File name:

Bluetooth discovery protocol installer.exe

Full analysis: https://app.any.run/tasks/218b6fd7-93e5-4232-b88b-7d9458552a38
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: February 17, 2024, 09:45:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D8EB4E7E6C1ED19C0F1E150239B70B45

SHA1:

F4A03AD59F8D0685873139636F36CD65256A6F38

SHA256:

8BDA33F106E522AB0B51052A035FC32877A2F6EAD6E5E7293C7D9E006F69FCA6

SSDEEP:

12288:LwQcgCzNHJj96xfKJStJkRm3bYXob0AnmFMcaGQxUGRhhJhhf4i5+ghhJhhfk:LwfQKgLIQmFuGQxUGH4+k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Bluetooth discovery protocol installer.exe (PID: 2752)
      • Bluetooth discovery protocol.exe (PID: 4044)
      • Bluetooth discovery protocol servises.exe (PID: 2672)
      • Rar.exe (PID: 1772)

    • NjRAT is detected

      • Bluetooth discovery protocol.exe (PID: 4044)
      • Bluetooth discovery protocol servises.exe (PID: 2672)

    • Connects to the CnC server

      • Bluetooth discovery protocol servises.exe (PID: 2672)

    • NJRAT has been detected (SURICATA)

      • Bluetooth discovery protocol servises.exe (PID: 2672)

    • NJRAT has been detected (YARA)

      • Bluetooth discovery protocol servises.exe (PID: 2672)

    • Create files in the Startup directory

      • Bluetooth discovery protocol servises.exe (PID: 2672)

    • Changes the autorun value in the registry

      • Bluetooth discovery protocol servises.exe (PID: 2672)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Bluetooth discovery protocol installer.exe (PID: 2752)
      • Bluetooth discovery protocol.exe (PID: 4044)
      • Bluetooth discovery protocol servises.exe (PID: 2672)

    • Reads Microsoft Outlook installation path

      • Bluetooth discovery protocol installer.exe (PID: 2752)

    • Reads security settings of Internet Explorer

      • Bluetooth discovery protocol installer.exe (PID: 2752)
      • Bluetooth discovery protocol.exe (PID: 4044)
      • Bluetooth discovery protocol servises.exe (PID: 2672)

    • Starts itself from another location

      • Bluetooth discovery protocol.exe (PID: 4044)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Bluetooth discovery protocol servises.exe (PID: 2672)

    • Executable content was dropped or overwritten

      • Bluetooth discovery protocol servises.exe (PID: 2672)
      • Bluetooth discovery protocol installer.exe (PID: 2752)
      • Bluetooth discovery protocol.exe (PID: 4044)
      • Rar.exe (PID: 1772)

    • Reads Internet Explorer settings

      • Bluetooth discovery protocol installer.exe (PID: 2752)

    • Connects to unusual port

      • Bluetooth discovery protocol servises.exe (PID: 2672)

  • INFO

    • Checks supported languages

      • Bluetooth discovery protocol installer.exe (PID: 2752)
      • wmpnscfg.exe (PID: 2472)
      • Bluetooth discovery protocol servises.exe (PID: 2672)
      • Bluetooth discovery protocol.exe (PID: 4044)
      • Rar.exe (PID: 1772)
      • cheat.exe (PID: 2668)

    • Reads the computer name

      • Bluetooth discovery protocol installer.exe (PID: 2752)
      • wmpnscfg.exe (PID: 2472)
      • Bluetooth discovery protocol.exe (PID: 4044)
      • Bluetooth discovery protocol servises.exe (PID: 2672)
      • Rar.exe (PID: 1772)
      • cheat.exe (PID: 2668)

    • Checks proxy server information

      • Bluetooth discovery protocol installer.exe (PID: 2752)

    • Creates files in the program directory

      • Bluetooth discovery protocol installer.exe (PID: 2752)
      • Bluetooth discovery protocol.exe (PID: 4044)

    • Reads the machine GUID from the registry

      • Bluetooth discovery protocol installer.exe (PID: 2752)
      • Bluetooth discovery protocol servises.exe (PID: 2672)
      • Bluetooth discovery protocol.exe (PID: 4044)
      • Rar.exe (PID: 1772)
      • cheat.exe (PID: 2668)

    • Reads Environment values

      • Bluetooth discovery protocol servises.exe (PID: 2672)

