IOC Report
njrat.exe

loading gif

Files

File Path
Type
Category
Malicious
njrat.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\njrat.exe.log
ASCII text, with CRLF line terminators
modified
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\495a56e87a9043e1648a2f6d33cf682f.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Windows\server.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Windows\server.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\server.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\1129210
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\Login Data
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\njrat.exe
"C:\Users\user\Desktop\njrat.exe"
 malicious
C:\Windows\server.exe
"C:\Windows\server.exe"
malicious
C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
 malicious
C:\Windows\server.exe
"C:\Windows\server.exe" ..
 malicious
C:\Windows\server.exe
"C:\Windows\server.exe" ..
 malicious
C:\Windows\server.exe
"C:\Windows\server.exe" ..
 malicious
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\user\AppData\Local\Temp\1129210"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0
unknown
http://hotmail.com
unknown
http://Yahoo.com
unknown
http://DynDns.com
unknown
http://hotmail.com9Software
unknown
http://www.oovoo.com/?Encrypted
unknown
http://Paltalk.com
unknown
http://go.micros
unknown
http://no-ip.com
unknown
http://www.noip.com/
unknown
http://Paltalk.com/Software
unknown
There are 1 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
51.103.213.187
unknown
United Kingdom
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER
di
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
495a56e87a9043e1648a2f6d33cf682f
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
495a56e87a9043e1648a2f6d33cf682f
HKEY_CURRENT_USER\SOFTWARE\495a56e87a9043e1648a2f6d33cf682f
2681e81bb4c4b3e6338ce2a456fb93a7
HKEY_CURRENT_USER\SOFTWARE\495a56e87a9043e1648a2f6d33cf682f
96bbeae23f13d8b402340f54c661c049

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
2F61000
trusted library allocation
page read and write
 malicious
152000
unkown
page readonly
 malicious
11BF000
heap
page read and write
CF6000
stack
page read and write
12E0000
trusted library allocation
page read and write
19B000
stack
page read and write
11C0000
heap
page read and write
3781000
trusted library allocation
page read and write
124E000
heap
page read and write
11A9000
heap
page read and write
4F4E000
stack
page read and write
E00000
trusted library allocation
page read and write
FF0000
heap
page execute and read and write
10FE000
stack
page read and write
E0A000
heap
page read and write
11D3000
heap
page read and write
495E000
stack
page read and write
A22000
trusted library allocation
page execute and read and write
54C0000
trusted library allocation
page read and write
F90000
trusted library allocation
page read and write
A8B000
trusted library allocation
page execute and read and write
DE0000
trusted library allocation
page read and write
C70000
heap
page read and write
DD0000
heap
page read and write
92F000
stack
page read and write
11DE000
stack
page read and write
4069000
trusted library allocation
page read and write
6AEE000
heap
page read and write
12F0000
heap
page read and write
155E000
stack
page read and write
534F000
stack
page read and write
DB5000
heap
page read and write
9D0000
heap
page read and write
BB0000
heap
page read and write
1248000
heap
page read and write
54D0000
unclassified section
page read and write
3F31000
trusted library allocation
page read and write
9C000
stack
page read and write
11CC000
heap
page read and write
E37000
trusted library allocation
page execute and read and write
9FA000
trusted library allocation
page execute and read and write
A42000
trusted library allocation
page execute and read and write
1060000
heap
page execute and read and write
50CE000
stack
page read and write
A06000
trusted library allocation
page execute and read and write
582E000
stack
page read and write
523C000
stack
page read and write
E48000
heap
page read and write
36E0000
heap
page read and write
13FE000
stack
page read and write
11DE000
heap
page read and write
4E3E000
stack
page read and write
4F9E000
stack
page read and write
55EE000
stack
page read and write
1201000
heap
page read and write
A20000
trusted library allocation
