Windows Analysis Report
myidJB8lDL.exe

Machine Learning detection for dropped file

Source: Yara match	File source: myidJB8lDL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: myidJB8lDL.exe PID: 6820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Joe Sandbox ML: detected
Source: C:\Umbrella.flv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\server.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: myidJB8lDL.exe

Joe Sandbox ML: detected

Source: myidJB8lDL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\myidJB8lDL.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Contains functionality to spread to USB devices (.Net source)

Source: myidJB8lDL.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Source: myidJB8lDL.exe, -.cs	.Net Code: @
Source: server.exe.0.dr, -.cs	.Net Code: @
Source: Microsoft Corporation.exe.1.dr, -.cs	.Net Code: @
Source: c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe.1.dr, -.cs	.Net Code: @
Source: Umbrella.flv.exe.1.dr, -.cs	.Net Code: @

Creates autorun.inf (USB autostart)

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\autorun.inf

Snort IDS alert for network traffic

Source: myidJB8lDL.exe, 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: myidJB8lDL.exe, 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: myidJB8lDL.exe, 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: myidJB8lDL.exe, 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: myidJB8lDL.exe, 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: myidJB8lDL.exe, 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: myidJB8lDL.exe	Binary or memory string: \autorun.inf
Source: myidJB8lDL.exe	Binary or memory string: [autorun]
Source: myidJB8lDL.exe	Binary or memory string: autorun.inf
Source: autorun.inf.1.dr	Binary or memory string: [autorun]
Source: Microsoft Corporation.exe.1.dr	Binary or memory string: \autorun.inf
Source: Microsoft Corporation.exe.1.dr	Binary or memory string: [autorun]
Source: Microsoft Corporation.exe.1.dr	Binary or memory string: autorun.inf
Source: Umbrella.flv.exe.1.dr	Binary or memory string: \autorun.inf
Source: Umbrella.flv.exe.1.dr	Binary or memory string: [autorun]
Source: Umbrella.flv.exe.1.dr	Binary or memory string: autorun.inf
Source: c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe.1.dr	Binary or memory string: \autorun.inf
Source: c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe.1.dr	Binary or memory string: [autorun]
Source: c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe.1.dr	Binary or memory string: autorun.inf
Source: server.exe.0.dr	Binary or memory string: \autorun.inf
Source: server.exe.0.dr	Binary or memory string: [autorun]
Source: server.exe.0.dr	Binary or memory string: autorun.inf

Networking

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49729 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49729 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49729 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49729 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49736 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49736 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49738 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49738 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49738 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49738 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49739 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49739 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49739 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49739 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49740 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49740 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49741 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49741 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49742 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49742 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49743 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49743 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49743 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49743 -> 3.69.157.220:12419
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49744 -> 3.69.115.178:12419
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49744 -> 3.69.115.178:12419

Source: global traffic	TCP traffic: 192.168.2.4:49729 -> 3.69.115.178:12419
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 3.69.157.220:12419

Source: Joe Sandbox View	IP Address: 3.69.115.178 3.69.115.178
Source: Joe Sandbox View	IP Address: 3.69.157.220 3.69.157.220

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 6.tcp.eu.ngrok.io

Source: C:\Users\user\Desktop\myidJB8lDL.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: myidJB8lDL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: myidJB8lDL.exe PID: 6820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED

System Summary

Source: myidJB8lDL.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: myidJB8lDL.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: myidJB8lDL.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: myidJB8lDL.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\myidJB8lDL.exe	Code function: 0_2_055A4298		0_2_055A4298
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Code function: 0_2_055A427D		0_2_055A427D

Source: myidJB8lDL.exe, 00000000.00000002.1652385743.00000000013FE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs myidJB8lDL.exe

Source: myidJB8lDL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: myidJB8lDL.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: myidJB8lDL.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: myidJB8lDL.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: myidJB8lDL.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.phis.troj.adwa.evad.winEXE@7/9@4/2

Source: C:\Users\user\Desktop\myidJB8lDL.exe

File created: C:\Users\user\AppData\Roaming\app

Source: C:\Users\user\AppData\Local\Temp\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\c57556e5735bc2d214eb9a21cf22ff31
Source: C:\Users\user\AppData\Local\Temp\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_03

Source: C:\Users\user\Desktop\myidJB8lDL.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Source: myidJB8lDL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: myidJB8lDL.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\myidJB8lDL.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\myidJB8lDL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: myidJB8lDL.exe

