analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Njrat.exe |
| Full analysis: | https://app.any.run/tasks/36d5489c-e737-4832-be3f-72d6dba85329 |
| Verdict: | Malicious activity |
| Threats: | DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim. |
| Analysis date: | May 20, 2022, 16:20:28 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5: | 46917F3212638687EC4839BAE1DEBFFF |
| SHA1: | A926177772765A01E51AE2855EFC07826EFEC52A |
| SHA256: | 5B38B79BC7FC0C12910E4D864F924A040FDB9C38AFCC9AEDA7CF34E3768906B1 |
| SSDEEP: | 6144:OcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37+:OcW7KEZlPzCy37+ |
MALICIOUS
Changes the autorun value in the registry
- Njrat.exe (PID: 2964)
- msdcsc.exe (PID: 480)
- iexplore.exe (PID: 2408)
Changes the login/logoff helper path in the registry
- Njrat.exe (PID: 2964)
Drops executable file immediately after starts
- Njrat.exe (PID: 2964)
Changes Security Center notification settings
- iexplore.exe (PID: 2408)
- msdcsc.exe (PID: 480)
DARKCOMET detected by memory dumps
- iexplore.exe (PID: 2408)
DARKCOMET was detected
- iexplore.exe (PID: 2408)
SUSPICIOUS
Executable content was dropped or overwritten
- Njrat.exe (PID: 2964)
Reads the computer name
- Njrat.exe (PID: 2964)
- msdcsc.exe (PID: 480)
Checks supported languages
- Njrat.exe (PID: 2964)
- cmd.exe (PID: 3428)
- cmd.exe (PID: 2084)
- msdcsc.exe (PID: 480)
Starts CMD.EXE for commands execution
- Njrat.exe (PID: 2964)
Drops a file with a compile date too recent
- Njrat.exe (PID: 2964)
Starts itself from another location
- Njrat.exe (PID: 2964)
Uses ATTRIB.EXE to modify file attributes
- cmd.exe (PID: 3428)
- cmd.exe (PID: 2084)
Reads the date of Windows installation
- Njrat.exe (PID: 2964)
Starts Internet Explorer
- msdcsc.exe (PID: 480)
INFO
Checks supported languages
- notepad.exe (PID: 3504)
- attrib.exe (PID: 3972)
- attrib.exe (PID: 3896)
- iexplore.exe (PID: 2408)
- notepad.exe (PID: 2712)
Reads the computer name
- iexplore.exe (PID: 2408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
DarkComet
(PID) Process(2408) iexplore.exe
Offline keyloggerTrue
PERS1
CHIDED1
CHIDEF1
SH101
SH91
SH81
SH71
SH61
SH51
SH41
SH31
SH11
File attrubutesTrue
Directory attributesTrue
Change Date0
MELT1
PersistanceTrue
Edit date2007-04-16
Registry keyMicroUpdate
Install pathMSDCSC\msdcsc.exe
COMBOPATH7
InstallTrue
gencode4cUaqJlWNM8B
FWB1
sidGuest16
MutexDC_MUTEX-X6Z6AGP
Version#KCMDDC51#
C2 (1)5.129.36.73:1604
TRiD
| .exe | | | UPX compressed Win32 Executable (38.2) |
|---|---|---|
| .exe | | | Win32 EXE Yoda's Crypter (37.5) |
| .dll | | | Win32 Dynamic Link Library (generic) (9.2) |
| .exe | | | Win32 Executable (generic) (6.3) |
| .exe | | | Win16/32 Executable Delphi generic (2.9) |
EXIF
EXE
| ProductVersion: | 4, 0, 0, 0 |
|---|---|
| ProductName: | Remote Service Application |
| OriginalFileName: | MSRSAAP.EXE |
| LegalCopyright: | Copyright (C) 1999 |
| InternalName: | MSRSAAPP |
| FileVersion: | 1, 0, 0, 1 |
| FileDescription: | Remote Service Application |
| CompanyName: | Microsoft Corp. |
| Comments: | Remote Service Application |
| CharacterSet: | Unicode |
| LanguageCode: | English (U.S.) |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Win32 |
| FileFlags: | (none) |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 4.0.0.0 |
| FileVersionNumber: | 4.0.0.0 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 4 |
| ImageVersion: | - |
| OSVersion: | 4 |
| EntryPoint: | 0xb5820 |
| UninitializedDataSize: | 487424 |
| InitializedDataSize: | 4096 |
| CodeSize: | 253952 |
| LinkerVersion: | 2.25 |
| PEType: | PE32 |
| TimeStamp: | 2012:06:07 17:59:53+02:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 07-Jun-2012 15:59:53 |
| Detected languages: |
|
| Comments: | Remote Service Application |
| CompanyName: | Microsoft Corp. |
| FileDescription: | Remote Service Application |
| FileVersion: | 1, 0, 0, 1 |
| InternalName: | MSRSAAPP |
| LegalCopyright: | Copyright (C) 1999 |
| OriginalFilename: | MSRSAAP.EXE |
| ProductName: | Remote Service Application |
| ProductVersion: | 4, 0, 0, 0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0050 |
| Pages in file: | 0x0002 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x000F |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x001A |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000100 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 07-Jun-2012 15:59:53 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x00077000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x00078000 | 0x0003E000 | 0x0003DC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.92304 |
.rsrc | 0x000B6000 | 0x00001000 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.52074 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 3.34616 | 856 | Latin 1 / Western European | French - France | RT_VERSION |
