download:

/simalei/njRAT/releases/download/v0.7D/NjRat.0.7D.Green.Edition.zip

Full analysis: https://app.any.run/tasks/0a5113ea-c582-4e6b-a7b7-4ef3bc2e7b5f
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: January 07, 2024, 04:23:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
securityxploded
njrat
rat
bladabindi
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

5E9879DFB0EB64E734C28F514F208418

SHA1:

0B5E8D1F6C777A07B6DA9DE781E7525D6C0B7562

SHA256:

72029D0005D9B3130CDBDBA3D6D6129A817F073B5EAEDD79345729042E586A25

SSDEEP:

49152:z91Heasnn4LOb5a7kQdWH7xKQtkWhCTNMH9xf1aawYLngK0posG+:z91Hn80y/7KQyW4TGHfnyosG+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NJRAT has been detected (YARA)

      • er.exe (PID: 148)
      • server.exe (PID: 1556)

    • Create files in the Startup directory

      • server.exe (PID: 1556)
      • server.exe (PID: 1096)

    • Steals credentials from Web Browsers

      • server.exe (PID: 1556)

    • NjRAT is detected

      • server.exe (PID: 1556)
      • server.exe (PID: 1096)
      • server.exe (PID: 116)

    • Changes the autorun value in the registry

      • server.exe (PID: 1096)
      • server.exe (PID: 1556)

    • Actions looks like stealing of personal data

      • server.exe (PID: 1556)

  • SUSPICIOUS

    • Reads the Internet Settings

      • NjRat 0.7D Green Edition by im523.exe (PID: 2024)
      • rundll32.exe (PID: 2472)
      • er.exe (PID: 148)
      • sipnotify.exe (PID: 1472)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • server.exe (PID: 1556)
      • server.exe (PID: 1096)

    • Reads Internet Explorer settings

      • NjRat 0.7D Green Edition by im523.exe (PID: 2024)

  • INFO

    • Manual execution by a user

      • NjRat 0.7D Green Edition by im523.exe (PID: 2024)
      • er.exe (PID: 148)
      • server.exe (PID: 1096)
      • IMEKLMG.EXE (PID: 320)
      • IMEKLMG.EXE (PID: 1904)
      • server.exe (PID: 116)
      • wmpnscfg.exe (PID: 2348)
      • wmpnscfg.exe (PID: 2384)
      • NjRat 0.7D Green Edition by im523.exe (PID: 2584)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2044)
      • ilasm.exe (PID: 1900)
      • NjRat 0.7D Green Edition by im523.exe (PID: 2024)
      • er.exe (PID: 148)
      • server.exe (PID: 1556)
      • server.exe (PID: 1096)

    • SecurityXploded is detected

      • WinRAR.exe (PID: 2044)

    • Checks supported languages

      • NjRat 0.7D Green Edition by im523.exe (PID: 2024)
      • ilasm.exe (PID: 1900)
      • er.exe (PID: 148)
      • server.exe (PID: 1556)
      • IMEKLMG.EXE (PID: 320)
      • IMEKLMG.EXE (PID: 1904)
      • server.exe (PID: 1096)
      • server.exe (PID: 116)
      • wmpnscfg.exe (PID: 2348)
      • NjRat 0.7D Green Edition by im523.exe (PID: 2584)
      • wmpnscfg.exe (PID: 2384)

    • Reads the machine GUID from the registry

      • NjRat 0.7D Green Edition by im523.exe (PID: 2024)
      • er.exe (PID: 148)
      • server.exe (PID: 1556)
      • server.exe (PID: 116)
      • server.exe (PID: 1096)
      • NjRat 0.7D Green Edition by im523.exe (PID: 2584)

    • Reads the computer name

      • NjRat 0.7D Green Edition by im523.exe (PID: 2024)
      • server.exe (PID: 1556)
      • er.exe (PID: 148)
      • IMEKLMG.EXE (PID: 320)
      • IMEKLMG.EXE (PID: 1904)
      • server.exe (PID: 116)
      • wmpnscfg.exe (PID: 2348)
      • NjRat 0.7D Green Edition by im523.exe (PID: 2584)
      • server.exe (PID: 1096)
      • wmpnscfg.exe (PID: 2384)

    • Reads Environment values

      • NjRat 0.7D Green Edition by im523.exe (PID: 2024)
      • server.exe (PID: 1556)
      • server.exe (PID: 1096)

    • Create files in a temporary directory

      • NjRat 0.7D Green Edition by im523.exe (PID: 2024)
      • er.exe (PID: 148)

    • Creates files or folders in the user directory

      • rundll32.exe (PID: 2472)
      • server.exe (PID: 1556)
      • sipnotify.exe (PID: 1472)
      • NjRat 0.7D Green Edition by im523.exe (PID: 2584)

    • Unusual connection from system programs

      • rundll32.exe (PID: 2472)

    • Checks proxy server information

      • rundll32.exe (PID: 2472)

