File name:

1.rar

Full analysis: https://app.any.run/tasks/bd008a79-cdac-432d-a821-2b63eb404f7e
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: July 17, 2019, 08:53:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

795B0FFFD889412584E797652F5AF509

SHA1:

54E5667B4B3D6E3587225F10F60C8E727F4E218E

SHA256:

9545D083499568470C56E70AD05CAD2339B9DA73B3CD67A90421CD28A6DA0558

SSDEEP:

49152:gFnDUq0X7hNH7YdQgTTw9TSXt33wqcE8MRPR7WLxAD1ReyTooXo47644/WlFKLYJ:gFDUqIhhYd1cmZwqnRZ7WLI1RnT3XBxJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ~SQLi_v_9_8_2.exe (PID: 3800)
      • net2.exe (PID: 2944)
      • Tempnet4com.exe (PID: 3912)
      • Tempnet2com.exe (PID: 2756)
      • ~SQLi_v_9_8_2.exe (PID: 3408)
      • net4.exe (PID: 3052)
      • Microsoft Service.exe (PID: 2864)

    • Writes to a start menu file

      • Microsoft Service.exe (PID: 2864)

    • NJRAT was detected

      • Microsoft Service.exe (PID: 2864)

    • Changes the autorun value in the registry

      • Microsoft Service.exe (PID: 2864)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • net2.exe (PID: 2944)
      • Tempnet2com.exe (PID: 2756)
      • SQLi Dumper 9.8.2.exe (PID: 3396)
      • net4.exe (PID: 3052)
      • Microsoft Service.exe (PID: 2864)

    • Starts CMD.EXE for self-deleting

      • net2.exe (PID: 2944)
      • net4.exe (PID: 3052)

    • Starts CMD.EXE for commands execution

      • SQLi Dumper 9.8.2.exe (PID: 3396)
      • net4.exe (PID: 3052)
      • net2.exe (PID: 2944)

    • Uses NETSH.EXE for network configuration

      • Microsoft Service.exe (PID: 2864)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3920)

    • Creates files in the user directory

      • Microsoft Service.exe (PID: 2864)

    • Starts itself from another location

      • Tempnet2com.exe (PID: 2756)

  • INFO

    • Manual execution by user

      • ~SQLi_v_9_8_2.exe (PID: 3800)
      • SQLi Dumper 9.8.2.exe (PID: 3396)
      • chrome.exe (PID: 3920)

    • Application launched itself

      • chrome.exe (PID: 3920)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 3548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
42
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe no specs ~sqli_v_9_8_2.exe no specs sqli dumper 9.8.2.exe cmd.exe no specs net2.exe net4.exe ~sqli_v_9_8_2.exe no specs tempnet2com.exe cmd.exe no specs ping.exe no specs tempnet4com.exe no specs cmd.exe no specs ping.exe no specs #NJRAT microsoft service.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs netsh.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,13594899267061457402,12655703071909592712,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=603117490071739889 --mojo-platform-channel-handle=3336 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1312"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,13594899267061457402,12655703071909592712,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=5463542328561774998 --mojo-platform-channel-handle=3776 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1992"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,13594899267061457402,12655703071909592712,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=14978045895970524098 --mojo-platform-channel-handle=4060 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2136"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,13594899267061457402,12655703071909592712,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=8281665361028332668 --mojo-platform-channel-handle=3948 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2216"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,13594899267061457402,12655703071909592712,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6067914462563610103 --mojo-platform-channel-handle=3936 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2280ping google.com C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2292"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\2F6A.tmp\2F6B.bat "C:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\SQLi Dumper 9.8.2.exe""C:\Windows\system32\cmd.exe—SQLi Dumper 9.8.2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2452ping google.com C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2532"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,13594899267061457402,12655703071909592712,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=2418790853899102619 --mojo-platform-channel-handle=3200 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2608"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=996,13594899267061457402,12655703071909592712,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=16097366170056093239 --mojo-platform-channel-handle=3960 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
2 111
Read events
1 722
Write events
384
Delete events
5

Modification events

(PID) Process:(3552) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3552) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3552) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\70\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3552) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\1.rar
(PID) Process:(3552) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3552) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3552) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3552) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3396) SQLi Dumper 9.8.2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3396) SQLi Dumper 9.8.2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
7
Suspicious files
84
Text files
205
Unknown types
16

