| File name: | minecraft.exe |
| Full analysis: | https://app.any.run/tasks/5d74e827-940e-47bd-950b-ba66974812d1 |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | February 11, 2024, 05:20:35 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | D4520E6CADBE5B453A630401B038D442 |
| SHA1: | 6CE86011DC4D9B33D3B8D67817B04257F2AE9B37 |
| SHA256: | C915DD811FE6BAA93CD9B68644E0BED1AFB8B8D15F5A69C31E790E9036F8A046 |
| SSDEEP: | 384:D4hP1yXRvXcWNnP24X0odBUvy8HIxssIJqqah0I8ZumTG3IBL+EcoinblneHQM38:GP1VenPXX0auy8HFJqqiD8ZuSNuaOcI |
MALICIOUS
NjRAT is detected
- minecraft.exe (PID: 2160)
- Bluetooth discovery protocol servises.exe (PID: 3952)
Drops the executable file immediately after the start
- minecraft.exe (PID: 2160)
- Bluetooth discovery protocol servises.exe (PID: 3952)
NJRAT has been detected (SURICATA)
- Bluetooth discovery protocol servises.exe (PID: 3952)
Connects to the CnC server
- Bluetooth discovery protocol servises.exe (PID: 3952)
Create files in the Startup directory
- Bluetooth discovery protocol servises.exe (PID: 3952)
NJRAT has been detected (YARA)
- Bluetooth discovery protocol servises.exe (PID: 3952)
Changes the autorun value in the registry
- Bluetooth discovery protocol servises.exe (PID: 3952)
SUSPICIOUS
Executable content was dropped or overwritten
- minecraft.exe (PID: 2160)
- Bluetooth discovery protocol servises.exe (PID: 3952)
Starts itself from another location
- minecraft.exe (PID: 2160)
Reads the Internet Settings
- minecraft.exe (PID: 2160)
Reads security settings of Internet Explorer
- minecraft.exe (PID: 2160)
Uses NETSH.EXE to add a firewall rule or allowed programs
- Bluetooth discovery protocol servises.exe (PID: 3952)
Connects to unusual port
- Bluetooth discovery protocol servises.exe (PID: 3952)
INFO
Checks supported languages
- minecraft.exe (PID: 2160)
- Bluetooth discovery protocol servises.exe (PID: 3952)
Creates files in the program directory
- minecraft.exe (PID: 2160)
Reads the computer name
- minecraft.exe (PID: 2160)
- Bluetooth discovery protocol servises.exe (PID: 3952)
Reads the machine GUID from the registry
- minecraft.exe (PID: 2160)
- Bluetooth discovery protocol servises.exe (PID: 3952)
Creates files or folders in the user directory
- Bluetooth discovery protocol servises.exe (PID: 3952)
Reads Environment values
- Bluetooth discovery protocol servises.exe (PID: 3952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
NjRat
(PID) Process(3952) Bluetooth discovery protocol servises.exe
C20.tcp.eu.ngrok.io
Ports11456
BotnetXer
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\78a154b7c7ad7f8cc0e0cfbca095143d
Splitter|'|'|
Versionim523
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:02:10 16:24:21+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 35840 |
| InitializedDataSize: | 1536 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xabee |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
40
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2160 | "C:\Users\admin\AppData\Local\Temp\minecraft.exe" | C:\Users\admin\AppData\Local\Temp\minecraft.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3708 | netsh firewall add allowedprogram "C:\ProgramData\Bluetooth discovery protocol servises.exe" "Bluetooth discovery protocol servises.exe" ENABLE | C:\Windows\System32\netsh.exe | — | Bluetooth discovery protocol servises.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3952 | "C:\ProgramData\Bluetooth discovery protocol servises.exe" | C:\ProgramData\Bluetooth discovery protocol servises.exe | minecraft.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
NjRat(PID) Process(3952) Bluetooth discovery protocol servises.exe C20.tcp.eu.ngrok.io Ports11456 BotnetXer Options Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\78a154b7c7ad7f8cc0e0cfbca095143d Splitter|'|'| Versionim523 | |||||||||||||||
Total events
2 589
Read events
2 391
Write events
198
Delete events
0
Modification events
| (PID) Process: | (2160) minecraft.exe | Key: | HKEY_CURRENT_USER |
| Operation: | write | Name: | di |
Value: ! | |||
| (PID) Process: | (2160) minecraft.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2160) minecraft.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2160) minecraft.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2160) minecraft.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (3952) Bluetooth discovery protocol servises.exe | Key: | HKEY_CURRENT_USER |
| Operation: | write | Name: | di |
Value: ! | |||
| (PID) Process: | (3952) Bluetooth discovery protocol servises.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | 78a154b7c7ad7f8cc0e0cfbca095143d |
Value: "C:\ProgramData\Bluetooth discovery protocol servises.exe" .. | |||
| (PID) Process: | (3708) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3708) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\dhcpqec.dll,-100 |
Value: DHCP Quarantine Enforcement Client | |||
| (PID) Process: | (3708) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | @%SystemRoot%\system32\dhcpqec.dll,-101 |
Value: Provides DHCP based enforcement for NAP | |||
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3952 | Bluetooth discovery protocol servises.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\78a154b7c7ad7f8cc0e0cfbca095143d.exe | executable | |
MD5:D4520E6CADBE5B453A630401B038D442 | SHA256:C915DD811FE6BAA93CD9B68644E0BED1AFB8B8D15F5A69C31E790E9036F8A046 | |||
| 2160 | minecraft.exe | C:\ProgramData\Bluetooth discovery protocol servises.exe | executable | |
MD5:D4520E6CADBE5B453A630401B038D442 | SHA256:C915DD811FE6BAA93CD9B68644E0BED1AFB8B8D15F5A69C31E790E9036F8A046 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
2
Threats
14
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3952 | Bluetooth discovery protocol servises.exe | 3.125.102.39:11456 | 0.tcp.eu.ngrok.io | AMAZON-02 | DE | unknown |
3952 | Bluetooth discovery protocol servises.exe | 18.158.249.75:11456 | 0.tcp.eu.ngrok.io | AMAZON-02 | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
0.tcp.eu.ngrok.io |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Misc activity | ET INFO DNS Query to a *.ngrok domain (ngrok.io) |
3952 | Bluetooth discovery protocol servises.exe | Malware Command and Control Activity Detected | ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) |
3952 | Bluetooth discovery protocol servises.exe | Malware Command and Control Activity Detected | ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) |
1080 | svchost.exe | Misc activity | ET INFO DNS Query to a *.ngrok domain (ngrok.io) |
3952 | Bluetooth discovery protocol servises.exe | Malware Command and Control Activity Detected | ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) |
3952 | Bluetooth discovery protocol servises.exe | Malware Command and Control Activity Detected | ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) |
8 ETPRO signatures available at the full report