Windows Analysis Report
NjRat.exe

Machine Learning detection for sample

Source: Yara match	File source: NjRat.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NjRat.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.232319489.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NjRat.exe PID: 5420, type: MEMORYSTR

Source: NjRat.exe

Joe Sandbox ML: detected

Source: 0.0.NjRat.exe.b90000.0.unpack

Avira: Label: TR/Dropper.Gen7

Source: 0.0.NjRat.exe.b90000.0.unpack

Malware Configuration Extractor: Njrat {"Host": "javaoracle.hopto.org", "Port": "5552", "Mutex Name": "49829bdae88c", "Network Seprator": "@!#&^%$", "Campaign ID": "NYAN CAT", "Version": "0.7NC"}

Source: NjRat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\NjRat.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

C2 URLs / IPs found in malware configuration

Source: NjRat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Source: Malware configuration extractor

URLs: javaoracle.hopto.org

Source: unknown

DNS traffic detected: queries for: javaoracle.hopto.org

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: NjRat.exe, Keylogger.cs	.Net Code: VKCodeToUnicode
Source: 0.0.NjRat.exe.b90000.0.unpack, Keylogger.cs	.Net Code: VKCodeToUnicode

E-Banking Fraud

Source: Yara match	File source: NjRat.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NjRat.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.232319489.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NjRat.exe PID: 5420, type: MEMORYSTR

Source: NjRat.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: NjRat.exe, 00000000.00000000.232326276.0000000000B98000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe4 vs NjRat.exe
Source: NjRat.exe	Binary or memory string: OriginalFilenameClient.exe4 vs NjRat.exe

Source: NjRat.exe

Virustotal: Detection: 80%

Source: NjRat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NjRat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: NjRat.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\NjRat.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\NjRat.exe	Code function: 0_2_054C10A6 AdjustTokenPrivileges,		0_2_054C10A6
Source: C:\Users\user\Desktop\NjRat.exe	Code function: 0_2_054C106F AdjustTokenPrivileges,		0_2_054C106F

Source: C:\Users\user\Desktop\NjRat.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\Desktop\NjRat.exe	Mutant created: \Sessions\1\BaseNamedObjects\49829bdae88c

Source: classification engine

Classification label: mal84.troj.spyw.evad.winEXE@1/0@58/0

Source: C:\Users\user\Desktop\NjRat.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: NjRat.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\NjRat.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

.NET source code contains potential unpacker

Source: NjRat.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: NjRat.exe, Program.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.NjRat.exe.b90000.0.unpack, Program.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NjRat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\NjRat.exe

Window / User API: threadDelayed 6670

Source: C:\Users\user\Desktop\NjRat.exe TID: 5232

Thread sleep count: 6670 > 30

Source: C:\Users\user\Desktop\NjRat.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\NjRat.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\NjRat.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\NjRat.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: NjRat.exe, Program.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: NjRat.exe, Keylogger.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 0.0.NjRat.exe.b90000.0.unpack, Program.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 0.0.NjRat.exe.b90000.0.unpack, Keylogger.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')

Source: NjRat.exe, 00000000.00000002.499171132.0000000003250000.00000004.00000800.00020000.00000000.sdmp, NjRat.exe, 00000000.00000002.499082624.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: NjRat.exe, 00000000.00000002.499171132.0000000003250000.00000004.00000800.00020000.00000000.sdmp, NjRat.exe, 00000000.00000002.499082624.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\|9
Source: NjRat.exe, 00000000.00000002.499171132.0000000003250000.00000004.00000800.00020000.00000000.sdmp, NjRat.exe, 00000000.00000002.499082624.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager<

