| File name: | Netflix Checker.exe |
| Full analysis: | https://app.any.run/tasks/5dc4e22b-dd88-4a49-a2d4-4f3fe6caeaa4 |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | February 27, 2024, 12:41:42 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 4BACF396503CD746F56EE367A84EA4F6 |
| SHA1: | 889A6A3A18F336BDD0152D2F4748275FBC39B27E |
| SHA256: | 72A810EC1B2C779AF7DCD2E7C527441FC17B4415FEFA3006FC771E92D16A4195 |
| SSDEEP: | 98304:S1NBSLis11j/wT2CaQ1ZF2EhnErLvY9n5fPi2KSvYe6Wb5yIbmjqX/4NwIp6ahH9:BwFbKc |
MALICIOUS
Drops the executable file immediately after the start
- Netflix Checker.exe (PID: 3672)
- Vhumhkltbx.exe (PID: 3972)
- windowsupdate.exe (PID: 2692)
NjRAT is detected
- Vhumhkltbx.exe (PID: 3972)
- windowsupdate.exe (PID: 2692)
Poullight is detected
- Gpayyx.exe (PID: 3916)
Steals credentials from Web Browsers
- Gpayyx.exe (PID: 3916)
Steals credentials
- Gpayyx.exe (PID: 3916)
Create files in the Startup directory
- windowsupdate.exe (PID: 2692)
NJRAT has been detected (YARA)
- windowsupdate.exe (PID: 2692)
Changes the autorun value in the registry
- windowsupdate.exe (PID: 2692)
Actions looks like stealing of personal data
- Gpayyx.exe (PID: 3916)
SUSPICIOUS
Reads security settings of Internet Explorer
- Netflix Checker.exe (PID: 3672)
- Vhumhkltbx.exe (PID: 3972)
Reads the Internet Settings
- Netflix Checker.exe (PID: 3672)
- Vhumhkltbx.exe (PID: 3972)
- Gpayyx.exe (PID: 3916)
Executable content was dropped or overwritten
- Netflix Checker.exe (PID: 3672)
- Vhumhkltbx.exe (PID: 3972)
- windowsupdate.exe (PID: 2692)
Starts itself from another location
- Vhumhkltbx.exe (PID: 3972)
Uses NETSH.EXE to add a firewall rule or allowed programs
- windowsupdate.exe (PID: 2692)
Connects to unusual port
- windowsupdate.exe (PID: 2692)
INFO
Create files in a temporary directory
- Netflix Checker.exe (PID: 3672)
- Gpayyx.exe (PID: 3916)
Reads the computer name
- Netflix Checker.exe (PID: 3672)
- Gpayyx.exe (PID: 3916)
- Qsbb.exe (PID: 3732)
- Vhumhkltbx.exe (PID: 3972)
- windowsupdate.exe (PID: 2692)
Checks supported languages
- Netflix Checker.exe (PID: 3672)
- Gpayyx.exe (PID: 3916)
- Vhumhkltbx.exe (PID: 3972)
- Qsbb.exe (PID: 3732)
- windowsupdate.exe (PID: 2692)
Reads the machine GUID from the registry
- Netflix Checker.exe (PID: 3672)
- Gpayyx.exe (PID: 3916)
- Vhumhkltbx.exe (PID: 3972)
- windowsupdate.exe (PID: 2692)
Reads Environment values
- Gpayyx.exe (PID: 3916)
- windowsupdate.exe (PID: 2692)
Reads product name
- Gpayyx.exe (PID: 3916)
Creates files or folders in the user directory
- Gpayyx.exe (PID: 3916)
- windowsupdate.exe (PID: 2692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
NjRat
(PID) Process(2692) windowsupdate.exe
C2alcachofa724-46937.portmap.host
Ports46937
Botnethappy
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\b2cfa0ba1b27be996957c11e1bf6a214
Splitter|'|'|
Version0.7d
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2021:08:06 16:49:36+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 2775552 |
| InitializedDataSize: | 109568 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2a79ce |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | NetFlix Checker by xRisky v2 |
| CompanyName: | NetFlix Checker by xRisky v2 |
| FileDescription: | NetFlix Checker by xRisky v2 |
| FileVersion: | 1.0.0.0 |
| InternalName: | Netflix Checker.exe |
| LegalCopyright: | Copyright © 2019 |
| LegalTrademarks: | __xRisky__ |
| OriginalFileName: | Netflix Checker.exe |
| ProductName: | NetFlix Checker by xRisky v2 |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
46
Monitored processes
6
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2692 | "C:\Users\admin\windowsupdate.exe" | C:\Users\admin\windowsupdate.exe | Vhumhkltbx.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
NjRat(PID) Process(2692) windowsupdate.exe C2alcachofa724-46937.portmap.host Ports46937 Botnethappy Options Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\b2cfa0ba1b27be996957c11e1bf6a214 Splitter|'|'| Version0.7d | |||||||||||||||
| 3488 | netsh firewall add allowedprogram "C:\Users\admin\windowsupdate.exe" "windowsupdate.exe" ENABLE | C:\Windows\System32\netsh.exe | — | windowsupdate.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3672 | "C:\Users\admin\Desktop\Netflix Checker.exe" | C:\Users\admin\Desktop\Netflix Checker.exe | explorer.exe | ||||||||||||
User: admin Company: NetFlix Checker by xRisky v2 Integrity Level: MEDIUM Description: NetFlix Checker by xRisky v2 Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3732 | "C:\Users\admin\AppData\Local\Temp\Qsbb.exe" | C:\Users\admin\AppData\Local\Temp\Qsbb.exe | Netflix Checker.exe | ||||||||||||
