| File name: | tempfolder4561.exe |
| Full analysis: | https://app.any.run/tasks/0b6395dc-ba14-4a16-876d-4406f890694b |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | December 02, 2023, 22:20:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 660BC139BE0D246E0B12FBFCB1A2E3C1 |
| SHA1: | AE3CCD0CEE931AB5DEA9DCD2CBC066A0AA8B1285 |
| SHA256: | D923CD1E3466B983D4C2FF1BCF8B3A8950B3822ED3934BF8D11589C101B1624A |
| SSDEEP: | 3072:vj5HO83Sf8d0mfQqvvhrNRar9Ws8hQJuDe3igtIrzwvwk:75HOOTH3cr9QFa3ijrUvV |
MALICIOUS
Drops the executable file immediately after the start
- tempfolder4561.exe (PID: 2644)
- tempfolder4561.exe (PID: 2428)
Create files in the Startup directory
- tempfolder4561.exe (PID: 2644)
- tempfolder4561.exe (PID: 2428)
NjRAT is detected
- tempfolder4561.exe (PID: 2428)
Changes the autorun value in the registry
- tempfolder4561.exe (PID: 2428)
SUSPICIOUS
Starts itself from another location
- tempfolder4561.exe (PID: 2644)
Reads the Internet Settings
- tempfolder4561.exe (PID: 2644)
Uses ATTRIB.EXE to modify file attributes
- tempfolder4561.exe (PID: 2644)
- tempfolder4561.exe (PID: 2428)
INFO
Checks supported languages
- tempfolder4561.exe (PID: 2644)
- tempfolder4561.exe (PID: 2428)
Reads the computer name
- tempfolder4561.exe (PID: 2644)
- tempfolder4561.exe (PID: 2428)
Creates files or folders in the user directory
- tempfolder4561.exe (PID: 2644)
- tempfolder4561.exe (PID: 2428)
Create files in a temporary directory
- tempfolder4561.exe (PID: 2644)
Reads the machine GUID from the registry
- tempfolder4561.exe (PID: 2644)
- tempfolder4561.exe (PID: 2428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (45.1) |
|---|---|---|
| .exe | | | Win32 Executable MS Visual C++ (generic) (19.2) |
| .exe | | | Win64 Executable (generic) (17) |
| .scr | | | Windows screen saver (8) |
| .dll | | | Win32 Dynamic Link Library (generic) (4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:07:30 18:42:21+02:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 159232 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x28dae |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
44
Monitored processes
5
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1116 | attrib +h +r +s "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Defender Sevices.exe" | C:\Windows\System32\attrib.exe | — | tempfolder4561.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1640 | attrib +h +r +s "C:\Users\admin\AppData\Local\Temp\tempfolder4561.exe" | C:\Windows\System32\attrib.exe | — | tempfolder4561.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2428 | "C:\Users\admin\AppData\Local\Temp\tempfolder4561.exe" | C:\Users\admin\AppData\Local\Temp\tempfolder4561.exe | tempfolder4561.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2644 | "C:\Users\admin\Desktop\tempfolder4561.exe" | C:\Users\admin\Desktop\tempfolder4561.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3784 | attrib +h +r +s "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Defender Sevices.exe" | C:\Windows\System32\attrib.exe | — | tempfolder4561.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 399
Read events
1 229
Write events
170
Delete events
0
Modification events
| (PID) Process: | (2644) tempfolder4561.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2644) tempfolder4561.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2644) tempfolder4561.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2644) tempfolder4561.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2428) tempfolder4561.exe | Key: | HKEY_CURRENT_USER |
| Operation: | write | Name: | di |
Value: ! | |||
| (PID) Process: | (2428) tempfolder4561.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Defender Sevices2 |
Value: C:\Users\admin\AppData\Local\Temp\tempfolder4561.exe | |||
| (PID) Process: | (2428) tempfolder4561.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Defender Sevices |
Value: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Defender Sevices.URL | |||
Executable files
2
Suspicious files
2
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2644 | tempfolder4561.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Defender Sevices.lnk | binary | |
MD5:D977F41D231D9E410D98E7FD93AB8ABC | SHA256:D0874A252483B2FBBF4EF3D4C242F484B123C4F1EB1662890E1B151FDBB95C5D | |||
| 2644 | tempfolder4561.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Defender Sevices.lnk | binary | |
MD5:215C102317DBDE97DBBFA6B89AFB7B06 | SHA256:CAD30CC01F93CD1B607D6397EAA16B68699B97388193E9750F36AC935F308790 | |||
| 2644 | tempfolder4561.exe | C:\Users\admin\AppData\Local\Temp\tempfolder4561.exe | executable | |
MD5:660BC139BE0D246E0B12FBFCB1A2E3C1 | SHA256:D923CD1E3466B983D4C2FF1BCF8B3A8950B3822ED3934BF8D11589C101B1624A | |||
| 2428 | tempfolder4561.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Defender Sevices.exe | executable | |
MD5:660BC139BE0D246E0B12FBFCB1A2E3C1 | SHA256:D923CD1E3466B983D4C2FF1BCF8B3A8950B3822ED3934BF8D11589C101B1624A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
1
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
microsoftservices.myvnc.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.myvnc .com |