Virustotal: Detection: 81%

Source: C:\Users\user\Desktop\myidJB8lDL.exe

File read: C:\Users\user\Desktop\myidJB8lDL.exe

Source: unknown	Process created: C:\Users\user\Desktop\myidJB8lDL.exe C:\Users\user\Desktop\myidJB8lDL.exe
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process created: C:\Users\user\AppData\Local\Temp\server.exe "C:\Users\user\AppData\Local\Temp\server.exe"
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process created: C:\Users\user\AppData\Local\Temp\server.exe "C:\Users\user\AppData\Local\Temp\server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: C:\Users\user\Desktop\myidJB8lDL.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: myidJB8lDL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\myidJB8lDL.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

.NET source code contains potential unpacker

Source: myidJB8lDL.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: myidJB8lDL.exe, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])
Source: server.exe.0.dr, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])
Source: Microsoft Corporation.exe.1.dr, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])
Source: c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe.1.dr, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])
Source: Umbrella.flv.exe.1.dr, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file
Source: C:\Users\user\Desktop\myidJB8lDL.exe	File created: C:\Users\user\AppData\Local\Temp\server.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Umbrella.flv.exe	Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\server.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe			Jump to behavior

Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\myidJB8lDL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\myidJB8lDL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: threadDelayed 1229	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: threadDelayed 3049	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: foregroundWindowGot 434	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Window / User API: foregroundWindowGot 451	Jump to behavior

Source: C:\Users\user\Desktop\myidJB8lDL.exe TID: 6880	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe TID: 7088	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe TID: 7152	Thread sleep time: -614500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe TID: 7152	Thread sleep time: -1524500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe TID: 6412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\myidJB8lDL.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: netsh.exe, 00000002.00000003.1671654790.00000000006C2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllS

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\myidJB8lDL.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\myidJB8lDL.exe

Process created: C:\Users\user\AppData\Local\Temp\server.exe "C:\Users\user\AppData\Local\Temp\server.exe"

Source: myidJB8lDL.exe, Microsoft Corporation.exe.1.dr, Umbrella.flv.exe.1.dr, c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe.1.dr, server.exe.0.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: Microsoft Corporation.exe, 00000005.00000002.1913543026.0000000004F0B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dProgram Manager
Source: myidJB8lDL.exe, 00000000.00000002.1652745855.0000000003371000.00000004.00000800.00020000.00000000.sdmp, myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033A3000.00000004.00000800.00020000.00000000.sdmp, myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: myidJB8lDL.exe, Microsoft Corporation.exe.1.dr, Umbrella.flv.exe.1.dr, c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe.1.dr, server.exe.0.dr	Binary or memory string: Shell_TrayWnd
Source: myidJB8lDL.exe, Microsoft Corporation.exe.1.dr, Umbrella.flv.exe.1.dr, c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe.1.dr, server.exe.0.dr	Binary or memory string: ProgMan
Source: myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033A3000.00000004.00000800.00020000.00000000.sdmp, myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\O
Source: myidJB8lDL.exe, 00000000.00000002.1653006002.000000000574B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dProgram Managerp
Source: myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033A3000.00000004.00000800.00020000.00000000.sdmp, myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/16 \| 14:31:52 - Program Manager
Source: myidJB8lDL.exe, 00000000.00000002.1652745855.0000000003371000.00000004.00000800.00020000.00000000.sdmp, myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033A3000.00000004.00000800.00020000.00000000.sdmp, myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ledProgram Manager
Source: myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033A3000.00000004.00000800.00020000.00000000.sdmp, myidJB8lDL.exe, 00000000.00000002.1652745855.00000000033AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/16 \| 14:31:51 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality to disable the Task Manager (.Net Source)

Lowering of HIPS / PFW / Operating System Security Settings

Source: myidJB8lDL.exe, -.cs	.Net Code: @
Source: server.exe.0.dr, -.cs	.Net Code: @
Source: Microsoft Corporation.exe.1.dr, -.cs	.Net Code: @
Source: c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe.1.dr, -.cs	.Net Code: @
Source: Umbrella.flv.exe.1.dr, -.cs	.Net Code: @

Disables zone checking for all users

Source: C:\Users\user\AppData\Local\Temp\server.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Local\Temp\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE

Stealing of Sensitive Information

Source: Yara match	File source: myidJB8lDL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: myidJB8lDL.exe PID: 6820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED

