| File name: | stub downloader.exe |
| Full analysis: | https://app.any.run/tasks/20562749-b27f-47fb-9636-3699af88cdf8 |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | August 26, 2020, 15:49:06 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 4959BE4445D5C1DC883A009881090BAD |
| SHA1: | FA4F0B5B7651E7248B440FB2F1622FC486CC6603 |
| SHA256: | 7F6821A14EB8CE4B2FE40F20CE6A17F9F591DEE436B1EE450C7AC92D6CEBC053 |
| SSDEEP: | 768:sVvEGOJhHoNa8rxZ8xY7PFKZ+y3KAC7ALvl+n/b:s9GCLr8xENKQmKACsLOb |
MALICIOUS
Changes the autorun value in the registry
- stub downloader.exe (PID: 4000)
Loads dropped or rewritten executable
- SearchProtocolHost.exe (PID: 3296)
NJRAT was detected
- Avast.exe (PID: 2824)
Connects to CnC server
- Avast.exe (PID: 2824)
SUSPICIOUS
Executable content was dropped or overwritten
- stub downloader.exe (PID: 4000)
- Avast.exe (PID: 2824)
Reads Environment values
- stub downloader.exe (PID: 4000)
- Avast.exe (PID: 2824)
Starts itself from another location
- stub downloader.exe (PID: 4000)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:08:26 17:47:47+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 28160 |
| InitializedDataSize: | 38912 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x8c0e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.1.100.0 |
| ProductVersionNumber: | 2.1.100.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | Avast Antivirus Installer |
| CompanyName: | Avast MicroInstaller |
| FileDescription: | microstub |
| FileVersion: | 2.1.100.0 |
| InternalName: | stub downloader.exe |
| LegalCopyright: | Copyright (c) 2019 AVAST Software |
| OriginalFileName: | stub downloader.exe |
| ProductName: | AVAST Software |
| ProductVersion: | 2.1.100.0 |
| AssemblyVersion: | 2.1.100.0 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 26-Aug-2020 15:47:47 |
| Comments: | Avast Antivirus Installer |
| CompanyName: | Avast MicroInstaller |
| FileDescription: | microstub |
| FileVersion: | 2.1.100.0 |
| InternalName: | stub downloader.exe |
| LegalCopyright: | Copyright (c) 2019 AVAST Software |
| OriginalFilename: | stub downloader.exe |
| ProductName: | AVAST Software |
| ProductVersion: | 2.1.100.0 |
| Assembly Version: | 2.1.100.0 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000080 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 3 |
| Time date stamp: | 26-Aug-2020 15:47:47 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00002000 | 0x00006C14 | 0x00006E00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.08091 |
.reloc | 0x0000A000 | 0x0000000C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 0.0815394 |
.rsrc | 0x0000C000 | 0x000029D4 | 0x00002A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.62565 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.00112 | 490 | UNKNOWN | UNKNOWN | RT_MANIFEST |
2 | 7.92659 | 8971 | UNKNOWN | UNKNOWN | RT_ICON |
32512 | 1.6789 | 20 | UNKNOWN | UNKNOWN | RT_GROUP_ICON |
Imports
mscoree.dll |
Total processes
41
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2824 | "C:\Users\admin\Antivirus\Avast.exe" | C:\Users\admin\Antivirus\Avast.exe | stub downloader.exe | ||||||||||||
User: admin Company: Avast MicroInstaller Integrity Level: MEDIUM Description: microstub Exit code: 0 Version: 2.1.100.0 Modules
| |||||||||||||||
| 3296 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 4000 | "C:\Users\admin\AppData\Local\Temp\stub downloader.exe" | C:\Users\admin\AppData\Local\Temp\stub downloader.exe | explorer.exe | ||||||||||||
User: admin Company: Avast MicroInstaller Integrity Level: MEDIUM Description: microstub Exit code: 0 Version: 2.1.100.0 Modules
| |||||||||||||||
Total events
634
Read events
574
Write events
60
Delete events
0
Modification events
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (4000) stub downloader.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\stub downloader_RASMANCS |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4000 | stub downloader.exe | C:\Users\admin\Antivirus\Avast.exe | executable | |
MD5:— | SHA256:— | |||
| 2824 | Avast.exe | C:\Users\admin\Antivirus\IconLib.dll | executable | |
MD5:45ECAF5E82DA876240F9BE946923406C | SHA256:087A0C5F789E964A2FBCB781015D3FC9D1757358BC63BB4E0B863B4DFFDB6E4F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
4
Threats
6
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4000 | stub downloader.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2824 | Avast.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
4000 | stub downloader.exe | 185.115.1.28:443 | www202.uschovna.cz | VSHosting s.r.o. | CZ | unknown |
2824 | Avast.exe | 185.115.1.28:443 | www202.uschovna.cz | VSHosting s.r.o. | CZ | unknown |
2824 | Avast.exe | 104.23.99.190:443 | pastebin.com | Cloudflare Inc | US | malicious |
2824 | Avast.exe | 185.19.85.139:6606 | — | Datawire Ag | CH | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
www202.uschovna.cz |
| unknown |
pastebin.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2824 | Avast.exe | A Network Trojan was detected | MALWARE [PTsecurity] Lime-RAT (Gen.NjRAT) |
2824 | Avast.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT/Bladabindi (Lime-RAT) |
2824 | Avast.exe | A Network Trojan was detected | MALWARE [PTsecurity] Lime-RAT (Gen.NjRAT) |
3 ETPRO signatures available at the full report