Play interactive tour

Edit tour

Analysis Report z2d6Yt5v.exe

Overview

General Information

Sample Name:	z2d6Yt5v.exe
Analysis ID:	321423
MD5:	9bb6d4f72a348ad47cc97185604f4dd9
SHA1:	7384957e8a29f517654fcbd905861574e772d3ed
SHA256:	0a170ca414d288bc25ebb5ce92ccd51ff0f62b1479d669172194bf0067601df1
Tags:	exenjRat
Most interesting Screenshot:

Detection

njRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected njRat

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Njrat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Creates autostart registry keys with suspicious names

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Netsh Port or Application Allowed

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

z2d6Yt5v.exe (PID: 6072 cmdline: 'C:\Users\user\Desktop\z2d6Yt5v.exe' MD5: 9BB6D4F72A348AD47CC97185604F4DD9)

Core Service.exe (PID: 4464 cmdline: 'C:\Users\user\AppData\Local\Temp\Core Service.exe' MD5: 9BB6D4F72A348AD47CC97185604F4DD9)

netsh.exe (PID: 5416 cmdline: netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\Core Service.exe' 'Core Service.exe' ENABLE MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 1124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Core Service.exe (PID: 4276 cmdline: 'C:\Users\user\AppData\Local\Temp\Core Service.exe' .. MD5: 9BB6D4F72A348AD47CC97185604F4DD9)

Core Service.exe (PID: 4760 cmdline: 'C:\Users\user\AppData\Local\Temp\Core Service.exe' .. MD5: 9BB6D4F72A348AD47CC97185604F4DD9)

Core Service.exe (PID: 6100 cmdline: 'C:\Users\user\AppData\Local\Temp\Core Service.exe' .. MD5: 9BB6D4F72A348AD47CC97185604F4DD9)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
z2d6Yt5v.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
z2d6Yt5v.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
z2d6Yt5v.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
z2d6Yt5v.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
C:\Users\user\AppData\Local\Temp\Core Service.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\Core Service.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\Core Service.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
C:\Users\user\AppData\Local\Temp\Core Service.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0xfc0:$a1: netsh firewall add allowedprogram 0x7068:$a1: netsh firewall add allowedprogram 0xf70:$a2: SEE_MASK_NOZONECHECKS 0x7038:$a2: SEE_MASK_NOZONECHECKS 0x72e2:$b1: [TAP] 0x6ffa:$c3: cmd.exe /c ping
00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0xf70:$reg: SEE_MASK_NOZONECHECKS 0x7038:$reg: SEE_MASK_NOZONECHECKS 0x7110:$msg: Execute ERROR 0x716c:$msg: Execute ERROR 0x6ffa:$ping: cmd.exe /c ping 0 -n 2 & del
00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4bb8:$a1: netsh firewall add allowedprogram 0x4b88:$a2: SEE_MASK_NOZONECHECKS 0x4e32:$b1: [TAP] 0x4b4a:$c3: cmd.exe /c ping
00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4b88:$reg: SEE_MASK_NOZONECHECKS 0x4c60:$msg: Execute ERROR 0x4cbc:$msg: Execute ERROR 0x4b4a:$ping: cmd.exe /c ping 0 -n 2 & del
00000002.00000002.461812462.0000000002FB5000.00000004.00000001.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Core Service.exe PID: 6100	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: z2d6Yt5v.exe PID: 6072	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Core Service.exe PID: 4760	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Core Service.exe PID: 4276	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Core Service.exe PID: 4464	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.Core Service.exe.8b0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
2.0.Core Service.exe.8b0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
2.0.Core Service.exe.8b0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
2.0.Core Service.exe.8b0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
15.0.Core Service.exe.920000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
15.0.Core Service.exe.920000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
15.0.Core Service.exe.920000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
15.0.Core Service.exe.920000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
0.2.z2d6Yt5v.exe.5e0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
0.2.z2d6Yt5v.exe.5e0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.z2d6Yt5v.exe.5e0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
0.2.z2d6Yt5v.exe.5e0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
2.2.Core Service.exe.8b0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
2.2.Core Service.exe.8b0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
2.2.Core Service.exe.8b0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
2.2.Core Service.exe.8b0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
7.0.Core Service.exe.ec0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
7.0.Core Service.exe.ec0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
7.0.Core Service.exe.ec0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
7.0.Core Service.exe.ec0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
15.2.Core Service.exe.920000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
15.2.Core Service.exe.920000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
15.2.Core Service.exe.920000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
15.2.Core Service.exe.920000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
7.2.Core Service.exe.ec0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
7.2.Core Service.exe.ec0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
7.2.Core Service.exe.ec0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
7.2.Core Service.exe.ec0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.z2d6Yt5v.exe.5e0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
0.0.z2d6Yt5v.exe.5e0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.z2d6Yt5v.exe.5e0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
0.0.z2d6Yt5v.exe.5e0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
10.0.Core Service.exe.810000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
10.0.Core Service.exe.810000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
10.0.Core Service.exe.810000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
10.0.Core Service.exe.810000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
10.2.Core Service.exe.810000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x4d4a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x4ea2:$s3: Executed As 0x4e84:$s6: Download ERROR
10.2.Core Service.exe.810000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
10.2.Core Service.exe.810000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x4db8:$a1: netsh firewall add allowedprogram 0x4d88:$a2: SEE_MASK_NOZONECHECKS 0x5032:$b1: [TAP] 0x4d4a:$c3: cmd.exe /c ping
10.2.Core Service.exe.810000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x4d88:$reg: SEE_MASK_NOZONECHECKS 0x4e60:$msg: Execute ERROR 0x4ebc:$msg: Execute ERROR 0x4d4a:$ping: cmd.exe /c ping 0 -n 2 & del
Click to see the 35 entries