2 | 7.02531 | 308 | Latin 1 / Western European | English - United States | RT_CURSOR |
3 | 7.16168 | 308 | Latin 1 / Western European | English - United States | RT_CURSOR |
4 | 7.32379 | 308 | Latin 1 / Western European | English - United States | RT_CURSOR |
5 | 7.17598 | 308 | Latin 1 / Western European | English - United States | RT_CURSOR |
6 | 7.15949 | 308 | Latin 1 / Western European | English - United States | RT_CURSOR |
7 | 7.1298 | 308 | Latin 1 / Western European | English - United States | RT_CURSOR |
4083 | 7.45862 | 524 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4084 | 7.65064 | 1020 | Latin 1 / Western European | UNKNOWN | RT_STRING |
4085 | 6.84604 | 168 | Latin 1 / Western European | UNKNOWN | RT_STRING |
Imports
AVICAP32.DLL |
KERNEL32.DLL |
SHFolder.dll |
URLMON.DLL |
WS2_32.DLL |
advapi32.dll |
comctl32.dll |
gdi32.dll |
gdiplus.dll |
msacm32.dll |
Total processes
43
Monitored processes
9
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2964 | "C:\Users\admin\AppData\Local\Temp\Njrat.exe" | C:\Users\admin\AppData\Local\Temp\Njrat.exe | Explorer.EXE | |
User: admin Company: Microsoft Corp. Integrity Level: MEDIUM Description: Remote Service Application Exit code: 0 Version: 1, 0, 0, 1 | ||||
| 3428 | "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\admin\AppData\Local\Temp\Njrat.exe" +s +h | C:\Windows\System32\cmd.exe | — | Njrat.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2084 | "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\admin\AppData\Local\Temp" +s +h | C:\Windows\System32\cmd.exe | — | Njrat.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 3504 | notepad | C:\Windows\system32\notepad.exe | — | Njrat.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 3896 | attrib "C:\Users\admin\AppData\Local\Temp" +s +h | C:\Windows\system32\attrib.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 3972 | attrib "C:\Users\admin\AppData\Local\Temp\Njrat.exe" +s +h | C:\Windows\system32\attrib.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 480 | "C:\Users\admin\Documents\MSDCSC\msdcsc.exe" | C:\Users\admin\Documents\MSDCSC\msdcsc.exe | Njrat.exe | |
User: admin Company: Microsoft Corp. Integrity Level: MEDIUM Description: Remote Service Application Exit code: 0 Version: 1, 0, 0, 1 | ||||
| 2408 | "C:\Program Files\Internet Explorer\iexplore.exe" | C:\Program Files\Internet Explorer\iexplore.exe | msdcsc.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) DarkComet(PID) Process(2408) iexplore.exe Offline keyloggerTrue PERS1 CHIDED1 CHIDEF1 SH101 SH91 SH81 SH71 SH61 SH51 SH41 SH31 SH11 File attrubutesTrue Directory attributesTrue Change Date0 MELT1 PersistanceTrue Edit date2007-04-16 Registry keyMicroUpdate Install pathMSDCSC\msdcsc.exe COMBOPATH7 InstallTrue gencode4cUaqJlWNM8B FWB1 sidGuest16 MutexDC_MUTEX-X6Z6AGP Version#KCMDDC51# C2 (1)5.129.36.73:1604 | ||||
| 2712 | notepad | C:\Windows\system32\notepad.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
2 026
Read events
1 942
Write events
84
Delete events
0
Modification events
| (PID) Process: | (2964) Njrat.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | MicroUpdate |
Value: C:\Users\admin\Documents\MSDCSC\msdcsc.exe | |||
| (PID) Process: | (2964) Njrat.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon |
| Operation: | write | Name: | UserInit |
Value: C:\Windows\system32\userinit.exe,C:\Users\admin\Documents\MSDCSC\msdcsc.exe | |||
| (PID) Process: | (2964) Njrat.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2964) Njrat.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2964) Njrat.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2964) Njrat.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2964) Njrat.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (480) msdcsc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | MicroUpdate |
Value: C:\Users\admin\Documents\MSDCSC\msdcsc.exe | |||
| (PID) Process: | (480) msdcsc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\System |
| Operation: | write | Name: | DisableTaskMgr |
Value: 1 | |||
| (PID) Process: | (480) msdcsc.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\System |
| Operation: | write | Name: | DisableRegistryTools |
Value: 1 | |||
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2964 | Njrat.exe | C:\Users\admin\Documents\MSDCSC\msdcsc.exe | executable | |
MD5:46917F3212638687EC4839BAE1DEBFFF | SHA256:5B38B79BC7FC0C12910E4D864F924A040FDB9C38AFCC9AEDA7CF34E3768906B1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2408 | iexplore.exe | 5.129.36.73:1604 | — | Novotelecom Ltd | RU | malicious |
DNS requests
Threats
4 ETPRO signatures available at the full report