Edit tour

Windows Analysis Report
xbOnlYALvtUq.exe

Overview

General Information

Sample Name:	xbOnlYALvtUq.exe
Analysis ID:	1345566
MD5:	2bdc913d338e004ac337cfe9a44abc55
SHA1:	29feda66e04422c0d506048ea8123771269faa82
SHA256:	f2f0353f1f50aa9a76a1ab978430f1a6e85d95d8ce7ee66230beda0927863cfc
Tags:	exenjRat
Infos:

Detection

Njrat, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected zgRAT

Malicious sample detected (through community Yara rule)

Yara detected Njrat

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Uses netsh to modify the Windows network and firewall settings

Connects to many ports of the same IP (likely port scanning)

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

.NET source code contains potential unpacker

.NET source code contains method to dynamically call methods (often used by packers)

C2 URLs / IPs found in malware configuration

Modifies the windows firewall

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Stores large binary data to the registry

Sample execution stops while process was sleeping (likely an evasion)

IP address seen in connection with other malware

Abnormal high CPU Usage

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Classification

Process Tree

System is w10x64

xbOnlYALvtUq.exe (PID: 3472 cmdline: C:\Users\user\Desktop\xbOnlYALvtUq.exe MD5: 2BDC913D338E004AC337CFE9A44ABC55)

netsh.exe (PID: 5148 cmdline: netsh firewall add allowedprogram "C:\Users\user\Desktop\xbOnlYALvtUq.exe" "xbOnlYALvtUq.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 2316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Njrat

{"Host": "0.tcp.sa.ngrok.io", "Port": "13065", "Version": "0.7d", "Campaign ID": "HacKed", "Install Name": "server.exe", "Install Dir": "TEMP", "Network Seprator": "|'|'|"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
xbOnlYALvtUq.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
xbOnlYALvtUq.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x3c9a:$a1: get_Registry 0x4d66:$a2: SEE_MASK_NOZONECHECKS 0x4e62:$a3: Download ERROR 0x4d28:$a4: cmd.exe /c ping 0 -n 2 & del " 0x4cba:$a5: netsh firewall delete allowedprogram "
xbOnlYALvtUq.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d28:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4e80:$s3: Executed As 0x4e62:$s6: Download ERROR
xbOnlYALvtUq.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4d96:$a1: netsh firewall add allowedprogram 0x4d66:$a2: SEE_MASK_NOZONECHECKS 0x5010:$b1: [TAP] 0x4d28:$c3: cmd.exe /c ping
xbOnlYALvtUq.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d66:$reg: SEE_MASK_NOZONECHECKS 0x4e3e:$msg: Execute ERROR 0x4e9a:$msg: Execute ERROR 0x4d28:$ping: cmd.exe /c ping 0 -n 2 & del
xbOnlYALvtUq.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x4cba:$s1: netsh firewall delete allowedprogram 0x4d96:$s2: netsh firewall add allowedprogram 0x4d28:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x4e3e:$s4: Execute ERROR 0x4e9a:$s4: Execute ERROR 0x4e62:$s5: Download ERROR 0x4fc6:$s6: [kl]
Click to see the 1 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Njrat_1	Yara detected Njrat	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1962163495.00000000007A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1962163495.00000000007A2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x3a9a:$a1: get_Registry 0x4b66:$a2: SEE_MASK_NOZONECHECKS 0x4c62:$a3: Download ERROR 0x4b28:$a4: cmd.exe /c ping 0 -n 2 & del " 0x4aba:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1962163495.00000000007A2000.00000002.00000001.01000000.00000003.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4b96:$a1: netsh firewall add allowedprogram 0x4b66:$a2: SEE_MASK_NOZONECHECKS 0x4e10:$b1: [TAP] 0x4b28:$c3: cmd.exe /c ping
00000000.00000000.1962163495.00000000007A2000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b66:$reg: SEE_MASK_NOZONECHECKS 0x4c3e:$msg: Execute ERROR 0x4c9a:$msg: Execute ERROR 0x4b28:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.4407298809.00000000059B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
00000000.00000002.4405941872.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: xbOnlYALvtUq.exe PID: 3472	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.xbOnlYALvtUq.exe.59b0000.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.2.xbOnlYALvtUq.exe.59b0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.xbOnlYALvtUq.exe.7a0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.xbOnlYALvtUq.exe.7a0000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x3c9a:$a1: get_Registry 0x4d66:$a2: SEE_MASK_NOZONECHECKS 0x4e62:$a3: Download ERROR 0x4d28:$a4: cmd.exe /c ping 0 -n 2 & del " 0x4cba:$a5: netsh firewall delete allowedprogram "
0.0.xbOnlYALvtUq.exe.7a0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d28:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4e80:$s3: Executed As 0x4e62:$s6: Download ERROR
0.0.xbOnlYALvtUq.exe.7a0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4d96:$a1: netsh firewall add allowedprogram 0x4d66:$a2: SEE_MASK_NOZONECHECKS 0x5010:$b1: [TAP] 0x4d28:$c3: cmd.exe /c ping
0.0.xbOnlYALvtUq.exe.7a0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d66:$reg: SEE_MASK_NOZONECHECKS 0x4e3e:$msg: Execute ERROR 0x4e9a:$msg: Execute ERROR 0x4d28:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.xbOnlYALvtUq.exe.7a0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x4cba:$s1: netsh firewall delete allowedprogram 0x4d96:$s2: netsh firewall add allowedprogram 0x4d28:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x4e3e:$s4: Execute ERROR 0x4e9a:$s4: Execute ERROR 0x4e62:$s5: Download ERROR 0x4fc6:$s6: [kl]
Click to see the 3 entries