    • Creates files or folders in the user directory

      • Bluetooth discovery protocol servises.exe (PID: 2672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(2672) Bluetooth discovery protocol servises.exe
C2photography-ringtones.gl.at.ply.gg
Ports29246
Botnetdaunisse
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\85a3e0c53d2ca04334c15e929598abdc
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:03 07:51:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 214528
InitializedDataSize: 153088
UninitializedDataSize: -
EntryPoint: 0x21d50
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bluetooth discovery protocol installer.exe #NJRAT bluetooth discovery protocol.exe #NJRAT bluetooth discovery protocol servises.exe netsh.exe no specs rar.exe cheat.exe no specs wmpnscfg.exe no specs bluetooth discovery protocol installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696netsh firewall add allowedprogram "C:\ProgramData\Bluetooth discovery protocol servises.exe" "Bluetooth discovery protocol servises.exe" ENABLEC:\Windows\System32\netsh.exe—Bluetooth discovery protocol servises.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1772"C:\Program Files\winrar\rar.exe" x -y"MrBeast.zip" *.* "UnRAR_MrBeasp\"C:\Program Files\WinRAR\Rar.exe
Bluetooth discovery protocol servises.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
HIGH
Description:
Command line RAR
Exit code:
6
Version:
5.91.0
Modules
Images
c:\program files\winrar\rar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2472"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2668"C:\UnRAR_MrBeasp\cheat.exe" C:\UnRAR_MrBeasp\cheat.exe—Bluetooth discovery protocol servises.exe
User:
admin
Integrity Level:
HIGH
Description:
MSBREASTTTTTTTTTTTTTTT
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\unrar_mrbeasp\cheat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2672"C:\ProgramData\Bluetooth discovery protocol servises.exe" C:\ProgramData\Bluetooth discovery protocol servises.exe
Bluetooth discovery protocol.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\bluetooth discovery protocol servises.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2672) Bluetooth discovery protocol servises.exe
C2photography-ringtones.gl.at.ply.gg
Ports29246
Botnetdaunisse
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\85a3e0c53d2ca04334c15e929598abdc
Splitter|'|'|
Versionim523
2752"C:\Users\admin\Desktop\Bluetooth discovery protocol installer.exe" C:\Users\admin\Desktop\Bluetooth discovery protocol installer.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\bluetooth discovery protocol installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3536"C:\Users\admin\Desktop\Bluetooth discovery protocol installer.exe" C:\Users\admin\Desktop\Bluetooth discovery protocol installer.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\bluetooth discovery protocol installer.exe
c:\windows\system32\ntdll.dll
4044"C:\Program Files\BluetoothDiscoveryProtocol\Bluetooth discovery protocol.exe" C:\Program Files\BluetoothDiscoveryProtocol\Bluetooth discovery protocol.exe
Bluetooth discovery protocol installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\bluetoothdiscoveryprotocol\bluetooth discovery protocol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
6 028
Read events
5 378
Write events
648
Delete events
2

Modification events

(PID) Process:(2752) Bluetooth discovery protocol installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2752) Bluetooth discovery protocol installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2752) Bluetooth discovery protocol installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2752) Bluetooth discovery protocol installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2752) Bluetooth discovery protocol installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2752) Bluetooth discovery protocol installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2752) Bluetooth discovery protocol installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2752) Bluetooth discovery protocol installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(2752) Bluetooth discovery protocol installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
(PID) Process:(4044) Bluetooth discovery protocol.exeKey:HKEY_CURRENT_USER
Operation:writeName:di
Value:
!
Executable files
5
Suspicious files
2
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1772Rar.exeC:\UnRAR_MrBeasp\beast.wav —
MD5:—
SHA256:—
2752Bluetooth discovery protocol installer.exeC:\Program Files\BluetoothDiscoveryProtocol\service.dlltext
MD5:57A0A47FE8C851CAB4432759D69063F3
SHA256:C0BC270A29B0A55C880FEE80E44D166585FADCAA2D650BB4B00F1A1872638C7A
2752Bluetooth discovery protocol installer.exeC:\Program Files\BluetoothDiscoveryProtocol\Bluetooth discovery protocol.exeexecutable
MD5:87224038CE10EDB583CA8CDE83A5BE43
SHA256:22EE66AE0E2F7708F70BD1AE76E8F5E743C9CEF30EFFD6D106E4BE837E9439D7
2752Bluetooth discovery protocol installer.exeC:\Program Files\BluetoothDiscoveryProtocol\Discovery.dlltext
MD5:94722AB7604211632CF78931068ABEDD
SHA256:F127BB3290C09255049B884A316082AC00F89F37260040DB4853BCF2DC71FA43
2752Bluetooth discovery protocol installer.exeC:\Program Files\BluetoothDiscoveryProtocol\protocol.dlltext
MD5:BA9366283F870640263C9FFFC5866C09
SHA256:569F02E01607B913BC94BFA38852F307B9F8297F8B75D159AD9BAC821E249264
2752Bluetooth discovery protocol installer.exeC:\Program Files\BluetoothDiscoveryProtocol\StartModule.dlltext
MD5:BA8F3EA48F08B9CF063CD4130BB71060
SHA256:9EB309100CA112EFD6C166C30FB973C8705C435057A97A8BF5BCEB6F036F6A9D
2672Bluetooth discovery protocol servises.exeC:\MrBeast.zipcompressed
MD5:B477B55E3DD71A7A62C3535746475019
SHA256:88DD2DEB2E552CDB052C3359C36AA559F560DAFD5510D7DAF0472D4C62987F36
4044Bluetooth discovery protocol.exeC:\ProgramData\Bluetooth discovery protocol servises.exeexecutable
MD5:87224038CE10EDB583CA8CDE83A5BE43
SHA256:22EE66AE0E2F7708F70BD1AE76E8F5E743C9CEF30EFFD6D106E4BE837E9439D7
2672Bluetooth discovery protocol servises.exeC:\Bluetooth discovery protocol installer.exeexecutable
MD5:87224038CE10EDB583CA8CDE83A5BE43
SHA256:22EE66AE0E2F7708F70BD1AE76E8F5E743C9CEF30EFFD6D106E4BE837E9439D7
1772Rar.exeC:\UnRAR_MrBeasp\cheat.exeexecutable
MD5:08BB6FA5A0A54030C55B6DC60601209F
SHA256:E5502FD83ED9ED24F535D8EC4D56AEF2FF647AEAB47661D7DE6797A24BB593A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
1
Threats
16

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2672
Bluetooth discovery protocol servises.exe
147.185.221.18:29246
photography-ringtones.gl.at.ply.gg
PLAYIT-GG
US
malicious

DNS requests

Domain
IP
Reputation
photography-ringtones.gl.at.ply.gg
  • 147.185.221.18
malicious

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
2672
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
2672
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
2672
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (File Manager Actions)
2672
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
2672
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
2672
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
2672
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
2672
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
2672
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bluetooth discovery protocol installer.exe