analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://disk.yandex.ru/d/b9zMfUFHnRhQtA

Full analysis: https://app.any.run/tasks/7f03f3ea-bf79-462e-a5e3-42b2862eec2f
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: February 02, 2022, 16:55:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
njrat
bladabindi
Indicators:
MD5:

0D712D0D3A5F430A93070837B83418F0

SHA1:

ACE976CFBA9B005BC1CB955FF4514BB35F5919DC

SHA256:

B23F35FDBFAB8482057BD631581488E93106D70374E0F58D5653B9CF98C9072D

SSDEEP:

3:N8U2WuoC5j:2U27oCF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Cryptotab.exe (PID: 2440)
      • server.exe (PID: 1788)
      • StUpdate.exe (PID: 1780)
      • StUpdate.exe (PID: 2776)
      • tmp6AD1.tmp.exe (PID: 3988)
      • tmp6AD1.tmp.exe (PID: 2344)

    • Writes to a start menu file

      • server.exe (PID: 1788)

    • Uses Task Scheduler to run other applications

      • server.exe (PID: 1788)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2148)

    • Changes the autorun value in the registry

      • tmp6AD1.tmp.exe (PID: 2344)

    • Drops executable file immediately after starts

      • tmp6AD1.tmp.exe (PID: 3988)

    • Changes the login/logoff helper path in the registry

      • tmp6AD1.tmp.exe (PID: 2344)

    • NJRAT was detected

      • server.exe (PID: 1788)

    • Connects to CnC server

      • server.exe (PID: 1788)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 3764)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 3764)
      • Cryptotab.exe (PID: 2440)
      • server.exe (PID: 1788)
      • tmp6AD1.tmp.exe (PID: 3988)

    • Drops a file with a compile date too recent

      • iexplore.exe (PID: 3764)
      • Cryptotab.exe (PID: 2440)
      • iexplore.exe (PID: 3264)
      • server.exe (PID: 1788)

    • Checks supported languages

      • server.exe (PID: 1788)
      • Cryptotab.exe (PID: 2440)
      • StUpdate.exe (PID: 1780)
      • tmp6AD1.tmp.exe (PID: 2344)
      • tmp6AD1.tmp.exe (PID: 3988)

    • Reads the computer name

      • Cryptotab.exe (PID: 2440)
      • server.exe (PID: 1788)
      • StUpdate.exe (PID: 1780)
      • tmp6AD1.tmp.exe (PID: 3988)
      • tmp6AD1.tmp.exe (PID: 2344)

    • Creates files in the user directory

      • Cryptotab.exe (PID: 2440)
      • server.exe (PID: 1788)

    • Starts itself from another location

      • Cryptotab.exe (PID: 2440)

    • Uses NETSH.EXE for network configuration

      • server.exe (PID: 1788)

    • Reads Environment values

      • netsh.exe (PID: 3352)
      • server.exe (PID: 1788)
      • netsh.exe (PID: 2248)
      • netsh.exe (PID: 3840)

    • Executed via Task Scheduler

      • StUpdate.exe (PID: 2776)
      • StUpdate.exe (PID: 1780)

    • Drops a file with too old compile date

      • server.exe (PID: 1788)
      • tmp6AD1.tmp.exe (PID: 3988)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 3764)
      • netsh.exe (PID: 3352)
      • netsh.exe (PID: 2248)
      • schtasks.exe (PID: 2148)
      • netsh.exe (PID: 3840)

    • Reads the computer name

      • iexplore.exe (PID: 3764)
      • iexplore.exe (PID: 3264)
      • netsh.exe (PID: 3352)
      • netsh.exe (PID: 2248)
      • netsh.exe (PID: 3840)
      • schtasks.exe (PID: 2148)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3764)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3764)
      • iexplore.exe (PID: 3264)

    • Changes internet zones settings

      • iexplore.exe (PID: 3764)

    • Application launched itself

      • iexplore.exe (PID: 3764)

    • Creates files in the user directory

      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 3764)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3764)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3264)
      • iexplore.exe (PID: 3764)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3264)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3764)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
12
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start iexplore.exe iexplore.exe cryptotab.exe #NJRAT server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs schtasks.exe no specs stupdate.exe no specs stupdate.exe tmp6ad1.tmp.exe tmp6ad1.tmp.exe

Process information

PID
CMD
Path
Indicators
Parent process
3764"C:\Program Files\Internet Explorer\iexplore.exe" "https://disk.yandex.ru/d/b9zMfUFHnRhQtA"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3264"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3764 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2440"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Cryptotab.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Cryptotab.exe
iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\cryptotab.exe
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1788"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
Cryptotab.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\advapi32.dll
3352netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe" "server.exe" ENABLEC:\Windows\system32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\credui.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3840netsh firewall delete allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe"C:\Windows\system32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2248netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe" "server.exe" ENABLEC:\Windows\system32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\credui.dll
2148schtasks /create /sc minute /mo 1 /tn StUpdate /tr C:\Users\admin\AppData\Local\Temp/StUpdate.exeC:\Windows\system32\schtasks.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2776C:\Users\admin\AppData\Local\Temp/StUpdate.exe C:\Users\admin\AppData\Local\Temp\StUpdate.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\stupdate.exe
c:\windows\system32\ntdll.dll
1780C:\Users\admin\AppData\Local\Temp/StUpdate.exe C:\Users\admin\AppData\Local\Temp\StUpdate.exe
taskeng.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\stupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
Total events
20 957
Read events
20 620
Write events
332
Delete events
5

