File name:

PON.exe

Full analysis: https://app.any.run/tasks/38ff0585-336a-4170-b9f7-145a598b4375
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: February 11, 2024, 08:06:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

C767BAB06D9E85E384B5C59F1F44917F

SHA1:

DF9B7898FC72E0DE864738707767F1309A10E27B

SHA256:

D959997F88927AC025C047D7ECBBDCF088BE2132E348B5ACB5A1BB7994EDAA67

SSDEEP:

384:J4QPm/fl7Ts6f/P94XpF0db37H2DssIJqqah0I8ZumTG3IBL+EcoinblneHQM3ew:lPubf/PeXpm97HlJqqiD8ZuSNujUcI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NjRAT is detected

      • PON.exe (PID: 3652)
      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Drops the executable file immediately after the start

      • PON.exe (PID: 3652)
      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Create files in the Startup directory

      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Connects to the CnC server

      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • NJRAT has been detected (YARA)

      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • NJRAT has been detected (SURICATA)

      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Changes the autorun value in the registry

      • Bluetooth discovery protocol servises.exe (PID: 3708)

  • SUSPICIOUS

    • Reads the Internet Settings

      • PON.exe (PID: 3652)
      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Executable content was dropped or overwritten

      • PON.exe (PID: 3652)
      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Reads security settings of Internet Explorer

      • PON.exe (PID: 3652)
      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Starts itself from another location

      • PON.exe (PID: 3652)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Starts CMD.EXE for commands execution

      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Connects to unusual port

      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Executing commands from a ".bat" file

      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2792)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 2792)

  • INFO

    • Reads the computer name

      • PON.exe (PID: 3652)
      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Creates files in the program directory

      • PON.exe (PID: 3652)

    • Checks supported languages

      • PON.exe (PID: 3652)
      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Reads the machine GUID from the registry

      • PON.exe (PID: 3652)
      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Creates files or folders in the user directory

      • Bluetooth discovery protocol servises.exe (PID: 3708)

    • Reads Environment values

      • Bluetooth discovery protocol servises.exe (PID: 3708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(3708) Bluetooth discovery protocol servises.exe
C2photography-ringtones.gl.at.ply.gg
Ports29246
BotnetXer
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\e9dbc39bf7d7c86cdeb9bb1f7473e919
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:11 06:27:25+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 36352
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0xac1e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
38
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #NJRAT pon.exe #NJRAT bluetooth discovery protocol servises.exe netsh.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs rundll32.exe no specs reg.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 67108863 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
748reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoStartMenuPinnedList /t REG_DWORD /d 1 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
796reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\main\FeatureControl\Feature_LocalMachine_Lockdown" /v "IExplorer" /d 0 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
980reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1352reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRecentDocsMenu /t REG_DWORD /d 1 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1368reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoAddPrinter /t REG_DWORD /d 1 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1556reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSMMyDocs /t REG_DWORD /d 1 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1576reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoCommonGroups /t REG_DWORD /d 1 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1740reg add "HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions" /v "NoFindFiles" /d 1 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1808reg add "hkcu\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFavoritesMenu /t REG_DWORD /d 1 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
4 593
Read events
4 262
Write events
331
Delete events
0

Modification events

(PID) Process:(3652) PON.exeKey:HKEY_CURRENT_USER
Operation:writeName:di
Value:
!
(PID) Process:(3652) PON.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3652) PON.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3652) PON.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3652) PON.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3708) Bluetooth discovery protocol servises.exeKey:HKEY_CURRENT_USER
Operation:writeName:di
Value:
!
(PID) Process:(3708) Bluetooth discovery protocol servises.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:e9dbc39bf7d7c86cdeb9bb1f7473e919
Value:
"C:\ProgramData\Bluetooth discovery protocol servises.exe" ..
(PID) Process:(2752) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2752) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-100
Value:
DHCP Quarantine Enforcement Client
(PID) Process:(2752) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-101
Value:
Provides DHCP based enforcement for NAP
Executable files
2
Suspicious files
0
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
3708Bluetooth discovery protocol servises.exeC:\Users\admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_902670FAA7AA4F7EBADFCB543A2775A4.datbinary
MD5:D899B593DEBE44F309C27959C8D4F494
SHA256:3426F105FBED54965F11C809DB711C8D540644E627D9A9EAE46C5AFE14C98A59
3708Bluetooth discovery protocol servises.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e9dbc39bf7d7c86cdeb9bb1f7473e919.exeexecutable
MD5:C767BAB06D9E85E384B5C59F1F44917F
SHA256:D959997F88927AC025C047D7ECBBDCF088BE2132E348B5ACB5A1BB7994EDAA67
3652PON.exeC:\ProgramData\Bluetooth discovery protocol servises.exeexecutable
MD5:C767BAB06D9E85E384B5C59F1F44917F
SHA256:D959997F88927AC025C047D7ECBBDCF088BE2132E348B5ACB5A1BB7994EDAA67
3708Bluetooth discovery protocol servises.exeC:\Users\admin\Desktop\hui.battext
MD5:7EB704FA7444403709C4D3E1C87C9AA8
SHA256:E2EEE61CDBC64AC601FCB67247B7B0E46DEA27F850E98067E965A7EAD9A2E527
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
1
Threats
7

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3708
Bluetooth discovery protocol servises.exe
147.185.221.18:29246
photography-ringtones.gl.at.ply.gg
PLAYIT-GG
US
malicious

DNS requests

Domain
IP
Reputation
photography-ringtones.gl.at.ply.gg
  • 147.185.221.18
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
3708
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
3708
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (File Manager Actions)
3708
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Microphone)
3708
Bluetooth discovery protocol servises.exe
Malware Command and Control Activity Detected
ET MALWARE njrat ver 0.7d Malware CnC Callback (Microphone)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PON.exe