page read and write
11C7000
heap
page read and write
11A7000
heap
page read and write
52B3000
heap
page read and write
9B5000
heap
page read and write
7BB000
stack
page read and write
11D3000
heap
page read and write
58C0000
heap
page read and write
6B8A000
heap
page read and write
59DA000
heap
page read and write
52EE000
stack
page read and write
4EF0000
trusted library allocation
page read and write
E3B000
trusted library allocation
page execute and read and write
770000
heap
page read and write
41E4000
trusted library allocation
page read and write
54EE000
stack
page read and write
51E0000
heap
page read and write
F10000
heap
page read and write
317E000
trusted library allocation
page read and write
11A4000
heap
page read and write
11C4000
heap
page read and write
49A0000
trusted library allocation
page read and write
A02000
trusted library allocation
page execute and read and write
46F000
remote allocation
page execute and read and write
11F2000
heap
page read and write
5D59000
heap
page read and write
12D0000
trusted library allocation
page execute and read and write
EEA000
heap
page read and write
739000
heap
page read and write
94F000
stack
page read and write
4163000
trusted library allocation
page read and write
59D6000
heap
page read and write
58CF000
heap
page read and write
11AA000
heap
page read and write
AF6000
stack
page read and write
59D8000
heap
page read and write
536B000
stack
page read and write
510000
heap
page read and write
242E000
stack
page read and write
480000
heap
page read and write
53C0000
heap
page read and write
9C0000
heap
page read and write
1077000
trusted library allocation
page execute and read and write
50E000
stack
page read and write
11DE000
heap
page read and write
EE0000
heap
page read and write
11D3000
heap
page read and write
11C8000
heap
page read and write
68E000
stack
page read and write
2F31000
trusted library allocation
page read and write
795000
heap
page read and write
B30000
heap
page read and write
E7E000
heap
page read and write
11DF000
heap
page read and write
10F0000
heap
page read and write
4C5E000
stack
page read and write
530000
heap
page read and write
640000
heap
page read and write
519E000
stack
page read and write
3458000
trusted library allocation
page read and write
55BF000
stack
page read and write
11CA000
heap
page read and write
BBA000
heap
page read and write
11CE000
heap
page read and write
6AF7000
heap
page read and write
11A8000
heap
page read and write
4E4E000
stack
page read and write
11D3000
heap
page read and write
E2A000
trusted library allocation
page execute and read and write
990000
heap
page execute and read and write
1247000
heap
page read and write
51F9000
stack
page read and write
DFA000
trusted library allocation
page execute and read and write
1070000
trusted library allocation
page read and write
A70000
heap
page read and write
3191000
trusted library allocation
page read and write
64B000
heap
page read and write
11F2000
heap
page read and write
11E1000
heap
page read and write
11DE000
heap
page read and write
B8F000
stack
page read and write
59D6000
heap
page read and write
56EE000
stack
page read and write
3CF1000
trusted library allocation
page read and write
5110000
heap
page read and write
11F7000
heap
page read and write
4D3E000
stack
page read and write
530C000
stack
page read and write
D70000
heap
page read and write
C75000
heap
page read and write
1201000
heap
page read and write
A4A000
trusted library allocation
page execute and read and write
119D000
heap
page read and write
F9C000
trusted library allocation
page execute and read and write
59C0000
trusted library allocation
page execute and read and write
11CE000
heap
page read and write
141E000
unkown
page read and write
A37000
trusted library allocation
page execute and read and write
11CC000
heap
page read and write
11A8000
heap
page read and write
11DD000
heap
page read and write
59CD000
heap
page read and write
4ECE000
stack
page read and write
F92000
trusted library allocation
page execute and read and write
514E000
stack
page read and write
550000
heap
page read and write
52B0000
heap
page read and write
11F7000
heap
page read and write
FFE000
stack
page read and write
50FE000
stack
page read and write
DD3000
heap
page read and write
DA0000
heap
page read and write
3F34000
trusted library allocation
page read and write
323E000