Snort Signatures

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049704130652825564 11/21/23-03:38:52.649286
SID:	2825564
Source Port:	49704
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049704130652825563 11/21/23-03:35:58.376585
SID:	2825563
Source Port:	49704
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN njrat ver 0.7d Malware CnC Callback Response (Remote Desktop) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049713130652022061 11/21/23-03:37:00.931357
SID:	2022061
Source Port:	49713
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049704130652814860 11/21/23-03:38:53.381901
SID:	2814860
Source Port:	49704
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN njrat ver 0.7d Malware CnC Callback (Remote Desktop) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049713130652022060 11/21/23-03:36:22.077496
SID:	2022060
Source Port:	49713
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity Sending Screenshot (CAP) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049704130652825565 11/21/23-03:37:00.623314
SID:	2825565
Source Port:	49704
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049704130652033132 11/21/23-03:35:58.171440
SID:	2033132
Source Port:	49704
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN njrat ver 0.7d Malware CnC Callback (Capture) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049704130652019214 11/21/23-03:37:00.623314
SID:	2019214
Source Port:	49704
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049704130652814856 11/21/23-03:35:58.376585
SID:	2814856
Source Port:	49704
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN njrat ver 0.7d Malware CnC Callback Response (Get Passwords) - Source IP: 192.168.2.5 - Destination IP: 18.228.115.60

Timestamp:	192.168.2.518.228.115.6049704130652022059 11/21/23-03:36:21.801212
SID:	2022059
Source Port:	49704
Destination Port:	13065
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inv) - Source IP: 18.228.115.60 - Destination IP: 192.168.2.5

Timestamp:	18.228.115.60192.168.2.513065497042814858 11/21/23-03:36:20.299135
SID:	2814858
Source Port:	13065
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000000.1962163495.00000000007A2000.00000002.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: Njrat {"Host": "0.tcp.sa.ngrok.io", "Port": "13065", "Version": "0.7d", "Campaign ID": "HacKed", "Install Name": "server.exe", "Install Dir": "TEMP", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for submitted file

Source: xbOnlYALvtUq.exe	ReversingLabs: Detection: 92%
Source: xbOnlYALvtUq.exe	Virustotal: Detection: 87%			Perma Link

Yara detected Njrat

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: xbOnlYALvtUq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.xbOnlYALvtUq.exe.7a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1962163495.00000000007A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.44

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
xbOnlYALvtUq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xbOnlYALvtUq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Windows Analysis Report
xbOnlYALvtUq.exe