| File name: | file.exe |
| Full analysis: | https://app.any.run/tasks/e6d1d17f-cbf2-4264-8a70-50d4423af47e |
| Verdict: | Malicious activity |
| Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
| Analysis date: | October 18, 2023, 19:34:19 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 03EC5C870036082F93ED9CC654CE717C |
| SHA1: | 8D1BCEFCCFCB5A1B6B349B4FF9C8B5873222CE3E |
| SHA256: | E5C20AFBD4C52F831AE5C874113D08510D1B048B562524E7525EC72C12A858F6 |
| SSDEEP: | 768:1N+NrcHx6rHAtEcSEJdefnbBuQYQtr/+YaRccmZPtZTg:1N+tAKHjcSEJdenEQYQB/+YaRhmR |
MALICIOUS
Drops the executable file immediately after the start
- file.exe (PID: 1560)
- windows.exe (PID: 1484)
- windows.exe (PID: 2244)
Application was dropped or rewritten from another process
- file.exe (PID: 1560)
- windows.exe (PID: 1484)
- windows.exe (PID: 2244)
Create files in the Startup directory
- windows.exe (PID: 1484)
- windows.exe (PID: 2244)
NJRAT has been detected (YARA)
- windows.exe (PID: 1484)
NJRAT was detected
- windows.exe (PID: 1484)
Connects to the CnC server
- windows.exe (PID: 1484)
NjRAT is detected
- windows.exe (PID: 1484)
- windows.exe (PID: 2244)
Changes the autorun value in the registry
- windows.exe (PID: 1484)
- windows.exe (PID: 2244)
SUSPICIOUS
Reads the Internet Settings
- file.exe (PID: 1560)
- sipnotify.exe (PID: 1452)
Starts itself from another location
- file.exe (PID: 1560)
Uses NETSH.EXE to add a firewall rule or allowed programs
- windows.exe (PID: 1484)
- windows.exe (PID: 2244)
Connects to unusual port
- windows.exe (PID: 1484)
The process executes via Task Scheduler
- sipnotify.exe (PID: 1452)
Reads settings of System Certificates
- sipnotify.exe (PID: 1452)
INFO
Reads the machine GUID from the registry
- wmpnscfg.exe (PID: 3684)
- file.exe (PID: 1560)
- wmpnscfg.exe (PID: 3448)
- wmpnscfg.exe (PID: 3868)
- windows.exe (PID: 2244)
- windows.exe (PID: 1484)
Create files in a temporary directory
- file.exe (PID: 1560)
Reads the computer name
- file.exe (PID: 1560)
- wmpnscfg.exe (PID: 3684)
- windows.exe (PID: 1484)
- IMEKLMG.EXE (PID: 900)
- IMEKLMG.EXE (PID: 2108)
- wmpnscfg.exe (PID: 3868)
- wmpnscfg.exe (PID: 3448)
- windows.exe (PID: 2244)
Checks supported languages
- wmpnscfg.exe (PID: 3684)
- file.exe (PID: 1560)
- windows.exe (PID: 1484)
- IMEKLMG.EXE (PID: 900)
- IMEKLMG.EXE (PID: 2108)
- windows.exe (PID: 2244)
- wmpnscfg.exe (PID: 3868)
- wmpnscfg.exe (PID: 3448)
Creates files or folders in the user directory
- windows.exe (PID: 1484)
Manual execution by a user
- IMEKLMG.EXE (PID: 900)
- windows.exe (PID: 2244)
- IMEKLMG.EXE (PID: 2108)
- wmpnscfg.exe (PID: 3448)
- wmpnscfg.exe (PID: 3868)
Process checks are UAC notifies on
- IMEKLMG.EXE (PID: 900)
- IMEKLMG.EXE (PID: 2108)
Reads security settings of Internet Explorer
- sipnotify.exe (PID: 1452)
Reads Environment values
- windows.exe (PID: 1484)
- windows.exe (PID: 2244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
NjRat
(PID) Process(1484) windows.exe
C2147.185.221.17
Ports1974
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\c028c795dd5be67a3f7352a9c42abcf7
Splitter|'|'|
Versionim523
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:10:18 21:29:52+02:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 34816 |
| InitializedDataSize: | 1536 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa79e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
99
Monitored processes
11
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 900 | "C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /Log | C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Office IME 2010 Exit code: 1 Version: 14.0.4734.1000 Modules
| |||||||||||||||
| 1452 | C:\Windows\system32\sipnotify.exe -LogonOrUnlock | C:\Windows\System32\sipnotify.exe | — | taskeng.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: sipnotify Exit code: 0 Version: 6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716) Modules
| |||||||||||||||
| 1484 | "C:\Users\admin\AppData\Local\Temp\windows.exe" | C:\Users\admin\AppData\Local\Temp\windows.exe | file.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1073807364 Modules
NjRat(PID) Process(1484) windows.exe C2147.185.221.17 Ports1974 BotnetHacKed Options Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\c028c795dd5be67a3f7352a9c42abcf7 Splitter|'|'| Versionim523 | |||||||||||||||
| 1560 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2108 | "C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /Log | C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Office IME 2010 Exit code: 1 Version: 14.0.4734.1000 Modules
| |||||||||||||||
