We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
28 July 2024, 23:35
Analysis environment:
Windows 10 Pro, build 19045, x64
New-Client.exe
MD5:
55CCDAF3FC592784367C93D1E996BA45
SHA1:
9C4990BF35A1204D9568991C39AFF3C06B417277
SHA256:
DADB22113040E155C4B3F55A5B19EFEF4442333A36B3DDF1528848E16A535662
Analysis result
Threat level:
Malicious activity
Tags:
rat
njrat
bladabindi
remote
limerat
trojan
Full analysis:
Analysis New-Client.exe (MD5: 55CCDAF3FC592784367C93D1E996BA45) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Drops the executable file immediately after the start
New-Client.exe (PID: 1752)
Changes the autorun value in the registry
New-Client.exe (PID: 1752)
Connects to the CnC server
Wservices.exe (PID: 5608)
LimeRAT is detected
Wservices.exe (PID: 5608)
NJRAT has been detected (SURICATA)
Wservices.exe (PID: 5608)
LIMERAT has been detected (YARA)
Wservices.exe (PID: 5608)
SUSPICIOUS
Executable content was dropped or overwritten
New-Client.exe (PID: 1752)
The process creates files with name similar to system file names
New-Client.exe (PID: 1752)
Reads security settings of Internet Explorer
New-Client.exe (PID: 1752)
Reads the date of Windows installation
New-Client.exe (PID: 1752)
Starts itself from another location
New-Client.exe (PID: 1752)
Connects to unusual port
Wservices.exe (PID: 5608)
Contacting a server suspected of hosting an CnC
Wservices.exe (PID: 5608)
INFO
Reads the software policy settings
slui.exe (PID: 6572)
Wservices.exe (PID: 5608)
Checks supported languages
New-Client.exe (PID: 1752)
Wservices.exe (PID: 5608)
Reads the computer name
New-Client.exe (PID: 1752)
Wservices.exe (PID: 5608)
Reads the machine GUID from the registry
New-Client.exe (PID: 1752)
Wservices.exe (PID: 5608)
Checks proxy server information
slui.exe (PID: 6572)
Wservices.exe (PID: 5608)
Create files in a temporary directory
New-Client.exe (PID: 1752)
Process checks computer location settings
New-Client.exe (PID: 1752)
Reads Environment values
Wservices.exe (PID: 5608)
Disables trace logs
Wservices.exe (PID: 5608)
Threats
No threats detected