URL:

https://wdho.ru/722h

Full analysis: https://app.any.run/tasks/0df80af2-9ea3-4a40-8646-d53dc1ff9c3b
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 08:16:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
qrcode
njrat
rat
bladabindi
Indicators:
MD5:

9C8F696B761B3BACD6C061C1DF7B1BA4

SHA1:

4214D1739B7DA463924D97E9AE32B2469F06AB1B

SHA256:

7921B698778E5A8F656AC1EF625800FCE514EA53BA378D8800FB671F399B8D4C

SSDEEP:

3:N8QNKj6HNn:2QNKj6HN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Roblx.exe (PID: 2988)

    • Uses Task Scheduler to run other applications

      • Roblx.exe (PID: 2988)

    • NJRAT has been detected (YARA)

      • Roblx.exe (PID: 2988)

    • Drops the executable file immediately after the start

      • Roblx.exe (PID: 2988)

    • Changes the autorun value in the registry

      • Roblx.exe (PID: 2988)

    • NjRAT is detected

      • Server.exe (PID: 3092)
      • Roblx.exe (PID: 4068)
      • Server.exe (PID: 3396)

  • SUSPICIOUS

    • The process executes via Task Scheduler

      • Server.exe (PID: 3092)
      • Server.exe (PID: 3396)

    • Connects to unusual port

      • Roblx.exe (PID: 2988)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2332)
      • Roblx.exe (PID: 4068)

    • Application launched itself

      • iexplore.exe (PID: 1236)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2332)
      • Roblx.exe (PID: 2988)
      • Server.exe (PID: 3092)
      • Server.exe (PID: 3396)
      • Roblx.exe (PID: 4068)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2332)
      • Roblx.exe (PID: 2988)
      • Server.exe (PID: 3092)
      • Server.exe (PID: 3396)
      • Roblx.exe (PID: 4068)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 3388)
      • iexplore.exe (PID: 1236)

    • Creates files or folders in the user directory

      • Roblx.exe (PID: 2988)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3388)

    • Reads the machine GUID from the registry

      • Roblx.exe (PID: 2988)
      • Server.exe (PID: 3092)
      • Roblx.exe (PID: 4068)
      • Server.exe (PID: 3396)

    • Create files in a temporary directory

      • Roblx.exe (PID: 2988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(2988) Roblx.exe
C20.tcp.eu.ngrok.io
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows Update
Splitter|Hassan|
VersionNjrat 0.7 Golden By Hassan Amiri
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs winrar.exe no specs #NJRAT roblx.exe schtasks.exe no specs #NJRAT server.exe no specs #NJRAT roblx.exe no specs #NJRAT server.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1236"C:\Program Files\Internet Explorer\iexplore.exe" "https://wdho.ru/722h"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2332"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2988"C:\Users\admin\AppData\Local\Temp\Rar$EXa3388.47625\Roblx.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3388.47625\Roblx.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3388.47625\roblx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2988) Roblx.exe
C20.tcp.eu.ngrok.io
Ports5552
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\Windows Update
Splitter|Hassan|
VersionNjrat 0.7 Golden By Hassan Amiri
3092C:\Users\admin\AppData\Local\Temp/Server.exe C:\Users\admin\AppData\Local\Temp\Server.exe
taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3296schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\admin\AppData\Local\Temp/Server.exeC:\Windows\System32\schtasks.exe—Roblx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3388"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\хуй.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3396C:\Users\admin\AppData\Local\Temp/Server.exe C:\Users\admin\AppData\Local\Temp\Server.exe
taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3672"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1236 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
4068"C:\Users\admin\Desktop\Roblx.exe" C:\Users\admin\Desktop\Roblx.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\roblx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
21 866
Read events
21 621
Write events
241
Delete events
4

Modification events

(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1236) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005A010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
4
Suspicious files
59
Text files
97
Unknown types
1