trusted library allocation
page read and write
DBE000
heap
page read and write
9F0000
heap
page read and write
5040000
heap
page read and write
48B000
stack
page read and write
D10000
trusted library allocation
page execute and read and write
9B0000
heap
page read and write
A0C000
trusted library allocation
page execute and read and write
11BF000
heap
page read and write
11E0000
heap
page read and write
71E000
heap
page read and write
11E0000
heap
page read and write
4A6E000
stack
page read and write
DF2000
trusted library allocation
page execute and read and write
119D000
heap
page read and write
125E000
stack
page read and write
12C0000
trusted library allocation
page read and write
B58000
heap
page read and write
9E0000
heap
page read and write
73E000
stack
page read and write
4AEE000
stack
page read and write
F70000
trusted library allocation
page read and write
1197000
heap
page read and write
4B5E000
stack
page read and write
6BDE000
heap
page read and write
6BB0000
heap
page read and write
A07C000
heap
page read and write
35BE000
stack
page read and write
3182000
trusted library allocation
page read and write
6A00000
heap
page read and write
46C000
remote allocation
page execute and read and write
FB2000
trusted library allocation
page execute and read and write
4F50000
heap
page read and write
1010000
heap
page read and write
F8A000
trusted library allocation
page execute and read and write
5CCC000
stack
page read and write
E2C000
trusted library allocation
page execute and read and write
517B000
stack
page read and write
4D9F000
stack
page read and write
1022000
trusted library allocation
page execute and read and write
630000
heap
page read and write
E20000
trusted library allocation
page read and write
1150000
heap
page read and write
11D3000
heap
page read and write
E40000
heap
page read and write
10E0000
trusted library allocation
page execute and read and write
A010000
heap
page read and write
11C9000
heap
page read and write
718000
heap
page read and write
10F3000
stack
page read and write
119D000
heap
page read and write
15C000
unkown
page readonly
4960000
heap
page read and write
11BD000
heap
page read and write
1198000
heap
page read and write
5F0000
heap
page read and write
2781000
trusted library allocation
page read and write
56F0000
heap
page read and write
11D8000
heap
page read and write
107B000
trusted library allocation
page execute and read and write
11D3000
heap
page read and write
5CE0000
trusted library section
page read and write
F0A000
heap
page read and write
6B13000
heap
page read and write
546C000
stack
page read and write
11C8000
heap
page read and write
740000
heap
page read and write
5D40000
trusted library section
page read and write
54BE000
stack
page read and write
11AA000
heap
page read and write
11FE000
stack
page read and write
11C5000
heap
page read and write
4920000
trusted library allocation
page read and write
102A000
trusted library allocation
page execute and read and write
1010000
trusted library allocation
page read and write
4EE0000
trusted library allocation
page execute and read and write
D60000
trusted library allocation
page read and write
B83000
heap
page read and write
A00000
trusted library allocation
page read and write
4F8E000
stack
page read and write
4ED0000
trusted library allocation
page read and write
113E000
unkown
page read and write
51CE000
stack
page read and write
4F68000
trusted library allocation
page read and write
53BD000
stack
page read and write
53D0000
heap
page read and write
40BC000
trusted library allocation
page read and write
4F9000
stack
page read and write
6BC0000
heap
page read and write
485E000
stack
page read and write
11CF000
heap
page read and write
11CA000
heap
page read and write
638000
heap
page read and write
11DE000
heap
page read and write
5E5D000
stack
page read and write
82F000
stack
page read and write
1400000
trusted library allocation
page read and write
1030000
trusted library allocation
page read and write
6BE0000
heap
page read and write
11CF000
heap
page read and write
A40000
trusted library allocation
page read and write
36BE000
stack
page read and write
B50000
heap
page read and write
10BE000
stack
page read and write
119A000
heap
page read and write
F82000
trusted library allocation
page execute and read and write
51DE000
stack
page read and write
1470000
heap