Source: C:\Users\user\Desktop\NjRat.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: NjRat.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NjRat.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.232319489.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NjRat.exe PID: 5420, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: NjRat.exe, type: SAMPLE
Source: Yara match	File source: 0.0.NjRat.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.232319489.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NjRat.exe PID: 5420, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	Path Interception	1 Access Token Manipulation	1 Virtualization/Sandbox Evasion	1 Input Capture	1 Virtualization/Sandbox Evasion	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Non-Application Layer Protocol	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Process Injection	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Access Token Manipulation	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Software Packing	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NjRat.exe	81%	Virustotal		Browse
NjRat.exe	100%	Avira	TR/Dropper.Gen7
NjRat.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.NjRat.exe.b90000.0.unpack	100%	Avira	TR/Dropper.Gen7		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
javaoracle.hopto.org	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
javaoracle.hopto.org	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
javaoracle.hopto.org	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	770271
Start date and time:	2022-12-19 23:02:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	NjRat.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.spyw.evad.winEXE@1/0@58/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 64 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.7989998190116143
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	NjRat.exe
File size:	32768
MD5:	4dfda9644efa02d836dbb422936b4fe8
SHA1:	521fa18a06ad42431014dd870a721bcb1e9318de
SHA256:	6bddb592e3b006a2e526bf7d3ff8f94f03b3e25897cea915960e648ef48869b3
SHA512:	2c9e919830939b686e6a2fec576da33197c4fcfb95fe2f685ca1ec1106a8f1719986bf1903dcc8922b9310bb36d1e023fb06613be5c28ace78bdb4e76c4a592a
SSDEEP:	384:00bUe5XB4e0X7OVcsw0Q0mS03AWTxtTUFQqzFGObbR:RT9BuC6555d4bR
TLSH:	3CE208067BF98215D6BC5AF88CB313214772E3838532EB6F5CDC98CA4B676D00645EE9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C.sc.................P... ......ng... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x40676e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6373F043 [Tue Nov 15 20:02:11 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6718	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x2a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4774	0x5000	False	0.4748046875	data	5.289775354614074	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x2a0	0x1000	False	0.07666015625	data	0.6655850551657312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x1000	False	0.0087890625	data	0.013126943721219527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x8058	0x244	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Download Network PCAP: filtered – full