    • Starts itself from another location

      • er.exe (PID: 148)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1456)
      • sipnotify.exe (PID: 1472)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 1904)
      • IMEKLMG.EXE (PID: 320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(148) er.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\984559f52d4087243e95e5ad9bb48e8d
Splitter|'|'|
Versionim523
(PID) Process(1556) server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\984559f52d4087243e95e5ad9bb48e8d
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:10:23 14:50:26
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: nj_users/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
107
Monitored processes
18
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SECURITYXPLODED winrar.exe no specs njrat 0.7d green edition by im523.exe no specs ilasm.exe no specs #NJRAT er.exe rundll32.exe #NJRAT server.exe netsh.exe no specs PhotoViewer.dll no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs #NJRAT server.exe #NJRAT server.exe no specs wmpnscfg.exe no specs netsh.exe no specs wmpnscfg.exe no specs njrat 0.7d green edition by im523.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\server.exe" ..C:\Users\admin\AppData\Local\Temp\server.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
148"C:\Users\admin\Desktop\er.exe" C:\Users\admin\Desktop\er.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\er.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
NjRat
(PID) Process(148) er.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\984559f52d4087243e95e5ad9bb48e8d
Splitter|'|'|
Versionim523
320"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1096"C:\Users\admin\AppData\Local\Temp\server.exe" ..C:\Users\admin\AppData\Local\Temp\server.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1456C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1472C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1556"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
er.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(1556) server.exe
C2127.0.0.1
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\984559f52d4087243e95e5ad9bb48e8d
Splitter|'|'|
Versionim523
1900"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\admin\AppData\Local\Temp\stub.il" /output:"C:\Users\admin\Desktop\er.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe—NjRat 0.7D Green Edition by im523.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework IL assembler
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\ilasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1904"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2024"C:\Users\admin\Desktop\NjRat 0.7D Green Edition by im523.exe" C:\Users\admin\Desktop\NjRat 0.7D Green Edition by im523.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NjRat 0.7D Green Edition by im523
Exit code:
3221225547
Version:
0.0.0.7
Modules
Images
c:\users\admin\desktop\njrat 0.7d green edition by im523.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 515
Read events
7 025
Write events
487
Delete events
3

Modification events

(PID) Process:(2044) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2044) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
15
Suspicious files
7
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2044.41511\nj_users\XTREME-HPHU46T6_Администратор_EE0C994\Keylog.rtftext
MD5:890CBD4ACF6BA3B475F59BF3D583DA83
SHA256:C1534AF7F44D83C419A261E90F1B226FD26171A3A55A494BC831006F9474AD5B
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2044.41511\Plugin\pw.dllexecutable
MD5:872401528FC94C90F3DE6658E776CC36
SHA256:3A1CC072EFFD8C38406A6FDDF4D8F49C5366BB0E32071311D90DB669940987CE
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2044.41511\Plugin\ch.dllexecutable
MD5:73C8A5CD64FCF87186A6A9AC870DF509
SHA256:7722206DBA0CFB290F33093F9430CB770A160947001715AE11E6DBBFAEF1C0EE
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2044.41511\Plugin\cam.dllexecutable
MD5:A73EDB60B80A2DFA86735D821BEA7B19
SHA256:7A4977B024D048B71BCC8F1CC65FB06E4353821323F852DC6740B79B9AB75C98
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2044.41511\Plugin\plg.dllexecutable
MD5:0CBC2D9703FEEAD9783439E551C2B673
SHA256:EA9ECF8723788FEEF6492BF938CDFAB1266A1558DFFE75E1F78A998320F96E39
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2044.41511\nj_users\VM-РџРљ_vm_602F4037\Keylog.rtftext
MD5:92122DA996C66CBD51D8C6EA868739C5
SHA256:9A27937010FA2BE4C9F3634FEE0BF20CBDEB64BC7141AB1BEDA02C06DE27F869
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2044.41511\WinMM.Net.dllexecutable
MD5:D4B80052C7B4093E10CE1F40CE74F707
SHA256:59E2AC1B79840274BDFCEF412A10058654E42F4285D732D1487E65E60FFBFB46
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2044.41511\Stub.iltext
MD5:3575ABF7AB346EC4039138FAD1FAB4B7
SHA256:ED79411707D5A9925F1146E595983804E4EEAFE35E72EB51703908EFF13CC073
2044WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2044.41511\Stub.manifestxml
MD5:4D18AC38A92D15A64E2B80447B025B7E
SHA256:835A00D6E7C43DB49AE7B3FA12559F23C2920B7530F4D3F960FD285B42B1EFB5
1900ilasm.exeC:\Users\admin\Desktop\er.exeexecutable
MD5:C1A6AD4B690D663C84592E7E45C86D72
SHA256:52527E8FB9E364EFEE2CA9F53E658890BD030C5069289F5880287C2D3143DAA1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
12
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2472
rundll32.exe
GET
302
23.32.186.57:80
http://go.microsoft.com/fwlink?linkid=30219&locale=en-US&clientType=VISTA_GAMES&clientVersion=6.1.2
unknown
—
—
—
1472
sipnotify.exe
HEAD
200
2.23.65.216:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133490752744060000
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2472
rundll32.exe
23.32.186.57:80
go.microsoft.com
AKAMAI-AS
BR
unknown
2472
rundll32.exe
65.55.186.113:80
movie.metaservices.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1128
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1472
sipnotify.exe
2.23.65.216:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 23.32.186.57
unknown
movie.metaservices.microsoft.com
  • 65.55.186.113
unknown
query.prod.cms.rt.microsoft.com
  • 2.23.65.216
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/simalei/njRAT/releases/download/v0.7D/NjRat.0.7D.Green.Edition.zip