Remote Access Functionality

Source: Yara match	File source: myidJB8lDL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.myidJB8lDL.exe.dc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: myidJB8lDL.exe PID: 6820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\server.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
21 Replication Through Removable Media	Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	21 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Registry Run Keys / Startup Folder	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
myidJB8lDL.exe	82%	Virustotal		Browse
myidJB8lDL.exe	100%	Avira	TR/Dropper.Gen
myidJB8lDL.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Avira	TR/Dropper.Gen
C:\Umbrella.flv.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\server.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Joe Sandbox ML
C:\Umbrella.flv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\server.exe	100%	Joe Sandbox ML
C:\Umbrella.flv.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\server.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe	82%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
6.tcp.eu.ngrok.io	11%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
6.tcp.eu.ngrok.io	3.69.115.178	true	true	11%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
3.69.115.178	6.tcp.eu.ngrok.io	United States		16509	AMAZON-02US	true
3.69.157.220	unknown	United States		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1363401
Start date and time:	2023-12-16 14:31:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	myidJB8lDL.exe renamed because original name is a hash value
Original Sample Name:	b83412ee8e4b5e4b96d43ff7832cac8f.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.adwa.evad.winEXE@7/9@4/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 69 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:31:58	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe
13:32:08	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
14:32:32	API Interceptor	163260x Sleep call for process: server.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
3.69.115.178	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	30b4CoDmKk.exe	Get hash	malicious	Njrat	Browse
	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse
	xZLQ8X9Cxo.exe	Get hash	malicious	Njrat	Browse
	sCXwkZrcZ3.exe	Get hash	malicious	Njrat	Browse
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse
	8AKGdJOQ8N.exe	Get hash	malicious	Njrat	Browse
	uPMGLG7QnV.exe	Get hash	malicious	Njrat	Browse
	X3vWrCoPG6.exe	Get hash	malicious	Njrat	Browse
	7U23YeVgmF.exe	Get hash	malicious	Njrat	Browse
	KD9rMPUEBM.exe	Get hash	malicious	Njrat	Browse
	8fZNpRy9pN.exe	Get hash	malicious	Njrat	Browse
	2CVeP16GYU.exe	Get hash	malicious	Njrat	Browse
	64EithtAyN.exe	Get hash	malicious	Njrat	Browse
	QuX5A6qz9G.exe	Get hash	malicious	Njrat	Browse
	TdxWv8SpDq.exe	Get hash	malicious	Njrat	Browse
	OperaSetup.exe	Get hash	malicious	Quasar	Browse
	887F546123CD59024356557175BD77FE1144BA5C56D93.exe	Get hash	malicious	Njrat	Browse
	HR0Hh3FsOH.exe	Get hash	malicious	njRat	Browse
3.69.157.220	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse
	xZLQ8X9Cxo.exe	Get hash	malicious	Njrat	Browse
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
	bRxR.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse
	BqFosj9Wcb.exe	Get hash	malicious	Njrat	Browse
	8AKGdJOQ8N.exe	Get hash	malicious	Njrat	Browse
	uPMGLG7QnV.exe	Get hash	malicious	Njrat	Browse
	X3vWrCoPG6.exe	Get hash	malicious	Njrat	Browse
	KD9rMPUEBM.exe	Get hash	malicious	Njrat	Browse
	2CVeP16GYU.exe	Get hash	malicious	Njrat	Browse
	64EithtAyN.exe	Get hash	malicious	Njrat	Browse
	TdxWv8SpDq.exe	Get hash	malicious	Njrat	Browse
	887F546123CD59024356557175BD77FE1144BA5C56D93.exe	Get hash	malicious	Njrat	Browse
	Android_USB_Jailbreaker.exe	Get hash	malicious	Njrat	Browse
	NNUqIKtjza.exe	Get hash	malicious	Unknown	Browse
	lOOwpUqlJq.exe	Get hash	malicious	njRat	Browse
	gAtrO34ote.exe	Get hash	malicious	njRat	Browse
	1VprX52hNY.exe	Get hash	malicious	njRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6.tcp.eu.ngrok.io	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	30b4CoDmKk.exe	Get hash	malicious	Njrat	Browse	18.197.239.109
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	m5l9v13hIi.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	xZLQ8X9Cxo.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	sCXwkZrcZ3.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	bRxR.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	18.197.239.109
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse	52.28.247.255
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	BqFosj9Wcb.exe	Get hash	malicious	Njrat	Browse	52.28.247.255
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse	52.28.247.255
	8AKGdJOQ8N.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	uPMGLG7QnV.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	X3vWrCoPG6.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	7U23YeVgmF.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	KD9rMPUEBM.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	8fZNpRy9pN.exe	Get hash	malicious	Njrat	Browse	52.28.247.255