| 2244 | "C:\Users\admin\AppData\Local\Temp\windows.exe" .. | C:\Users\admin\AppData\Local\Temp\windows.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3120 | netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLE | C:\Windows\System32\netsh.exe | — | windows.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3448 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3684 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3868 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
6 394
Read events
5 992
Write events
390
Delete events
12
Modification events
| (PID) Process: | (3684) wmpnscfg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{DE2F7A6A-3263-4800-8594-237D720ECEF3}\{C01382C4-8B53-428A-80CA-DE14DA5DE7AC} |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (3684) wmpnscfg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{DE2F7A6A-3263-4800-8594-237D720ECEF3} |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (3684) wmpnscfg.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{AF2396DE-971E-41CB-9579-5E7196A31577} |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (1560) file.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (1560) file.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (1560) file.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (1560) file.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (1484) windows.exe | Key: | HKEY_CURRENT_USER |
| Operation: | write | Name: | di |
Value: ! | |||
| (PID) Process: | (3120) netsh.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1484) windows.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | c028c795dd5be67a3f7352a9c42abcf7 |
Value: "C:\Users\admin\AppData\Local\Temp\windows.exe" .. | |||
Executable files
3
Suspicious files
1
Text files
5
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1560 | file.exe | C:\Users\admin\AppData\Local\Temp\windows.exe | executable | |
MD5:03EC5C870036082F93ED9CC654CE717C | SHA256:E5C20AFBD4C52F831AE5C874113D08510D1B048B562524E7525EC72C12A858F6 | |||
| 1452 | sipnotify.exe | C:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\en-us.html | html | |
MD5:9752942B57692148B9F614CF4C119A36 | SHA256:E31B834DD53FA6815F396FC09C726636ABF98F3367F0CF1590EF5EB3801C75D1 | |||
| 1452 | sipnotify.exe | C:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\metadata.json | binary | |
MD5:E8A970BA6CE386EED9A5E724F26212A6 | SHA256:7E06107D585D8FC7870998F3856DCC3E35800AA97E4406AAB83BC8444B6CBDE3 | |||
| 1452 | sipnotify.exe | C:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\script.js | text | |
MD5:A2682382967C351F7ED21762F9E5DE9E | SHA256:36B1D26F1EC69685648C0528C2FCE95A3C2DBECF828CDFA4A8B4239A15B644A2 | |||
| 1484 | windows.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c028c795dd5be67a3f7352a9c42abcf7.exe | executable | |
MD5:03EC5C870036082F93ED9CC654CE717C | SHA256:E5C20AFBD4C52F831AE5C874113D08510D1B048B562524E7525EC72C12A858F6 | |||
| 2244 | windows.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c028c795dd5be67a3f7352a9c42abcf7.exe | executable | |
MD5:03EC5C870036082F93ED9CC654CE717C | SHA256:E5C20AFBD4C52F831AE5C874113D08510D1B048B562524E7525EC72C12A858F6 | |||
| 1452 | sipnotify.exe | C:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\microsoft-logo.png | image | |
MD5:B7C73A0CFBA68CC70C35EF9C63703CE4 | SHA256:1D8B27A0266FF526CF95447F3701592A908848467D37C09A00A2516C1F29A013 | |||
| 1452 | sipnotify.exe | C:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\main.jpg | image | |
MD5:B342ACE63F77961249A084C61EABC884 | SHA256:E5067BBA2095B5DA7C3171EC116E9A92337E24E471339B0860A160076EFE49B9 | |||
| 1452 | sipnotify.exe | C:\Users\admin\AppData\Local\microsoft\windows\SipNotify\eoscontent\styles.css | text | |
MD5:3383EEF350240253D7C2C2564381B3CB | SHA256:85443493D86D6D7FB0E07BC9705DFC9C858086FBA1B0E508092AB328D5F145E8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
11
DNS requests
3
Threats
13
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 200 | 104.98.137.239:80 | http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133421350315620000 | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2656 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1484 | windows.exe | 147.185.221.17:1974 | — | PLAYIT-GG | US | malicious |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
— | — | 104.98.137.239:80 | query.prod.cms.rt.microsoft.com | AKAMAI-AS | NL | unknown |
— | — | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 147.185.221.17:1974 | — | PLAYIT-GG | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
dns.msftncsi.com |
| shared |
query.prod.cms.rt.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1484 | windows.exe | Malware Command and Control Activity Detected | ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) |
— | — | Malware Command and Control Activity Detected | ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) |
11 ETPRO signatures available at the full report