Modification events

(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30939221
(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30939221
(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3764) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
34
Suspicious files
23
Text files
20
Unknown types
16

Dropped files

PID
Process
Filename
Type
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6der
MD5:DC6CE777F8453501DB1B3F46769DBBD0
SHA256:DD1D9AAC41BEFA4B15B8BDF06BA811BFF5DEFE5F39B447F0C928D79657711E58
3264iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\2GA6GBQZ.txttext
MD5:9D876E2AAF6047F5538768C6CDF23CAD
SHA256:2D981EEC44CFD86811F22A491D076CD3ECA759216738B08763176D2C7D6A3A61
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E887E036775F4159E2816B7B9E527E5F_D0F3378B0A5E09534CCA8798569940EBder
MD5:6BF0E97CC4FD0069301AC0F5722CF412
SHA256:B5664F19606162C4E6F3BEF9923929394274DFA745A142EEE0311D90163C73B2
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68FAF71AF355126BCA00CE2E73CC7374_77B682CF3AAC7B00161DFFF7DEA4CC8Cder
MD5:C105609247D123E14E7D841746BD7F1B
SHA256:2D16F804375D3885707E5647E56A82D7E597CBF7E64ADC055602570644CB015E
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6binary
MD5:D80F74388B9AF019CFF16ED52C0893CB
SHA256:E13E647429158CC35CF42881FFFA7B9F1390431A962E1D0809AE985D1988BF5C
3264iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\watch[1].jstext
MD5:5FE7CD783ECD8AE79C5ABAC67DBF76ED
SHA256:A19A7C026EA510F9130B05E9B0FFEE379D64239E9103A686570CF6770534C5B2
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E887E036775F4159E2816B7B9E527E5F_ADE58CF9589C2D8854882E94BDAA0990der
MD5:453E5253D6ED518320AF29E80E53E79D
SHA256:DB353B51F5732B2214469F4C2C9286F0F536DE118941FE6E1E892CAC8A0F09CE
3264iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\b9zMfUFHnRhQtA[1].htmhtml
MD5:4C7703879C7192D299829934F8A6EAE6
SHA256:93943DD665570EE7C3543EF6E8F25A21835CA2896CDB7ACF81991FA8A729D0B4
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E887E036775F4159E2816B7B9E527E5F_ADE58CF9589C2D8854882E94BDAA0990binary
MD5:D977951196F7FCFFBB04796F2D8657A5
SHA256:BEB64F154915D28A3F99FC3F6EF2DE247CA603E0F00D01131CC2A535B4663F8F
3264iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3EAB0C7F8A0637A2707060AA40035B3E
SHA256:9565503C1342730590244E73447E91A034F193362DAFD6DC779D1E69F6A11344
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
18
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3264
iexplore.exe
GET
200
2.16.186.163:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I
unknown
der
1.54 Kb
whitelisted
3764
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3264
iexplore.exe
GET
200
5.45.205.243:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEDOB3I9UeYBPeBwD%2BBgMzcg%3D
RU
der
1.48 Kb
whitelisted
3764
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3264
iexplore.exe
GET
200
5.45.205.243:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEHoHzpzggMLl%2Fc8M87bvClo%3D
RU
der
1.48 Kb
whitelisted
3264
iexplore.exe
GET
200
5.45.205.243:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEGlTKIPuh018TJJ9M3J8QXw%3D
RU
der
1.48 Kb
whitelisted
3264
iexplore.exe
GET
200
2.16.186.163:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w%2FsCEQCTkoVAAWVxX5R%2FKI%2FvyZso
unknown
der
1.50 Kb
whitelisted
3264
iexplore.exe
GET
200
5.45.205.243:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CED3qPfT1yuXcCePg2RUC75o%3D
RU
der
1.48 Kb
whitelisted
3264
iexplore.exe
GET
200
23.32.238.232:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?eca9542a7ac09f54
US
compressed
4.70 Kb
whitelisted
3264
iexplore.exe
GET
200
5.45.205.243:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEFDje3I7MASsbiBNGm3xtrE%3D
RU
der
1.48 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3764
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3264
iexplore.exe
93.158.134.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
3264
iexplore.exe
23.32.238.232:80
ctldl.windowsupdate.com
XO Communications
US
unknown
3764
iexplore.exe
13.107.22.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3764
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3264
iexplore.exe
87.250.250.50:443
disk.yandex.ru
YANDEX LLC
RU
whitelisted
3264
iexplore.exe
2.16.186.163:80
subca.ocsp-certum.com
Akamai International B.V.
—
whitelisted
3264
iexplore.exe
5.45.205.243:80
yandex.ocsp-responder.com
YANDEX LLC
RU
whitelisted
3764
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3264
iexplore.exe
178.154.131.217:443
yastatic.net
YANDEX LLC
RU
whitelisted

DNS requests

Domain
IP
Reputation
disk.yandex.ru
  • 87.250.250.50
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ctldl.windowsupdate.com
  • 23.32.238.232
  • 23.32.238.201
whitelisted
subca.ocsp-certum.com
  • 2.16.186.163
  • 2.16.186.232
whitelisted
yandex.ocsp-responder.com
  • 5.45.205.243
  • 5.45.205.241
  • 5.45.205.242
  • 5.45.205.245
  • 5.45.205.244
whitelisted
mc.yandex.ru
  • 93.158.134.119
  • 87.250.250.119
  • 77.88.21.119
  • 87.250.251.119
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
yastatic.net
  • 178.154.131.217
  • 178.154.131.215
  • 178.154.131.216
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)
—
—
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://disk.yandex.ru/d/b9zMfUFHnRhQtA