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	arm4-20231216-1307.elf	Get hash	malicious	Mirai	Browse	157.175.21.160
	arm5-20231216-1307.elf	Get hash	malicious	Mirai	Browse	65.2.197.43
	SecuriteInfo.com.FileRepMetagen.14347.4124.exe	Get hash	malicious	Unknown	Browse	52.216.56.248
	x86_64-20231216-1226.elf	Get hash	malicious	Mirai	Browse	13.250.98.133
	SecuriteInfo.com.FileRepMetagen.14347.4124.exe	Get hash	malicious	Unknown	Browse	52.217.227.136
	mips-20231216-1225.elf	Get hash	malicious	Mirai	Browse	157.175.43.253
	arm7-20231216-1225.elf	Get hash	malicious	Mirai	Browse	35.79.232.156
	viXBSh9JRd.exe	Get hash	malicious	Njrat	Browse	35.158.159.254
	arm4-20231216-1200.elf	Get hash	malicious	Mirai	Browse	52.16.84.76
	gs0e9zuvJl.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	34.212.247.228
	w2WeaYML3S.exe	Get hash	malicious	SmokeLoader	Browse	44.239.89.105
	Loan+Easy.apk	Get hash	malicious	Unknown	Browse	13.249.98.120
	K9nM2bWboK.exe	Get hash	malicious	SmokeLoader	Browse	108.156.83.53
	Or0dzqpsOa.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	18.230.90.119
	mQ1UfmBFtz.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	108.156.83.53
	ZOe53Zwi1a.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	108.156.83.96
	4ifWSHuWZo.exe	Get hash	malicious	SmokeLoader	Browse	108.156.83.119
	vZ3cyoSmwf.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	18.230.90.119
	WIbO7w8btd.exe	Get hash	malicious	SmokeLoader	Browse	108.156.83.53
	FTq09uH032.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	108.156.83.53
AMAZON-02US	arm4-20231216-1307.elf	Get hash	malicious	Mirai	Browse	157.175.21.160
	arm5-20231216-1307.elf	Get hash	malicious	Mirai	Browse	65.2.197.43
	SecuriteInfo.com.FileRepMetagen.14347.4124.exe	Get hash	malicious	Unknown	Browse	52.216.56.248
	x86_64-20231216-1226.elf	Get hash	malicious	Mirai	Browse	13.250.98.133
	SecuriteInfo.com.FileRepMetagen.14347.4124.exe	Get hash	malicious	Unknown	Browse	52.217.227.136
	mips-20231216-1225.elf	Get hash	malicious	Mirai	Browse	157.175.43.253
	arm7-20231216-1225.elf	Get hash	malicious	Mirai	Browse	35.79.232.156
	viXBSh9JRd.exe	Get hash	malicious	Njrat	Browse	35.158.159.254
	arm4-20231216-1200.elf	Get hash	malicious	Mirai	Browse	52.16.84.76
	gs0e9zuvJl.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	34.212.247.228
	w2WeaYML3S.exe	Get hash	malicious	SmokeLoader	Browse	44.239.89.105
	Loan+Easy.apk	Get hash	malicious	Unknown	Browse	13.249.98.120
	K9nM2bWboK.exe	Get hash	malicious	SmokeLoader	Browse	108.156.83.53
	Or0dzqpsOa.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	18.230.90.119
	mQ1UfmBFtz.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	108.156.83.53
	ZOe53Zwi1a.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	108.156.83.96
	4ifWSHuWZo.exe	Get hash	malicious	SmokeLoader	Browse	108.156.83.119
	vZ3cyoSmwf.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	18.230.90.119
	WIbO7w8btd.exe	Get hash	malicious	SmokeLoader	Browse	108.156.83.53
	FTq09uH032.exe	Get hash	malicious	RisePro Stealer, SmokeLoader, Vidar	Browse	108.156.83.53

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	5.549094511461939
Encrypted:	false
SSDEEP:	1536:Sd4XkWOqipj69Qos0n2NDkNskqVR1mpwv:O43qj69QMGqxqVRQw
MD5:	B83412EE8E4B5E4B96D43FF7832CAC8F
SHA1:	40DB2BCF274F0968CC8F9C153FB88B13821AF357
SHA-256:	446CF6AC1DE71C4307EC105D6FA09D48B7FD65F788C1BE8FCEA56BA097A6D818
SHA-512:	8E189FF517E5613FB7D211E5B7589572B1C42B7C8B65E11935BA67AA89C7E1FAC7DBFD09EF242801451B49B859377CE706DE96143F1EAC6361E84FC157FE643C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Umbrella.flv.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Umbrella.flv.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Umbrella.flv.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Umbrella.flv.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ixe.................h..........N.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...Tf... ...h.................. ..`.reloc...............j..............@..B........................................................0.......H.......................................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Microsoft Corporation.exe.log