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2022 23:03:01.135204077 CET	49977	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:01.155674934 CET	53	49977	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:03.180324078 CET	57840	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:03.199692965 CET	53	57840	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:05.213258982 CET	57990	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:05.236181974 CET	53	57990	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:07.264019012 CET	56924	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:07.288095951 CET	53	56924	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:09.307188034 CET	60625	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:09.326510906 CET	53	60625	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:11.362128973 CET	49302	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:11.380264997 CET	53	49302	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:13.451940060 CET	53975	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:13.470891953 CET	53	53975	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:15.499706030 CET	51139	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:15.519515038 CET	53	51139	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:17.602252007 CET	52955	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:17.620395899 CET	53	52955	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:19.651704073 CET	60582	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:19.669816017 CET	53	60582	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:21.689243078 CET	57134	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:21.708992958 CET	53	57134	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:23.728792906 CET	62050	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:23.747059107 CET	53	62050	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:25.770757914 CET	56042	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:25.791280985 CET	53	56042	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:28.065093040 CET	59636	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:28.083154917 CET	53	59636	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:30.138931036 CET	55638	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:30.157114983 CET	53	55638	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:32.202222109 CET	57704	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:32.220282078 CET	53	57704	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:34.231417894 CET	65320	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:34.251072884 CET	53	65320	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:36.263711929 CET	60767	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:36.281912088 CET	53	60767	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:38.295089960 CET	65107	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:38.312933922 CET	53	65107	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:40.325378895 CET	53848	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:40.343202114 CET	53	53848	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:42.361660004 CET	57571	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:42.381429911 CET	53	57571	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:44.401216030 CET	58691	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:44.421427011 CET	53	58691	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:46.434865952 CET	53305	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:46.455352068 CET	53	53305	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:48.498076916 CET	59433	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:48.519148111 CET	53	59433	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:50.527416945 CET	60749	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:50.545219898 CET	53	60749	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:52.563286066 CET	56949	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:52.581445932 CET	53	56949	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:54.591330051 CET	52547	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:54.609739065 CET	53	52547	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:56.630789995 CET	53844	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:56.650423050 CET	53	53844	8.8.8.8	192.168.2.3
Dec 19, 2022 23:03:58.707082987 CET	65017	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:03:58.727535009 CET	53	65017	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:00.749882936 CET	53466	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:00.768559933 CET	53	53466	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:02.840859890 CET	57743	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:02.858617067 CET	53	57743	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:04.936908960 CET	53623	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:04.957174063 CET	53	53623	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:06.965876102 CET	61416	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:06.983719110 CET	53	61416	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:09.003112078 CET	65196	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:09.023678064 CET	53	65196	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:11.052040100 CET	58708	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:11.074887991 CET	53	58708	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:13.092600107 CET	59581	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:13.121436119 CET	53	59581	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:15.138598919 CET	53049	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:15.159041882 CET	53	53049	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:17.176152945 CET	60088	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:17.197258949 CET	53	60088	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:19.218736887 CET	63562	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:19.237216949 CET	53	63562	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:21.301671982 CET	53428	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:21.321234941 CET	53	53428	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:23.343063116 CET	65511	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:23.362637043 CET	53	65511	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:25.375946045 CET	59820	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:25.396213055 CET	53	59820	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:27.406435013 CET	64595	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:27.424422979 CET	53	64595	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:29.437721968 CET	52079	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:29.455574989 CET	53	52079	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:31.474884033 CET	64823	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:31.495091915 CET	53	64823	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:33.520098925 CET	51992	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:33.538078070 CET	53	51992	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:35.549333096 CET	58119	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:35.572043896 CET	53	58119	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:37.635499954 CET	49166	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:37.653634071 CET	53	49166	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:39.679414034 CET	58301	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:39.697695017 CET	53	58301	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:41.718868017 CET	63446	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:41.738656044 CET	53	63446	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:43.754101992 CET	49874	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:43.775408030 CET	53	49874	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:45.804409027 CET	65459	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:45.824541092 CET	53	65459	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:47.844623089 CET	65385	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:47.864533901 CET	53	65385	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:49.877428055 CET	54153	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:49.897413015 CET	53	54153	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:51.962511063 CET	64602	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:51.982722044 CET	53	64602	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:54.002010107 CET	50784	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:54.022227049 CET	53	50784	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:56.034060955 CET	64121	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:56.056148052 CET	53	64121	8.8.8.8	192.168.2.3