page read and write
4980000
heap
page read and write
4C9E000
stack
page read and write
7B67000
heap
page read and write
10D0000
heap
page read and write
1196000
heap
page read and write
6B2C000
heap
page read and write
318D000
trusted library allocation
page read and write
4F6000
stack
page read and write
11AC000
heap
page read and write
11D6000
heap
page read and write
401B000
trusted library allocation
page read and write
538E000
stack
page read and write
11DC000
heap
page read and write
710000
heap
page read and write
EBF000
stack
page read and write
A70000
heap
page execute and read and write
6F0000
heap
page read and write
1201000
heap
page read and write
3FC7000
trusted library allocation
page read and write
119E000
heap
page read and write
11BD000
heap
page read and write
D5E000
stack
page read and write
9C0000
heap
page read and write
11CE000
heap
page read and write
11F2000
heap
page read and write
E12000
trusted library allocation
page read and write
59D7000
heap
page read and write
11D3000
heap
page read and write
5120000
heap
page read and write
53E0000
heap
page read and write
103C000
trusted library allocation
page execute and read and write
1248000
heap
page read and write
50CE000
stack
page read and write
1243000
heap
page read and write
524E000
stack
page read and write
11C3000
heap
page read and write
1158000
heap
page read and write
90F000
stack
page read and write
59C2000
heap
page read and write
11AB000
heap
page read and write
B6E000
heap
page read and write
4C3E000
stack
page read and write
548E000
stack
page read and write
1080000
trusted library allocation
page read and write
9D0000
trusted library allocation
page read and write
3235000
trusted library allocation
page read and write
EE6000
heap
page read and write
9F6000
heap
page read and write
11E0000
heap
page read and write
60F000
heap
page read and write
FC7000
trusted library allocation
page execute and read and write
490E000
stack
page read and write
11D9000
heap
page read and write
DB0000
heap
page read and write
11D8000
heap
page read and write
CF9000
stack
page read and write
775000
heap
page read and write
A0F000
stack
page read and write
37D1000
trusted library allocation
page read and write
5D50000
heap
page read and write
4110000
trusted library allocation
page read and write
3FBA000
trusted library allocation
page read and write
D50000
heap
page read and write
1200000
heap
page read and write
11DF000
heap
page read and write
520B000
stack
page read and write
635000
heap
page read and write
6BF0000
heap
page read and write
11DE000
heap
page read and write
119B000
heap
page read and write
119B000
heap
page read and write
11C9000
heap
page read and write
11AA000
heap
page read and write
11D2000
heap
page read and write
6F0000
heap
page read and write
A32000
trusted library allocation
page execute and read and write
111F000
stack
page read and write
5F30000
trusted library allocation
page execute and read and write
1186000
heap
page read and write
74F000
heap
page read and write
11C7000
heap
page read and write
5F8000
heap
page read and write
1440000
heap
page read and write
248F000
stack
page read and write
480E000
stack
page read and write
D3E000
stack
page read and write
104E000
stack
page read and write
D7E000
stack
page read and write
625000
heap
page read and write
77B000
heap
page read and write
1247000
heap
page read and write
501E000
stack
page read and write
95A000
stack
page read and write
513C000
stack
page read and write
11DD000
heap
page read and write
A3A000
trusted library allocation
page execute and read and write
E32000
trusted library allocation
page read and write
11F7000
heap
page read and write
1189000
heap
page read and write
3784000
trusted library allocation
page read and write
DD5000
heap
page read and write
A62000
trusted library allocation
page execute and read and write
E22000
trusted library allocation
page execute and read and write
DF0000
heap
page read and write
592F000
stack
page read and write
53EF000
stack
page read and write
CF6000
stack
page read and write
11D8000
heap
page read and write
A3B000
trusted library allocation
page execute and read and write
11CE000
heap
page read and write
49C0000
trusted library allocation
page read and write
36C0000
heap
page read and write
11DE000
heap
page read and write
11D1000
heap
page read and write
12A0000
heap