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\myidJB8lDL.exe.log

Process:	C:\Users\user\Desktop\myidJB8lDL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Temp\server.exe

Process:	C:\Users\user\Desktop\myidJB8lDL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	5.549094511461939
Encrypted:	false
SSDEEP:	1536:Sd4XkWOqipj69Qos0n2NDkNskqVR1mpwv:O43qj69QMGqxqVRQw
MD5:	B83412EE8E4B5E4B96D43FF7832CAC8F
SHA1:	40DB2BCF274F0968CC8F9C153FB88B13821AF357
SHA-256:	446CF6AC1DE71C4307EC105D6FA09D48B7FD65F788C1BE8FCEA56BA097A6D818
SHA-512:	8E189FF517E5613FB7D211E5B7589572B1C42B7C8B65E11935BA67AA89C7E1FAC7DBFD09EF242801451B49B859377CE706DE96143F1EAC6361E84FC157FE643C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ixe.................h..........N.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...Tf... ...h.................. ..`.reloc...............j..............@..B........................................................0.......H.......................................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	5.549094511461939
Encrypted:	false
SSDEEP:	1536:Sd4XkWOqipj69Qos0n2NDkNskqVR1mpwv:O43qj69QMGqxqVRQw
MD5:	B83412EE8E4B5E4B96D43FF7832CAC8F
SHA1:	40DB2BCF274F0968CC8F9C153FB88B13821AF357
SHA-256:	446CF6AC1DE71C4307EC105D6FA09D48B7FD65F788C1BE8FCEA56BA097A6D818
SHA-512:	8E189FF517E5613FB7D211E5B7589572B1C42B7C8B65E11935BA67AA89C7E1FAC7DBFD09EF242801451B49B859377CE706DE96143F1EAC6361E84FC157FE643C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ixe.................h..........N.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...Tf... ...h.................. ..`.reloc...............j..............@..B........................................................0.......H.......................................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	5.549094511461939
Encrypted:	false
SSDEEP:	1536:Sd4XkWOqipj69Qos0n2NDkNskqVR1mpwv:O43qj69QMGqxqVRQw
MD5:	B83412EE8E4B5E4B96D43FF7832CAC8F
SHA1:	40DB2BCF274F0968CC8F9C153FB88B13821AF357
SHA-256:	446CF6AC1DE71C4307EC105D6FA09D48B7FD65F788C1BE8FCEA56BA097A6D818
SHA-512:	8E189FF517E5613FB7D211E5B7589572B1C42B7C8B65E11935BA67AA89C7E1FAC7DBFD09EF242801451B49B859377CE706DE96143F1EAC6361E84FC157FE643C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c57556e5735bc2d214eb9a21cf22ff31Windows Update.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ixe.................h..........N.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...Tf... ...h.................. ..`.reloc...............j..............@..B........................................................0.......H.......................................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\app

Process:	C:\Users\user\Desktop\myidJB8lDL.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:1n:1
MD5:	02B81B0CBE1FAAA1FA62D5FC876AB443
SHA1:	D473CFE21FB1F188689415B0BDD239688F8FDDD9
SHA-256:	E7E9E2C247BC872BACCE77661C78F001A17D70EE3130A9016A5818DA9DA00CDB
SHA-512:	592AB5B200D4C560951CB70288DC1B7A562F0CBFAEE01CE03076B6934D537B88575C2E1E0FEDCC05DB95E6C224CA739923E7D74F9165E683F3FBAD7BBF641784
Malicious:	false
Reputation:	low
Preview:	.16

C:\autorun.inf

Process:	C:\Users\user\AppData\Local\Temp\server.exe
File Type:	Microsoft Windows Autorun file
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.474554204780528
Encrypted:	false
SSDEEP:	3:It1KV2PHQCyK0x:e1KAwCyD
MD5:	40B1630BE21F39CB17BD1963CAE5A207
SHA1:	63C14BD151D42820DD45C033363FA5B9E1D34124
SHA-256:	F87E55F1A423B65FD639146F71F6027DBD4D6E69B65D9A17F1744774AA6589E1
SHA-512:	833112ED4A9A3C621D2FFFC78F83502B2937B82A2CF9BC692D75D907CE2AA46C2D97CFE23C402DB3292B2DD2655FF8692C3CD00D5BA4D792C3D8AF24958E1926
Malicious:	true
Preview:	[autorun]..open=C:\Umbrella.flv.exe..shellexecute=C:\..