Dec 19, 2022 23:04:58.060647964 CET	64967	53	192.168.2.3	8.8.8.8
Dec 19, 2022 23:04:58.078546047 CET	53	64967	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2022 23:03:01.135204077 CET	192.168.2.3	8.8.8.8	0xa00c	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:03.180324078 CET	192.168.2.3	8.8.8.8	0xdc47	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:05.213258982 CET	192.168.2.3	8.8.8.8	0xbf97	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:07.264019012 CET	192.168.2.3	8.8.8.8	0x7194	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:09.307188034 CET	192.168.2.3	8.8.8.8	0xc917	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:11.362128973 CET	192.168.2.3	8.8.8.8	0xf3bb	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:13.451940060 CET	192.168.2.3	8.8.8.8	0xbed9	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:15.499706030 CET	192.168.2.3	8.8.8.8	0x23e0	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:17.602252007 CET	192.168.2.3	8.8.8.8	0x82b5	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:19.651704073 CET	192.168.2.3	8.8.8.8	0x27ec	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:21.689243078 CET	192.168.2.3	8.8.8.8	0xfe64	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:23.728792906 CET	192.168.2.3	8.8.8.8	0x2bf6	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:25.770757914 CET	192.168.2.3	8.8.8.8	0x219f	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:28.065093040 CET	192.168.2.3	8.8.8.8	0x32	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:30.138931036 CET	192.168.2.3	8.8.8.8	0x8b67	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:32.202222109 CET	192.168.2.3	8.8.8.8	0x565c	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:34.231417894 CET	192.168.2.3	8.8.8.8	0xbe98	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:36.263711929 CET	192.168.2.3	8.8.8.8	0xf1e6	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:38.295089960 CET	192.168.2.3	8.8.8.8	0x5a28	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:40.325378895 CET	192.168.2.3	8.8.8.8	0xfe48	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:42.361660004 CET	192.168.2.3	8.8.8.8	0xa2c7	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:44.401216030 CET	192.168.2.3	8.8.8.8	0x8e65	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:46.434865952 CET	192.168.2.3	8.8.8.8	0x4d80	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:48.498076916 CET	192.168.2.3	8.8.8.8	0xa1d2	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:50.527416945 CET	192.168.2.3	8.8.8.8	0xee00	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:52.563286066 CET	192.168.2.3	8.8.8.8	0x4e93	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:54.591330051 CET	192.168.2.3	8.8.8.8	0x92c7	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:56.630789995 CET	192.168.2.3	8.8.8.8	0xa9d9	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:03:58.707082987 CET	192.168.2.3	8.8.8.8	0x40b	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:00.749882936 CET	192.168.2.3	8.8.8.8	0x1aef	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:02.840859890 CET	192.168.2.3	8.8.8.8	0xa236	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:04.936908960 CET	192.168.2.3	8.8.8.8	0x5a65	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:06.965876102 CET	192.168.2.3	8.8.8.8	0xe35b	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:09.003112078 CET	192.168.2.3	8.8.8.8	0x47a5	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:11.052040100 CET	192.168.2.3	8.8.8.8	0x8a75	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:13.092600107 CET	192.168.2.3	8.8.8.8	0x89ab	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:15.138598919 CET	192.168.2.3	8.8.8.8	0xb877	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:17.176152945 CET	192.168.2.3	8.8.8.8	0xbd5a	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:19.218736887 CET	192.168.2.3	8.8.8.8	0x177	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:21.301671982 CET	192.168.2.3	8.8.8.8	0xdb96	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:23.343063116 CET	192.168.2.3	8.8.8.8	0x5a63	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:25.375946045 CET	192.168.2.3	8.8.8.8	0xc88f	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:27.406435013 CET	192.168.2.3	8.8.8.8	0xc3e0	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:29.437721968 CET	192.168.2.3	8.8.8.8	0x7fcb	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:31.474884033 CET	192.168.2.3	8.8.8.8	0x4965	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:33.520098925 CET	192.168.2.3	8.8.8.8	0x4abc	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:35.549333096 CET	192.168.2.3	8.8.8.8	0xece8	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:37.635499954 CET	192.168.2.3	8.8.8.8	0xd2bc	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:39.679414034 CET	192.168.2.3	8.8.8.8	0xeb27	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:41.718868017 CET	192.168.2.3	8.8.8.8	0x7d30	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:43.754101992 CET	192.168.2.3	8.8.8.8	0x4964	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:45.804409027 CET	192.168.2.3	8.8.8.8	0x27d5	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:47.844623089 CET	192.168.2.3	8.8.8.8	0xe7ad	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:49.877428055 CET	192.168.2.3	8.8.8.8	0xf820	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:51.962511063 CET	192.168.2.3	8.8.8.8	0xf94d	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:54.002010107 CET	192.168.2.3	8.8.8.8	0x5a24	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:56.034060955 CET	192.168.2.3	8.8.8.8	0xf734	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false
Dec 19, 2022 23:04:58.060647964 CET	192.168.2.3	8.8.8.8	0x3226	Standard query (0)	javaoracle.hopto.org	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

• NjRat.exe

Click to jump to process

Memory Usage

• NjRat.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

System Behavior

Analysis Process: NjRat.exePID: 5420, Parent PID: 3452

Function Logs

General

Target ID:	0
Start time:	23:02:53
Start date:	19/12/2022
Path:	C:\Users\user\Desktop\NjRat.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\NjRat.exe
Imagebase:	0xb90000
File size:	32768 bytes
MD5 hash:	4DFDA9644EFA02D836DBB422936B4FE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.232319489.0000000000B92000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

File Activities

File Opened

File Created

File Read

File Attributes Queried

Section Activities

Sections loaded by Windows

Sections loaded by Program

Registry Activities

Key Opened

Key Created

Key Value Created

Key Value Queried

Key Value Enumerated

Key Enumerated

Mutex Activities

Mutex Created

Process Activities

Process Queried

Process Information Set

Thread Activities

Thread Created

Thread Execution Resumed

Thread Delayed

Thread Information Set

Memory Activities

Memory Allocated

Memory Protection Changed

Memory Usage Statistics

System Activities

System Information Queried

Windows UI Activities

Window Created

Network Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Process Token Activities

Token Adjusted

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.