| File name: | Mod menu sms bomber.exe |
| Full analysis: | https://app.any.run/tasks/5f85238b-cf0b-485d-ae3e-234df981f1cf |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | April 02, 2024, 13:23:03 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | A4D612081DBFEF6E69EDAAB680D6F20D |
| SHA1: | 55C2B4655CE72F52D8A93624A6898301789ED437 |
| SHA256: | 581D6E5A8472C8C1E3862EC241925901ED1BFFDE7D550BBCDDBCBBE8D01093D6 |
| SSDEEP: | 768:EsPAvLyqhxQdh6t7vaSriIPyWw7sBWS/CFtkgiajVQNPl1Rz4Rk3esOdMTRBto:RwftraSWAw72F/CFtuZl1dDCSTRP |
MALICIOUS
NJRAT has been detected (SURICATA)
- Mod menu sms bomber.exe (PID: 1836)
Connects to the CnC server
- Mod menu sms bomber.exe (PID: 1836)
Drops the executable file immediately after the start
- Mod menu sms bomber.exe (PID: 1836)
NJRAT has been detected (YARA)
- Mod menu sms bomber.exe (PID: 1836)
SUSPICIOUS
Uses NETSH.EXE to add a firewall rule or allowed programs
- Mod menu sms bomber.exe (PID: 1836)
Reads security settings of Internet Explorer
- Mod menu sms bomber.exe (PID: 1836)
Connects to unusual port
- Mod menu sms bomber.exe (PID: 1836)
Reads the Internet Settings
- Mod menu sms bomber.exe (PID: 1836)
The process executes VB scripts
- Mod menu sms bomber.exe (PID: 1836)
INFO
Reads the machine GUID from the registry
- Mod menu sms bomber.exe (PID: 1836)
Checks supported languages
- Mod menu sms bomber.exe (PID: 1836)
Reads the computer name
- Mod menu sms bomber.exe (PID: 1836)
Reads Environment values
- Mod menu sms bomber.exe (PID: 1836)
Creates files or folders in the user directory
- Mod menu sms bomber.exe (PID: 1836)
Create files in a temporary directory
- Mod menu sms bomber.exe (PID: 1836)
Manual execution by a user
- notepad.exe (PID: 1112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
NjRat
(PID) Process(1836) Mod menu sms bomber.exe
C294.73.231.235
Ports1488
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\d49fdf56d02c11b92350e19f54509091
Splitter|'|'|
Version0.7d
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:04:02 09:30:40+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 94208 |
| InitializedDataSize: | 512 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x18f2e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
50
Monitored processes
10
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 844 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.vbs" | C:\Windows\System32\wscript.exe | — | Mod menu sms bomber.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 1112 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\negri pidori.txt | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1484 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.vbs" | C:\Windows\System32\wscript.exe | — | Mod menu sms bomber.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 1816 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.vbs" | C:\Windows\System32\wscript.exe | — | Mod menu sms bomber.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 1836 | "C:\Users\admin\AppData\Local\Temp\Mod menu sms bomber.exe" | C:\Users\admin\AppData\Local\Temp\Mod menu sms bomber.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
NjRat(PID) Process(1836) Mod menu sms bomber.exe C294.73.231.235 Ports1488 BotnetHacKed Options Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\d49fdf56d02c11b92350e19f54509091 Splitter|'|'| Version0.7d | |||||||||||||||
| 2572 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\Mod menu sms bomber.exe" "Mod menu sms bomber.exe" ENABLE | C:\Windows\System32\netsh.exe | — | Mod menu sms bomber.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2632 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.vbs" | C:\Windows\System32\wscript.exe | — | Mod menu sms bomber.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2760 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.vbs" | C:\Windows\System32\wscript.exe | — | Mod menu sms bomber.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 3540 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.vbs" | C:\Windows\System32\wscript.exe | — | Mod menu sms bomber.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 3984 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.vbs" | C:\Windows\System32\wscript.exe | — | Mod menu sms bomber.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Version: 5.8.7600.16385 Modules
| |||||||||||||||
Total events
4 875
Read events
4 799
Write events
76
Delete events
0
Modification events
| (PID) Process: | (1836) Mod menu sms bomber.exe | Key: | HKEY_CURRENT_USER\Environment |
| Operation: | write | Name: | SEE_MASK_NOZONECHECKS |
Value: 1 | |||
| (PID) Process: | (2572) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2572) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\dhcpqec.dll,-100 |
Value: DHCP Quarantine Enforcement Client | |||
| (PID) Process: | (2572) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\dhcpqec.dll,-101 |
Value: Provides DHCP based enforcement for NAP | |||
| (PID) Process: | (2572) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\dhcpqec.dll,-103 |
Value: 1.0 | |||
| (PID) Process: | (2572) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\dhcpqec.dll,-102 |
Value: Microsoft Corporation | |||
| (PID) Process: | (2572) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\napipsec.dll,-1 |
Value: IPsec Relying Party | |||
| (PID) Process: | (2572) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\napipsec.dll,-2 |
Value: Provides IPsec based enforcement for Network Access Protection | |||
| (PID) Process: | (2572) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\napipsec.dll,-4 |
Value: 1.0 | |||
| (PID) Process: | (2572) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\napipsec.dll,-3 |
Value: Microsoft Corporation | |||
Executable files
0
Suspicious files
0
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1836 | Mod menu sms bomber.exe | C:\Users\admin\AppData\Roaming\app | text | |
MD5:— | SHA256:— | |||
| 1836 | Mod menu sms bomber.exe | C:\Users\admin\AppData\Local\Temp\�������.jpg | image | |
MD5:— | SHA256:— | |||
| 1836 | Mod menu sms bomber.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\tempxxSD.vbs | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
0
Threats
318
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1836 | Mod menu sms bomber.exe | 94.73.231.235:1488 | — | Orion Telecom LLC | RU | unknown |
DNS requests
Threats
PID | Process | Class | Message |
|---|---|---|---|
1836 | Mod menu sms bomber.exe | Malware Command and Control Activity Detected | ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) |
— | — | Malware Command and Control Activity Detected | ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop) |
— | — | Malware Command and Control Activity Detected | ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) |
— | — | Malware Command and Control Activity Detected | ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) |
— | — | Malware Command and Control Activity Detected | ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) |
— | — | Malware Command and Control Activity Detected | ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) |
— | — | Malware Command and Control Activity Detected | ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) |
— | — | Malware Command and Control Activity Detected | ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) |
— | — | Malware Command and Control Activity Detected | ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) |
— | — | Malware Command and Control Activity Detected | ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) |
2 ETPRO signatures available at the full report