\Device\ConDrv

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.549094511461939
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	myidJB8lDL.exe
File size:	93'184 bytes
MD5:	b83412ee8e4b5e4b96d43ff7832cac8f
SHA1:	40db2bcf274f0968cc8f9c153fb88b13821af357
SHA256:	446cf6ac1de71c4307ec105d6fa09d48b7fd65f788c1be8fcea56ba097a6d818
SHA512:	8e189ff517e5613fb7d211e5b7589572b1c42b7c8b65e11935ba67aa89c7e1fac7dbfd09ef242801451b49b859377ce706de96143f1eac6361e84fc157fe643c
SSDEEP:	1536:Sd4XkWOqipj69Qos0n2NDkNskqVR1mpwv:O43qj69QMGqxqVRQw
TLSH:	2F93D74933E15069E2FE8AF3A971B2404FB9F0471742934D49E179BA1A33AD84F44DBB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ixe.................h..........N.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41864e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x657869AD [Tue Dec 12 14:09:49 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x185fc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16654	0x16800	False	0.36357421875	data	5.581764800393336	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.43.69.115.17849736124192814856 12/16/23-14:32:34.069646	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49736	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849738124192814856 12/16/23-14:33:07.134713	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49738	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849744124192814856 12/16/23-14:35:56.314002	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49744	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.157.22049742124192033132 12/16/23-14:34:40.325313	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49742	12419	192.168.2.4	3.69.157.220
192.168.2.43.69.157.22049743124192033132 12/16/23-14:35:11.327522	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49743	12419	192.168.2.4	3.69.157.220
192.168.2.43.69.157.22049743124192814860 12/16/23-14:35:13.739948	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49743	12419	192.168.2.4	3.69.157.220
192.168.2.43.69.115.17849744124192033132 12/16/23-14:35:56.072047	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49744	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849736124192033132 12/16/23-14:32:33.827942	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49736	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849729124192814856 12/16/23-14:32:00.247681	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49729	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849738124192825564 12/16/23-14:33:11.248802	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49738	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849739124192814856 12/16/23-14:33:41.766455	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49739	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.157.22049740124192814856 12/16/23-14:34:16.768267	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49740	12419	192.168.2.4	3.69.157.220
192.168.2.43.69.115.17849729124192825564 12/16/23-14:32:04.581044	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49729	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849739124192825564 12/16/23-14:33:42.660469	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49739	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.157.22049743124192814856 12/16/23-14:35:11.568835	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49743	12419	192.168.2.4	3.69.157.220
192.168.2.43.69.115.17849729124192033132 12/16/23-14:32:00.007016	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49729	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849738124192033132 12/16/23-14:33:06.894258	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49738	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849739124192033132 12/16/23-14:33:41.525416	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49739	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.115.17849738124192814860 12/16/23-14:33:11.248802	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49738	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.157.22049742124192814856 12/16/23-14:34:40.567429	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49742	12419	192.168.2.4	3.69.157.220
192.168.2.43.69.157.22049741124192814856 12/16/23-14:34:36.971005	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49741	12419	192.168.2.4	3.69.157.220
192.168.2.43.69.115.17849729124192814860 12/16/23-14:32:04.581044	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49729	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.157.22049741124192033132 12/16/23-14:34:36.729114	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49741	12419	192.168.2.4	3.69.157.220
192.168.2.43.69.115.17849739124192814860 12/16/23-14:33:42.660469	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49739	12419	192.168.2.4	3.69.115.178
192.168.2.43.69.157.22049740124192033132 12/16/23-14:34:16.527045	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49740	12419	192.168.2.4	3.69.157.220
192.168.2.43.69.157.22049743124192825564 12/16/23-14:35:13.739948	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49743	12419	192.168.2.4	3.69.157.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2023 14:31:59.035231113 CET	49729	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:31:59.275862932 CET	12419	49729	3.69.115.178	192.168.2.4
Dec 16, 2023 14:31:59.275995016 CET	49729	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:00.007015944 CET	49729	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:00.247627020 CET	12419	49729	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:00.247680902 CET	49729	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:00.488594055 CET	12419	49729	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:04.581043959 CET	49729	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:04.822370052 CET	12419	49729	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:20.026465893 CET	12419	49729	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:20.026551008 CET	49729	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:31.558994055 CET	12419	49729	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:31.559171915 CET	49729	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:33.582874060 CET	49729	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:33.584408998 CET	49736	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:33.823575974 CET	12419	49729	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:33.826924086 CET	12419	49736	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:33.827033997 CET	49736	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:33.827941895 CET	49736	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:34.069569111 CET	12419	49736	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:34.069645882 CET	49736	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:32:34.311275005 CET	12419	49736	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:49.314373970 CET	12419	49736	3.69.115.178	192.168.2.4