page read and write
508E000
stack
page read and write
1032000
trusted library allocation
page execute and read and write
E1A000
trusted library allocation
page execute and read and write
1197000
heap
page read and write
E02000
trusted library allocation
page execute and read and write
D70000
heap
page read and write
4B30000
heap
page read and write
150000
unkown
page readonly
3288000
trusted library allocation
page read and write
11C5000
heap
page read and write
94B000
stack
page read and write
51BC000
stack
page read and write
59C2000
heap
page read and write
11A8000
heap
page read and write
145D000
stack
page read and write
11DD000
heap
page read and write
A4C000
trusted library allocation
page execute and read and write
3398000
trusted library allocation
page read and write
11A6000
heap
page read and write
FCB000
trusted library allocation
page execute and read and write
11C9000
heap
page read and write
27D1000
trusted library allocation
page read and write
DBE000
stack
page read and write
EF2000
heap
page read and write
4AAE000
stack
page read and write
59A0000
heap
page read and write
11C3000
heap
page read and write
1036000
trusted library allocation
page execute and read and write
A87000
trusted library allocation
page execute and read and write
630000
heap
page read and write
11D9000
heap
page read and write
11D5000
heap
page read and write
9D0000
heap
page read and write
1196000
heap
page read and write
1052000
trusted library allocation
page execute and read and write
DA8000
heap
page read and write
49B0000
trusted library allocation
page execute and read and write
A80000
heap
page read and write
13FF000
stack
page read and write
5B30000
heap
page read and write
B20000
heap
page read and write
A7E000
stack
page read and write
6CE000
stack
page read and write
59CB000
heap
page read and write
11CC000
heap
page read and write
5240000
trusted library allocation
page execute and read and write
EFE000
stack
page read and write
5B40000
heap
page read and write
4910000
trusted library allocation
page execute and read and write
7F9B0000
trusted library allocation
page execute and read and write
2CF1000
trusted library allocation
page read and write
4FDE000
stack
page read and write
4DCE000
stack
page read and write
9B0000
heap
page read and write
11CE000
heap
page read and write
11CA000
heap
page read and write
1171000
heap
page read and write
586000
stack
page read and write
11D7000
heap
page read and write
6BD0000
heap
page read and write
129E000
stack
page read and write
AF9000
stack
page read and write
E08000
heap
page read and write
1243000
heap
page read and write
1140000
heap
page read and write
98E000
stack
page read and write
121F000
stack
page read and write
36E6000
heap
page read and write
59C7000
heap
page read and write
11E0000
heap
page read and write
10EE000
stack
page read and write
E02000
heap
page read and write
3195000
trusted library allocation
page read and write
3F61000
trusted library allocation
page read and write
AD0000
heap
page read and write
5B60000
heap
page read and write
59D6000
heap
page read and write
11D3000
heap
page read and write
D90000
heap
page read and write
11BD000
heap
page read and write
1EB000
stack
page read and write
1090000
heap
page execute and read and write
F96000
trusted library allocation
page execute and read and write
6AE0000
heap
page read and write
1198000
heap
page read and write
10DC000
stack
page read and write
124A000
heap
page read and write
ACE000
stack
page read and write
3CF4000
trusted library allocation
page read and write
5E60000
trusted library allocation
page read and write
515E000
stack
page read and write
11D7000
heap
page read and write
D7B000
stack
page read and write
CF9000
stack
page read and write
A000000
heap
page read and write
E17000
trusted library allocation
page execute and read and write
4050000
trusted library allocation
page read and write
5CD0000
trusted library section
page read and write
11DE000
heap
page read and write
9F2000
trusted library allocation
page execute and read and write
4CE000
stack
page read and write
65B000
heap
page read and write
1245000
heap
page read and write
124E000
heap
page read and write
192000
stack
page read and write
124C000
heap
page read and write
11C4000
heap
page read and write
E4E000
heap
page read and write
There are 490 hidden memdumps, click here to show them.