Try VMRay Platform
Malicious
Classifications

Keylogger Spyware Backdoor

Threat Names

njRAT njRAT.07dDanger Mal/Generic-S Mal/HTMLGen-A

Dynamic Analysis Report

Created on 2023-02-14T20:55:52+00:00

792ad1aa7d042b3a51290003dd51befe14499c85103f02d75cb4a022e1713160.exe

Windows Exe (x86-32)
...

Remarks (2/2)

(0x02000008): One or more processes crashed during the analysis. Analysis results may be incomplete.

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Filters:
File Name Category Type Verdict Actions
C:\Users\kEecfMwgj\Desktop\792ad1aa7d042b3a51290003dd51befe14499c85103f02d75cb4a022e1713160.exe Sample File Binary
Malicious
...
»
Also Known As C:\Notepad.exe (Dropped File, Accessed File)
C:\Program Files (x86)\Explower.exe (Dropped File, Accessed File)
C:\Umbrella.flv.exe (Dropped File, Accessed File)
C:\Users\kEecfMwgj\AppData\Local\Temp\server.exe (Accessed File)
C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe (Dropped File, Accessed File)
C:\Users\kEecfMwgj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bf4b86d937e29b1b51011983fd5145bbWindows Update.exe (Dropped File, Accessed File)
C:\Windows\system32\Explower.exe (Dropped File, Accessed File)
Z:\Umbrella.flv.exe (Accessed File)
c:\users\keecfmwgj\appdata\local\temp\server.exe (VM File, Dropped File, Accessed File)
c:\users\keecfmwgj\appdata\roaming\microsoft\windows\start menu\programs\startup\bf4b86d937e29b1b51011983fd5145bbwindows update.exe (VM File, Dropped File, Accessed File)
MIME Type application/vnd.microsoft.portable-executable
File Size 93.00 KB
MD5 267f11aeaa62420506bf00912608fd80 Copy to Clipboard
SHA1 a2c07492f065dce7f90665284ded763f6ab838e9 Copy to Clipboard
SHA256 792ad1aa7d042b3a51290003dd51befe14499c85103f02d75cb4a022e1713160 Copy to Clipboard
SSDeep 1536:S5Kw0i6FHfpmcYM1t/2jEwzGi1dDDDPgS:S5oFHfpzYMj//i1dTo Copy to Clipboard
ImpHash f34d5f2d4577ed6d9ceec516c1f5a744 Copy to Clipboard
File Reputation Information
»
Verdict
Malicious
Names Mal/Generic-S
PE Information
»
Image Base 0x00400000
Entry Point 0x00418ECE
Size Of Code 0x00017000
Size Of Initialized Data 0x00000200
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_I386
Compile Timestamp 2023-02-10 14:31 (UTC+1)
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x00402000 0x00016ED4 0x00017000 0x00000200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.6
.reloc 0x0041A000 0x0000000C 0x00000200 0x00017200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 0.1
Imports (1)
»
mscoree.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_CorExeMain - 0x00402000 0x00018EA4 0x000170A4 0x00000000
Memory Dumps (20)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
792ad1aa7d042b3a51290003dd51befe14499c85103f02d75cb4a022e1713160.exe 1 0x01370000 0x0138BFFF Relevant Image False 32-bit - False
...
792ad1aa7d042b3a51290003dd51befe14499c85103f02d75cb4a022e1713160.exe 1 0x01370000 0x0138BFFF Process Termination False 32-bit - False
...
server.exe 2 0x00D60000 0x00D7BFFF Relevant Image False 32-bit - False
...
server.exe 2 0x00D60000 0x00D7BFFF Final Dump False 32-bit - False
...
system.exe 7 0x00080000 0x0009BFFF Relevant Image False 32-bit - False
...
bf4b86d937e29b1b51011983fd5145bbwindows update.exe 6 0x00EB0000 0x00ECBFFF Relevant Image False 32-bit - False
...
buffer 6 0x00470000 0x00479FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
system.exe 7 0x00080000 0x0009BFFF Process Termination False 32-bit - False
...
server.exe 9 0x01260000 0x0127BFFF Relevant Image False 32-bit - False
...
bf4b86d937e29b1b51011983fd5145bbwindows update.exe 6 0x00EB0000 0x00ECBFFF Process Termination False 32-bit - False
...
buffer 9 0x0528B000 0x0528FFFF First Network Behavior False 32-bit - False
...
buffer 9 0x055AD000 0x055AFFFF First Network Behavior False 32-bit - False
...
buffer 9 0x0520D000 0x0520FFFF First Network Behavior False 32-bit - False
...
buffer 9 0x050AE000 0x050AFFFF First Network Behavior False 32-bit - False
...
buffer 9 0x04BDD000 0x04BDFFFF First Network Behavior False 32-bit - False
...
buffer 9 0x0491B000 0x0491FFFF First Network Behavior False 32-bit - False
...
buffer 9 0x047BE000 0x047BFFFF First Network Behavior False 32-bit - False
...
buffer 9 0x00349000 0x0034FFFF First Network Behavior False 32-bit - False
...
server.exe 9 0x01260000 0x0127BFFF First Network Behavior False 32-bit - False
...
server.exe 9 0x01260000 0x0127BFFF Final Dump False 32-bit - False
...
YARA Matches (1)
»
Rule Name Rule Description Classification Score Actions
njRAT njRAT Backdoor
5/5
...
C:\autorun.inf Dropped File Setup Script
Malicious
...
»
MIME Type application/x-setupscript
File Size 55 Bytes
MD5 40b1630be21f39cb17bd1963cae5a207 Copy to Clipboard
SHA1 63c14bd151d42820dd45c033363fa5b9e1d34124 Copy to Clipboard
SHA256 f87e55f1a423b65fd639146f71f6027dbd4d6e69b65d9a17f1744774aa6589e1 Copy to Clipboard
SSDeep 3:It1KV2PHQCyK0x:e1KAwCyD Copy to Clipboard
ImpHash -
File Reputation Information
»
Verdict
Malicious
Names Mal/Generic-S
C:\Users\kEecfMwgj\AppData\Local\Temp\FransescoPast.txt Dropped File Text
Clean
...
»
MIME Type text/plain
File Size 32 Bytes
MD5 c02b79764a0c7b6340586e225631ca4f Copy to Clipboard
SHA1 46d73f2a3798de05160258fdccc3075c88a94039 Copy to Clipboard
SHA256 cbee1cd5673418c7c190256736061f58880db3d4b27be22f3e3b1118d5f87bcb Copy to Clipboard
SSDeep 3:YyFuBk5/ml2T:Y8uBWY2T Copy to Clipboard
ImpHash -
C:\Users\kEecfMwgj\AppData\Roaming\app Dropped File Text
Clean
Known to be clean.
...
»
MIME Type text/plain
File Size 5 Bytes
MD5 8f11404a507cfb98455f89a534077f73 Copy to Clipboard
SHA1 0716c668f504450353527aff1a6457b8348cf435 Copy to Clipboard
SHA256 f7c301f3fcce1c2444b540090e5024f0cea1806ab8ae1d81901ecc3b63334cbb Copy to Clipboard
SSDeep 3:3n:3 Copy to Clipboard
ImpHash -
File Reputation Information
»
Verdict
Clean
Known to be clean.
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    

     Exit-Icon
    

    

     

      WHOIS Domain Information
     

     

      

       
        Domain Name
       
       
       
      

      

       
        WHOIS Response
       
       
        

       		
      

     

    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image