Dropped files

PID
Process
Filename
Type
3672iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:47FEA77AFB038DDA3C254760A7D20A89
SHA256:CA2EBCFCC45022BFE76BD179BF970A42CA96A66FF7910921E623CC73BB8E1275
3672iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar63FF.tmpbinary
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
3672iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab63FE.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
3672iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar643F.tmpbinary
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
3672iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DE1B9FF483F4A78A577C0893F7549F0binary
MD5:C2E9D2030BA0324886FE77F724136D1A
SHA256:99CCFC49D2E36D0A8FC6F520191FC1067631AE600288E7EB11B8B2257D6DCCB6
3672iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\F6370HC5.txttext
MD5:15B79DD400321438A7CB586428DF0951
SHA256:FFE7654466D549A7AF679F6E150F4FD71D5DF63A82A6A0CF7F226A1A4253BA88
3672iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\ULSPW05O.txttext
MD5:B45E9AF6227FA14A39145FCE1112997A
SHA256:96309A56D9F882A31F6800731A3E4F3B48897E31393766704C004C5D09CE1371
3672iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3672iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DE1B9FF483F4A78A577C0893F7549F0der
MD5:C6A3E1C47DA597E6C3383BE2AF914C30
SHA256:6D1E5C61A612C77ABC923A439FB9E39C1838776F219BE4180F246B0CA878810D
3672iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\XDJMKQN0.txttext
MD5:F16672EDB670321839F527FD34E3D5BA
SHA256:1B9CB67B2E9599C5314022D64C291DF9B042ECF8A45C0041E525BA0E7935A4D6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
47
DNS requests
29
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3672
iexplore.exe
GET
200
23.53.40.64:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1d7b6ba33f16a438
unknown
compressed
4.66 Kb
unknown
3672
iexplore.exe
GET
200
23.53.40.64:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8b06c490bce339bc
unknown
compressed
4.66 Kb
unknown
3672
iexplore.exe
GET
200
23.53.40.64:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64a1a5dfd935ecb5
unknown
compressed
65.2 Kb
unknown
3672
iexplore.exe
GET
200
23.212.210.158:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3672
iexplore.exe
GET
200
23.53.40.64:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?a88ccd45ad45c010
unknown
compressed
65.2 Kb
unknown
3672
iexplore.exe
GET
200
184.24.77.79:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgSL2RPwxeFIepf0Ll5fmvZsVw%3D%3D
unknown
binary
503 b
unknown
3672
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3672
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHUeP1PjGFkz6V8I7O6tApc%3D
unknown
binary
1.41 Kb
unknown
1236
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
3672
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3672
iexplore.exe
91.122.205.219:443
wdho.ru
Rostelecom
RU
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3672
iexplore.exe
23.53.40.64:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3672
iexplore.exe
23.212.210.158:80
x1.c.lencr.org
AKAMAI-AS
AU
unknown
3672
iexplore.exe
184.24.77.79:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1236
iexplore.exe
91.122.205.219:443
wdho.ru
Rostelecom
RU
unknown
1236
iexplore.exe
104.126.37.176:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
wdho.ru
  • 91.122.205.219
whitelisted
ctldl.windowsupdate.com
  • 23.53.40.64
  • 23.53.40.41
  • 23.53.40.65
  • 23.53.40.58
  • 23.53.40.72
  • 23.53.40.51
  • 23.53.40.42
  • 23.53.40.67
  • 23.53.40.56
whitelisted
x1.c.lencr.org
  • 23.212.210.158
whitelisted
r3.o.lencr.org
  • 184.24.77.79
  • 184.24.77.67
  • 184.24.77.46
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.176
  • 104.126.37.184
  • 104.126.37.177
  • 104.126.37.186
  • 104.126.37.171
  • 104.126.37.170
  • 104.126.37.137
  • 104.126.37.168
  • 104.126.37.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
yandex.ru
  • 5.255.255.70
  • 5.255.255.77
  • 77.88.55.60
  • 77.88.55.88
whitelisted
yastatic.net
  • 178.154.131.217
  • 178.154.131.215
  • 178.154.131.216
whitelisted
chart.apis.google.com
  • 142.250.184.238
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
1080
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://wdho.ru/722h