analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

uc

Full analysis: https://app.any.run/tasks/34700288-f91b-4263-bf6d-2dbc9dfd33be
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: April 25, 2019, 16:45:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
njrat
bladabindi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

A8B299F6B66A6AA709E2436102C983C2

SHA1:

AA8B31F94A5BE2D7B2D16CA824536F47B0D1F8A6

SHA256:

FF29E59CD73A117799D34D84C74A6E2942C0C054E1533E30627E28143B7AC6B4

SSDEEP:

12288:e1TSwYQQpFA21H+e8/yM2okVGHORYdq9CYF2M2odjQ98pUbA0SvphWtrJnL:eBSoQXJWNkEHS9CYF2hyF02hqrVL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exe (PID: 2752)

    • Uses Task Scheduler to run other applications

      • RegAsm.exe (PID: 3528)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3612)
      • schtasks.exe (PID: 2760)

    • NJRAT was detected

      • RegAsm.exe (PID: 3528)

    • Writes to a start menu file

      • HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exe (PID: 2752)

    • Connects to CnC server

      • RegAsm.exe (PID: 3528)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2832)
      • HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exe (PID: 2752)

    • Creates files in the user directory

      • HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exe (PID: 2752)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe hytwuocapturemep100902019000011 hytwuocapturemep10090201900022.exe #NJRAT regasm.exe schtasks.exe no specs schtasks.exe no specs regasm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2832"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\uc.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2752"C:\Users\admin\AppData\Local\Temp\Rar$EXa2832.28819\HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2832.28819\HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exe
WinRAR.exe
User:
admin
Company:
Netplwiz
Integrity Level:
MEDIUM
Description:
RdpSaUacHelper
Exit code:
0
Version:
720.941.63.129
3528"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
2760schtasks /Delete /tn NYAN /FC:\Windows\system32\schtasks.exe—RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3612schtasks /create /tn NYAN /tr "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /sc minute /mo 1C:\Windows\system32\schtasks.exe—RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2556C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Total events
480
Read events
463
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2752HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\archiveint.urltext
MD5:836F41F0B0150E5BA1A01EB0E19D592C
SHA256:94B29BBB807EC9FC8BC89106E67AD1EEE0AD92D5B1FA18CCC2934E324F54FF9E
2752HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exeC:\Users\admin\difx64\archiveint.vbstext
MD5:5893C0968460C2B5E6611B2F6D8C22CA
SHA256:DABDF906E23A107D09413473092D94DC5ADDD1939A074D4A0CAA6F902D5929BB
2752HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exeC:\Users\admin\difx64\cdd.exeexecutable
MD5:CE50D7105BAA03768A5378720F8CE5F1
SHA256:DE9D63F3BC2712DE84CDB897554B9F8D6ABB2852E107535475C1621D89035761
2832WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2832.28819\HYTWUOCaptureMEP100902019000011 HYTWUOCaptureMEP10090201900022.exeexecutable
MD5:72F4EE16F5D2BFBEB913727C9A47F534
SHA256:63C7A6AC6AEA89ADCB71BA671F74768046E1C1985FBDC6A20EAAEB68A5CD5076
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3528
RegAsm.exe
181.59.9.81:1992
mayolomejor.duckdns.org
Telmex Colombia S.A.
CO
malicious

DNS requests

Domain
IP
Reputation
mayolomejor.duckdns.org
  • 181.59.9.81
malicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3528
RegAsm.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT.Gen RAT outbound connection
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
uc