6c69d654b646d
Value:
WyJDOlxcY29udGFpbmVycGVyZlxcSHlwZXJibG9ja3BvcnQuZXhlIiwiQzpcXGNvbnRhaW5lcnBlcmZcXGJhY2tncm91bmRUYXNrSG9zdC5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlcyAoeDg2KVxcT3BlcmFcXHNsdWkuZXhlIiwiQzpcXFdpbmRvd3NcXFNjaENhY2hlXFxmb250ZHJ2aG9zdC5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlcyAoeDg2KVxcV2luZG93cyBQaG90byBWaWV3ZXJcXHNsdWkuZXhlIiwiQzpcXFByb2dyYW0gRmlsZXMgKHg4NilcXE1pY3Jvc29mdC5ORVRcXFJlZGlzdExpc3RcXGNzcnNzLmV4ZSIsIkM6XFxmb3VuZC4wMDBcXGRpcl8wMDAwMDAwMi5jaGtcXGxzYXNzLmV4ZSJd
(PID) Process:(7232) Hyperblockport.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(7232) Hyperblockport.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(9096) fontdrvhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
Executable files
8
Suspicious files
2
Text files
85
Unknown types
0

Dropped files

PID
Process
Filename
Type
7520njrat.exeC:\containerperf\GqIVhrHBUpNCPyn.vbebinary
MD5:90A2E983F0C16682198551AFA3E7A353
SHA256:67665265C0172B2C6DF484A2805B852845AE8EE1FC44CC1AB369E8B1E7FF5C00
7520njrat.exeC:\containerperf\NNqy8Xs9dr.battext
MD5:7A122E2BF760C3BA657E5BA59337BCE2
SHA256:B9469F10268A8E4A44814D71F3EB6530F2A4970933B586F6DC5E3EEBB2FE33F8
7520njrat.exeC:\containerperf\Hyperblockport.exeexecutable
MD5:4DC6258599C742FA6E6330FE6037D8E5
SHA256:C3722D45E834305961FC21E8A473C049E7EC937EF4F94FF3DDE8A82DEE99CB6B
7232Hyperblockport.exeC:\containerperf\backgroundTaskHost.exeexecutable
MD5:4DC6258599C742FA6E6330FE6037D8E5
SHA256:C3722D45E834305961FC21E8A473C049E7EC937EF4F94FF3DDE8A82DEE99CB6B
7232Hyperblockport.exeC:\found.000\dir_00000002.chk\lsass.exeexecutable
MD5:4DC6258599C742FA6E6330FE6037D8E5
SHA256:C3722D45E834305961FC21E8A473C049E7EC937EF4F94FF3DDE8A82DEE99CB6B
7232Hyperblockport.exeC:\Program Files (x86)\Windows Photo Viewer\slui.exeexecutable
MD5:4DC6258599C742FA6E6330FE6037D8E5
SHA256:C3722D45E834305961FC21E8A473C049E7EC937EF4F94FF3DDE8A82DEE99CB6B
7232Hyperblockport.exeC:\Users\admin\AppData\Local\Temp\axYga8iI84text
MD5:CD5C196DFEAD5FE68752A98E95091409
SHA256:564C250E4B3F3C6E7C027D0DF7A30AF5B08F9FA6FE9CEA3F44667CA4A2154012
7220powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mvzhzuir.nxj.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7232Hyperblockport.exeC:\Program Files (x86)\Microsoft.NET\RedistList\csrss.exeexecutable
MD5:4DC6258599C742FA6E6330FE6037D8E5
SHA256:C3722D45E834305961FC21E8A473C049E7EC937EF4F94FF3DDE8A82DEE99CB6B
7232Hyperblockport.exeC:\Program Files (x86)\Windows Photo Viewer\a29f4157103644text
MD5:3EDC64B71FE8E245C53DB2BD4FC777A3
SHA256:6EC4FB0F89555B3EB7A0C19905321D729E1C6076FFFBC21F6B210755FC548BBD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
41
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7776
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6324
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6324
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7776
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7776
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.3
  • 20.190.160.132
  • 40.126.32.72
  • 20.190.160.65
  • 20.190.160.131
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
bupsudn0.beget.tech
  • —
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
njrat.exe