User: admin Company: __xRisky__ Integrity Level: MEDIUM Description: NetFlix Checker by xRisky v2 Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3916 | "C:\Users\admin\AppData\Local\Temp\Gpayyx.exe" | C:\Users\admin\AppData\Local\Temp\Gpayyx.exe | Netflix Checker.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Video Player V Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 3972 | "C:\Users\admin\AppData\Local\Temp\Vhumhkltbx.exe" | C:\Users\admin\AppData\Local\Temp\Vhumhkltbx.exe | Netflix Checker.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
7 652
Read events
7 511
Write events
141
Delete events
0
Modification events
| (PID) Process: | (3672) Netflix Checker.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3672) Netflix Checker.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3672) Netflix Checker.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3672) Netflix Checker.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (3972) Vhumhkltbx.exe | Key: | HKEY_CURRENT_USER |
| Operation: | write | Name: | di |
Value: ! | |||
| (PID) Process: | (3916) Gpayyx.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib |
| Operation: | write | Name: | vga.drv 1280x720x32(BGR 0) |
Value: 31,31,31,31 | |||
| (PID) Process: | (3972) Vhumhkltbx.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3972) Vhumhkltbx.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3972) Vhumhkltbx.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3972) Vhumhkltbx.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
Executable files
5
Suspicious files
10
Text files
31
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\u73hfoel\PC-Information.txt | text | |
MD5:32D50B9AAB0425D8459017E59E923AC6 | SHA256:E870604D6D4D0ED95AA3D83CEA3CAB8F3A08573CC70E953A3F9A25B19A77E94D | |||
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\u73hfoel\Stealer Files\Desktop Files\againaddress.rtf | text | |
MD5:FA93DBEB13C82F5BA9B37D501C79BB36 | SHA256:6FF7F2649692B720F532A44E7540DCE4DCD626AEB02580279526B034909BB17A | |||
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\Temp\pl2d4vfegvbqddddkms0zhqii0i | text | |
MD5:CF8BE200E4CF734228B56A90E664C59D | SHA256:A10BF19F068CEBA6E908C786458BAF476648AE9EA70E6A1D89C1222B819B7659 | |||
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\u73hfoel\ProcessList.txt | text | |
MD5:92E24860CA8BD3F2160D771318F7B040 | SHA256:39A7DBC22325DFDD3DEE5116182ECFDC3F8268C082958999C499F8AF5EB01863 | |||
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\u73hfoel\Clipboard.txt | text | |
MD5:809B24C010F6102183F6461CAB36EB06 | SHA256:B2DF1A1B12DE37C3B1159C28AA1FE7C7230666F70AD6D5F7B6C474307DB26B10 | |||
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\u73hfoel\Stealer Files\Desktop Files\startingillinois.rtf | text | |
MD5:D56605D4C38E433E0A15FDF5CE301E1C | SHA256:04B3A22411286B89D1A0FF07BB9F82D789A46470EB0DACECF08A078DF0755424 | |||
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\u73hfoel\ScreenShot.png | image | |
MD5:EFECAFAD29F9BC7F9B7D4CA167EAAB7C | SHA256:DD23E1B0F4793D61DDF70A0C7796AFADDDEBA1B86B745D601FE7B4F245B43BD0 | |||
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\u73hfoel\Stealer Files\Desktop Files\touraccess.rtf | text | |
MD5:20AEF5C56C68B0FBFA72609C1DF34F81 | SHA256:F0652C9654845EEC19F258B36CBD816E0426BF1A0144828BB374534CFCDD97A7 | |||
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\u73hfoel\Stealer Files\Documents Files\commentled.rtf | text | |
MD5:008093CA470BCDF0F653AA3F81919ECA | SHA256:60BF0BF7AEA36036157E335BE8FC4AE1D07789CB765B3CF2458E85EA6EBF2FC8 | |||
| 3916 | Gpayyx.exe | C:\Users\admin\AppData\Local\u73hfoel\Stealer Files\Documents Files\electronicsmade.rtf | text | |
MD5:5341CB207C8D1B91D22927A03BE547B0 | SHA256:3DA8A1750220A4A2F049FA6209BDE688C545F8426166A9E0C021DFC604B576DC | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
4
Threats
7
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3916 | Gpayyx.exe | 69.197.143.14:80 | fhruhceio.eu5.org | WII | US | unknown |
2692 | windowsupdate.exe | 49.13.77.253:46937 | alcachofa724-46937.portmap.host | Hetzner Online GmbH | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
fhruhceio.eu5.org |
| unknown |
alcachofa724-46937.portmap.host |
| unknown |
dns.msftncsi.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Potential Corporate Privacy Violation | ET POLICY DNS Query to a Reverse Proxy Service Observed |
1080 | svchost.exe | Misc activity | ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host) |
3916 | Gpayyx.exe | A Network Trojan was detected | ET MALWARE Trojan Generic - POST To gate.php with no referer |
3916 | Gpayyx.exe | A Network Trojan was detected | ET MALWARE Trojan Generic - POST To gate.php with no accept headers |
3916 | Gpayyx.exe | A Network Trojan was detected | ET MALWARE Win32/X-Files Stealer Activity |
3916 | Gpayyx.exe | A Network Trojan was detected | ET MALWARE Matrix Max Stealer Exfiltration Observed |
1 ETPRO signatures available at the full report