Dropped files

PID
Process
Filename
Type
3552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3552.12056\SQLi v.9.8.2 PASS 0123\SQLi Dumper 9.8.2.exe —
MD5:—
SHA256:—
3552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3552.12056\SQLi v.9.8.2 PASS 0123\~SQLi_v_9_8_2.exe —
MD5:—
SHA256:—
3396SQLi Dumper 9.8.2.exeC:\Users\admin\Desktop\SQLi v.9.8.2 PASS 0123\net4.exeexecutable
MD5:—
SHA256:—
3396SQLi Dumper 9.8.2.exeC:\Users\admin\AppData\Local\Temp\2F6A.tmp\2F6B.battext
MD5:—
SHA256:—
3920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
3052net4.exeC:\Users\admin\AppData\Local\Tempnet4com.exeexecutable
MD5:—
SHA256:—
2756Tempnet2com.exeC:\Users\admin\AppData\Local\Temp\Microsoft Service.exeexecutable
MD5:—
SHA256:—
3552WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3552.12056\SQLi v.9.8.2 PASS 0123\DIC\dic_file_dump.txttext
MD5:351CACFFC2884FCD4E69BB1FB04DDEB5
SHA256:C67BCC0B4ED5E5EF72AA1134C0838D9201A97C2BF462FDFF0AC9052A53B286A2
3920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\2872d1ab-c650-4720-8f81-5ddfc21b217d.tmp —
MD5:—
SHA256:—
3920chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF11ee93.TMPtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
82
TCP/UDP connections
71
DNS requests
65
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/themes/twentyfourteen/style.css?ver=5.0.2
US
text
14.4 Kb
suspicious
3548
chrome.exe
GET
302
172.217.22.78:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
521 b
whitelisted
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/page/12/
US
html
23.5 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/plugins/jetpack/css/jetpack.css?ver=5.5.1
US
text
11.7 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/uploads/2019/02/error.png
US
image
20.5 Kb
suspicious
3548
chrome.exe
GET
200
87.245.195.173:80
http://r2---sn-gxuog0-jx3e.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0.3_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.117.118.92&mm=28&mn=sn-gxuog0-jx3e&ms=nvh&mt=1563353083&mv=u&mvi=1&pl=25&shardbypass=yes
RU
crx
862 Kb
whitelisted
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/plugins/jetpack/_inc/genericons/genericons/genericons.css?ver=3.1
US
text
15.9 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
US
text
3.92 Kb
suspicious
3548
chrome.exe
GET
200
104.24.126.50:80
http://fitgirl-repacks.site/wp-content/plugins/social-polls-by-opinionstage/js/shortcodes.js?ver=18.1.0
US
text
275 b
suspicious
3548
chrome.exe
GET
200
209.197.3.15:80
http://netdna.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css?ver=4.4.0
US
text
5.94 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3548
chrome.exe
216.58.207.67:443
www.google.com.ua
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.16.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.18.10:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.18.109:443
accounts.google.com
Google Inc.
US
suspicious
3548
chrome.exe
172.217.18.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.23.132:443
www.google.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.22.78:80
redirector.gvt1.com
Google Inc.
US
whitelisted
3548
chrome.exe
216.58.205.238:443
clients2.google.com
Google Inc.
US
whitelisted
3548
chrome.exe
172.217.21.225:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
3548
chrome.exe
87.245.195.173:80
r2---sn-gxuog0-jx3e.gvt1.com
RETN Limited
RU
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.16.195
whitelisted
accounts.google.com
  • 172.217.18.109
shared
www.google.com.ua
  • 216.58.207.67
whitelisted
fonts.googleapis.com
  • 172.217.18.10
whitelisted
www.gstatic.com
  • 172.217.23.131
whitelisted
fonts.gstatic.com
  • 172.217.18.99
whitelisted
apis.google.com
  • 172.217.23.174
whitelisted
www.google.com
  • 172.217.23.132
malicious
clients2.google.com
  • 216.58.205.238
whitelisted
www.google.fi
  • 172.217.18.99
whitelisted

Threats

PID
Process
Class
Message
1044
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
No debug info