Dec 16, 2023 14:32:49.314538956 CET	49736	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:04.417042971 CET	12419	49736	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:04.566236019 CET	49736	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:06.119353056 CET	12419	49736	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:06.119787931 CET	49736	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:06.487353086 CET	49736	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:06.652798891 CET	49738	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:06.893275023 CET	12419	49738	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:06.893388033 CET	49738	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:06.894258022 CET	49738	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:07.134310007 CET	12419	49738	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:07.134712934 CET	49738	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:07.375221968 CET	12419	49738	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:11.248801947 CET	49738	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:11.488835096 CET	12419	49738	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:26.591304064 CET	12419	49738	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:26.591372967 CET	49738	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:39.211601973 CET	12419	49738	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:39.211679935 CET	49738	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:41.269531012 CET	49738	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:41.283359051 CET	49739	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:41.509959936 CET	12419	49738	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:41.524477005 CET	12419	49739	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:41.524585962 CET	49739	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:41.525415897 CET	49739	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:41.766379118 CET	12419	49739	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:41.766454935 CET	49739	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:42.007452965 CET	12419	49739	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:42.660469055 CET	49739	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:33:42.901652098 CET	12419	49739	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:57.915380955 CET	12419	49739	3.69.115.178	192.168.2.4
Dec 16, 2023 14:33:57.915451050 CET	49739	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:34:13.158987045 CET	12419	49739	3.69.115.178	192.168.2.4
Dec 16, 2023 14:34:13.159055948 CET	49739	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:34:13.836472988 CET	12419	49739	3.69.115.178	192.168.2.4
Dec 16, 2023 14:34:13.836541891 CET	49739	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:34:15.882673979 CET	49739	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:34:16.123564959 CET	12419	49739	3.69.115.178	192.168.2.4
Dec 16, 2023 14:34:16.284879923 CET	49740	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:16.525989056 CET	12419	49740	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:16.526078939 CET	49740	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:16.527045012 CET	49740	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:16.768194914 CET	12419	49740	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:16.768266916 CET	49740	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:17.009557962 CET	12419	49740	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:32.010734081 CET	12419	49740	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:32.010790110 CET	49740	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:34.417634010 CET	12419	49740	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:34.566462994 CET	49740	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:36.429744005 CET	49740	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:36.486466885 CET	49741	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:36.728203058 CET	12419	49741	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:36.728286028 CET	49741	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:36.729114056 CET	49741	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:36.970912933 CET	12419	49741	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:36.971004963 CET	49741	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:37.212752104 CET	12419	49741	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:37.719657898 CET	12419	49741	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:37.719733000 CET	49741	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:39.747711897 CET	49741	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:39.989487886 CET	12419	49741	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:40.082439899 CET	49742	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:40.324565887 CET	12419	49742	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:40.324650049 CET	49742	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:40.325313091 CET	49742	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:40.567329884 CET	12419	49742	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:40.567429066 CET	49742	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:34:40.809442043 CET	12419	49742	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:55.811029911 CET	12419	49742	3.69.157.220	192.168.2.4
Dec 16, 2023 14:34:55.811111927 CET	49742	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:09.019859076 CET	12419	49742	3.69.157.220	192.168.2.4
Dec 16, 2023 14:35:09.020138025 CET	49742	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:11.059429884 CET	49742	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:11.085500002 CET	49743	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:11.301548004 CET	12419	49742	3.69.157.220	192.168.2.4
Dec 16, 2023 14:35:11.326488018 CET	12419	49743	3.69.157.220	192.168.2.4
Dec 16, 2023 14:35:11.326592922 CET	49743	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:11.327522039 CET	49743	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:11.568744898 CET	12419	49743	3.69.157.220	192.168.2.4
Dec 16, 2023 14:35:11.568835020 CET	49743	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:11.809950113 CET	12419	49743	3.69.157.220	192.168.2.4
Dec 16, 2023 14:35:13.739948034 CET	49743	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:13.980770111 CET	12419	49743	3.69.157.220	192.168.2.4
Dec 16, 2023 14:35:29.226701975 CET	12419	49743	3.69.157.220	192.168.2.4
Dec 16, 2023 14:35:29.226794004 CET	49743	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:43.617218971 CET	12419	49743	3.69.157.220	192.168.2.4
Dec 16, 2023 14:35:43.617324114 CET	49743	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:45.629297018 CET	49743	12419	192.168.2.4	3.69.157.220
Dec 16, 2023 14:35:45.870225906 CET	12419	49743	3.69.157.220	192.168.2.4
Dec 16, 2023 14:35:55.828751087 CET	49744	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:35:56.070957899 CET	12419	49744	3.69.115.178	192.168.2.4
Dec 16, 2023 14:35:56.071086884 CET	49744	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:35:56.072046995 CET	49744	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:35:56.313889980 CET	12419	49744	3.69.115.178	192.168.2.4
Dec 16, 2023 14:35:56.314002037 CET	49744	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:35:56.555645943 CET	12419	49744	3.69.115.178	192.168.2.4
Dec 16, 2023 14:36:04.427779913 CET	12419	49744	3.69.115.178	192.168.2.4
Dec 16, 2023 14:36:04.473119020 CET	49744	12419	192.168.2.4	3.69.115.178
Dec 16, 2023 14:36:16.980392933 CET	12419	49744	3.69.115.178	192.168.2.4
Dec 16, 2023 14:36:16.980572939 CET	49744	12419	192.168.2.4	3.69.115.178

