File name:

1.zip

Full analysis: https://app.any.run/tasks/10600e25-6340-484d-92da-54efb81ea2c1
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: May 15, 2019, 16:52:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

6960EBD053FB5FC2D8792F0145A06A7D

SHA1:

53CD23F05518EAF160B8CCBB523E5236C3B75E2B

SHA256:

F1E61057605A38C6A9BF92F6E6671681E429F83DF050770C172097FE0871EFCC

SSDEEP:

3072:R1TenRzQZsOwfO9LZv3AHBN4jA8iV1aQaHPXP1IYW:R0RQ2OjAHv4jAbVKHPuZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • FortSlurper.exe (PID: 3816)
      • System_manager.exe (PID: 324)
      • tmp8101.tmp.exe (PID: 4036)
      • System_manager.exe (PID: 3068)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1256)

    • Writes to a start menu file

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

    • NJRAT was detected

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

    • Connects to CnC server

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

    • Changes the autorun value in the registry

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

  • SUSPICIOUS

    • Creates files in the user directory

      • FortSlurper.exe (PID: 3816)
      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)
      • tmp8101.tmp.exe (PID: 4036)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2964)
      • FortSlurper.exe (PID: 3816)
      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)
      • tmp8101.tmp.exe (PID: 4036)

    • Starts itself from another location

      • FortSlurper.exe (PID: 3816)
      • tmp8101.tmp.exe (PID: 4036)

    • Uses NETSH.EXE for network configuration

      • System_manager.exe (PID: 324)
      • System_manager.exe (PID: 3068)

    • Starts CMD.EXE for commands execution

      • System_manager.exe (PID: 324)

    • Uses NETSTAT.EXE to discover network connections

      • cmd.exe (PID: 588)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:05:15 16:58:08
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Fortnite Slurper Checker/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
16
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start winrar.exe searchprotocolhost.exe no specs fortslurper.exe #NJRAT system_manager.exe netsh.exe no specs tmp8101.tmp.exe netsh.exe no specs cmd.exe no specs ping.exe no specs #NJRAT system_manager.exe netsh.exe no specs regedit.exe no specs regedit.exe cmd.exe netstat.exe no specs netstat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
324"C:\Users\admin\AppData\Roaming\System_manager.exe" C:\Users\admin\AppData\Roaming\System_manager.exe
FortSlurper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\system_manager.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
588"C:\Windows\System32\cmd.exe" C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
676netsh firewall delete allowedprogram "C:\Users\admin\AppData\Roaming\System_manager.exe"C:\Windows\system32\netsh.exe—System_manager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
704"C:\Windows\regedit.exe" C:\Windows\regedit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1256"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2404cmd.exe /c ping 0 -n 2 & del "C:\Users\admin\AppData\Roaming\System_manager.exe"C:\Windows\system32\cmd.exe—System_manager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2580"C:\Windows\regedit.exe" C:\Windows\regedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
2668ping 0 -n 2 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2820netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\System_manager.exe" "System_manager.exe" ENABLEC:\Windows\system32\netsh.exe—System_manager.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2964"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
2 538
Read events
1 949
Write events
586
Delete events
3

Modification events

(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2964) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\1.zip
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2964) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3816) FortSlurper.exeKey:HKEY_CURRENT_USER
Operation:writeName:di
Value:
!
(PID) Process:(3816) FortSlurper.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
8
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
324System_manager.exeC:\Users\admin\AppData\Local\Temp\tmp8101.tmp.exeexecutable
MD5:—
SHA256:—
3068System_manager.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\19e0e82edf35be9fb14741ee8dfb00a8.exeexecutable
MD5:—
SHA256:—
324System_manager.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6069c10fb03a92473633134bb7e91c38.exeexecutable
MD5:—
SHA256:—
2964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2964.19657\Fortnite Slurper Checker\FortSlurper.exeexecutable
MD5:—
SHA256:—
3816FortSlurper.exeC:\Users\admin\AppData\Roaming\System_manager.exeexecutable
MD5:—
SHA256:—
4036tmp8101.tmp.exeC:\Users\admin\AppData\Roaming\System_manager.exeexecutable
MD5:—
SHA256:—
2964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2964.19657\Fortnite Slurper Checker\xNet.dllexecutable
MD5:AC1DCEDDBC66A1AB7915AC9931F0CFEC
SHA256:CC949931EF9533ADCED83F3D58862E9732E5DB7AD17B5FD4CB9D209A99EDB592
2964WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2964.19657\Fortnite Slurper Checker\Bunifu_UI_v1.5.3.dllexecutable
MD5:2ECB51AB00C5F340380ECF849291DBCF
SHA256:F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
3
Threats
41

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
324
System_manager.exe
197.25.152.77:1177
forupload.ddns.net
Tunisia BackBone AS
TN
malicious
3068
System_manager.exe
197.25.152.77:1177
forupload.ddns.net
Tunisia BackBone AS
TN
malicious

DNS requests

Domain
IP
Reputation
forupload.ddns.net
  • 197.25.152.77
malicious
linkobenz.ddns.net
  • 197.25.152.77
malicious

Threats

PID
Process
Class
Message
324
System_manager.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
324
System_manager.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3068
System_manager.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3068
System_manager.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3068
System_manager.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN Bladabindi/njRAT CnC Command (ll)
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Capture)
3068
System_manager.exe
A Network Trojan was detected
ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop)
21 ETPRO signatures available at the full report
No debug info