File name: | ec21432052298640b54673391e93df26375776f511d9ca1efcf93fa939c2ff48.doc |
Full analysis: | https://app.any.run/tasks/8d9ca9af-3e1b-44d8-8210-627733acc64d |
Verdict: | Malicious activity |
Threats: | njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world. |
Analysis date: | July 17, 2019, 18:39:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | text/rtf |
File info: | Rich Text Format data, version 1, unknown character set |
MD5: | B8E1A1EFB94A995E7447D51541F08DE9 |
SHA1: | 2440429F66F1260F18E35DE3B7F749B746858CD1 |
SHA256: | EC21432052298640B54673391E93DF26375776F511D9CA1EFCF93FA939C2FF48 |
SSDEEP: | 768:OvyXCdJWz7zpgegbFz8Lob2GR/yapptJdRH4v:cm7gJz/BrH74v |
.rtf | | | Rich Text Format (100) |
---|
InternalVersionNumber: | 24689 |
---|---|
CharactersWithSpaces: | 4 |
Characters: | 4 |
Words: | - |
Pages: | 1 |
TotalEditTime: | 1 minute |
RevisionNumber: | 2 |
ModifyDate: | 2019:06:20 00:52:00 |
CreateDate: | 2019:06:20 00:52:00 |
LastModifiedBy: | Windows User |
Author: | C |
Title: | Not |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2876 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\ec21432052298640b54673391e93df26375776f511d9ca1efcf93fa939c2ff48.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 | ||||
4004 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | — | svchost.exe |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2784 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" | C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE | EQNEDT32.EXE | |
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 | ||||
2540 | C:\Users\admin\AppData\Roaming\408812.exe | C:\Users\admin\AppData\Roaming\408812.exe | — | EQNEDT32.EXE |
User: admin Company: VersaVPN L.L.C Integrity Level: MEDIUM Description: VersaVPN Version: 1.0.0.5 | ||||
2944 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | — | 408812.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
3064 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | — | 408812.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
3256 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | — | 408812.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
3564 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | 408812.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 2.0.50727.5420 (Win7SP1.050727-5400) | ||||
3716 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe | — | 408812.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 2.0.50727.5420 (Win7SP1.050727-5400) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2876 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRA6A0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2784 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\408812.exe | — | |
MD5:— | SHA256:— | |||
2876 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{760F9511-AC49-4459-AC82-94C68079F9F8}.tmp | — | |
MD5:— | SHA256:— | |||
2876 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{685A853B-101B-4282-BEAD-0A9F4249BC95}.tmp | — | |
MD5:— | SHA256:— | |||
2784 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@put[1].txt | text | |
MD5:6329036A66FA92B49BBF3EE896726D27 | SHA256:B41E1224B902374D91DDABDCC24D4123700248FACA88CEF2EFC751582272C8C4 | |||
2784 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\3[1].exe | executable | |
MD5:A1F0BA4951E43A05D5C05DE6E7BDF44C | SHA256:045EFFC81057CB6E8E94899EAF9B522768CFD3D81F0CBE029D1C15346961EB1D | |||
2876 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{AE97265E-088F-4E4F-9DF7-2C0271EBD231}.tmp | binary | |
MD5:75B31CD62066E79EAD889CB6029D6FE0 | SHA256:30C379593CE76020667CB2058D379656A08D6079A7C9FC8212F5F4404A0936D1 | |||
2876 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:F2DE1431816F1A887F11E37F0E5B78C1 | SHA256:AC75C28502BA69F35891655C9ADFC2B4C73730F00CE0F6C22519E9B5B48762BD | |||
2876 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\wd32PrvSE.wmf | binary | |
MD5:C8BBD69BB58F455FD68CE82892139525 | SHA256:DA65E5D170765F586BD067BC32648B01E6FFDBBDC55FBED9DA5AAD8F5724E84B | |||
2876 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$21432052298640b54673391e93df26375776f511d9ca1efcf93fa939c2ff48.doc | pgc | |
MD5:C4AC655CFC2B2DEB2E682E8C11173C19 | SHA256:4B4905F4A1F3E225442F94B051670BDA07342CBFE008A50067402CDFD1A91765 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2784 | EQNEDT32.EXE | 104.27.143.252:443 | m.put.re | Cloudflare Inc | US | shared |
2784 | EQNEDT32.EXE | 104.27.142.252:443 | m.put.re | Cloudflare Inc | US | shared |
3564 | RegAsm.exe | 104.20.208.21:443 | pastebin.com | Cloudflare Inc | US | shared |
3564 | RegAsm.exe | 185.247.228.236:7707 | — | — | — | malicious |
Domain | IP | Reputation |
---|---|---|
m.put.re |
| suspicious |
dns.msftncsi.com |
| shared |
pastebin.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
3564 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] njRAT/Bladabindi (Lime-RAT) |