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2023 14:31:58.778795958 CET	63632	53	192.168.2.4	1.1.1.1
Dec 16, 2023 14:31:59.012172937 CET	53	63632	1.1.1.1	192.168.2.4
Dec 16, 2023 14:33:06.488557100 CET	62579	53	192.168.2.4	1.1.1.1
Dec 16, 2023 14:33:06.631305933 CET	53	62579	1.1.1.1	192.168.2.4
Dec 16, 2023 14:34:15.883997917 CET	51330	53	192.168.2.4	1.1.1.1
Dec 16, 2023 14:34:16.010274887 CET	53	51330	1.1.1.1	192.168.2.4
Dec 16, 2023 14:35:49.703478098 CET	59019	53	192.168.2.4	1.1.1.1
Dec 16, 2023 14:35:49.844868898 CET	53	59019	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2023 14:31:58.778795958 CET	192.168.2.4	1.1.1.1	0xb3b	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 16, 2023 14:33:06.488557100 CET	192.168.2.4	1.1.1.1	0x9213	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 16, 2023 14:34:15.883997917 CET	192.168.2.4	1.1.1.1	0x7f52	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 16, 2023 14:35:49.703478098 CET	192.168.2.4	1.1.1.1	0x9304	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 16, 2023 14:31:59.012172937 CET	1.1.1.1	192.168.2.4	0xb3b	No error (0)	6.tcp.eu.ngrok.io	3.69.115.178	A (IP address)	IN (0x0001)	false
Dec 16, 2023 14:33:06.631305933 CET	1.1.1.1	192.168.2.4	0x9213	No error (0)	6.tcp.eu.ngrok.io	3.69.115.178	A (IP address)	IN (0x0001)	false
Dec 16, 2023 14:34:16.010274887 CET	1.1.1.1	192.168.2.4	0x7f52	No error (0)	6.tcp.eu.ngrok.io	3.69.157.220	A (IP address)	IN (0x0001)	false
Dec 16, 2023 14:35:49.844868898 CET	1.1.1.1	192.168.2.4	0x9304	No error (0)	6.tcp.eu.ngrok.io	3.69.115.178	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	14:31:51
Start date:	16/12/2023
Path:	C:\Users\user\Desktop\myidJB8lDL.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\myidJB8lDL.exe
Imagebase:	0xdc0000
File size:	93'184 bytes
MD5 hash:	B83412EE8E4B5E4B96D43FF7832CAC8F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1632581383.0000000000DC2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.1652805753.0000000004378000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	14:31:52
Start date:	16/12/2023
Path:	C:\Users\user\AppData\Local\Temp\server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\server.exe"
Imagebase:	0x980000
File size:	93'184 bytes
MD5 hash:	B83412EE8E4B5E4B96D43FF7832CAC8F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Local\Temp\server.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, Virustotal, Browse
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	14:31:54
Start date:	16/12/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\server.exe" "server.exe" ENABLE
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	14:31:54
Start date:	16/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	14:32:16
Start date:	16/12/2023
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Imagebase:	0x4e0000
File size:	93'184 bytes
MD5 hash:	B83412EE8E4B5E4B96D43FF7832CAC8F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, Virustotal, Browse
Reputation:	low
Has exited:	true