Sigma Overview

System Summary:

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\Core Service.exe' 'Core Service.exe' ENABLE, CommandLine: netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\Core Service.exe' 'Core Service.exe' ENABLE, CommandLine|base64offset|contains: l, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: 'C:\Users\user\AppData\Local\Temp\Core Service.exe' , ParentImage: C:\Users\user\AppData\Local\Temp\Core Service.exe, ParentProcessId: 4464, ProcessCommandLine: netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\Core Service.exe' 'Core Service.exe' ENABLE, ProcessId: 5416

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: z2d6Yt5v.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Avira: detection malicious, Label: TR/Dropper.Gen7

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Virustotal: Detection: 84%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Metadefender: Detection: 89%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	Virustotal: Detection: 84%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	Metadefender: Detection: 89%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	ReversingLabs: Detection: 89%

Multi AV Scanner detection for submitted file

Show sources

Source: z2d6Yt5v.exe	Virustotal: Detection: 84%			Perma Link
Source: z2d6Yt5v.exe	Metadefender: Detection: 89%			Perma Link

Yara detected Njrat

Show sources

Source: Yara match	File source: z2d6Yt5v.exe, type: SAMPLE
Source: Yara match	File source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.461812462.0000000002FB5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 6100, type: MEMORY
Source: Yara match	File source: Process Memory Space: z2d6Yt5v.exe PID: 6072, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4760, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4276, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4464, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED
Source: Yara match	File source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: z2d6Yt5v.exe

Joe Sandbox ML: detected

Source: 15.2.Core Service.exe.920000.0.unpack	Avira: Label: TR/Dropper.Gen7
Source: 15.0.Core Service.exe.920000.0.unpack	Avira: Label: TR/Dropper.Gen7
Source: 7.2.Core Service.exe.ec0000.0.unpack	Avira: Label: TR/Dropper.Gen7
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack	Avira: Label: TR/Dropper.Gen7
Source: 2.2.Core Service.exe.8b0000.0.unpack	Avira: Label: TR/Dropper.Gen7
Source: 2.0.Core Service.exe.8b0000.0.unpack	Avira: Label: TR/Dropper.Gen7
Source: 10.0.Core Service.exe.810000.0.unpack	Avira: Label: TR/Dropper.Gen7
Source: 7.0.Core Service.exe.ec0000.0.unpack	Avira: Label: TR/Dropper.Gen7
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack	Avira: Label: TR/Dropper.Gen7
Source: 10.2.Core Service.exe.810000.0.unpack	Avira: Label: TR/Dropper.Gen7

Source: global traffic

TCP traffic: 192.168.2.3:49722 -> 81.249.236.18:5553

Source: unknown

DNS traffic detected: queries for: noiphack93.hopto.org

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to log keystrokes (.Net Source)

Show sources

Source: z2d6Yt5v.exe, kl.cs	.Net Code: VKCodeToUnicode
Source: Core Service.exe.0.dr, kl.cs	.Net Code: VKCodeToUnicode
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: af48625ee196d906557ab2d838a9cc2f.exe.2.dr, kl.cs	.Net Code: VKCodeToUnicode
Source: 2.2.Core Service.exe.8b0000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 2.0.Core Service.exe.8b0000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 7.2.Core Service.exe.ec0000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 7.0.Core Service.exe.ec0000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 10.0.Core Service.exe.810000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 10.2.Core Service.exe.810000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 15.2.Core Service.exe.920000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 15.0.Core Service.exe.920000.0.unpack, kl.cs	.Net Code: VKCodeToUnicode

E-Banking Fraud:

Yara detected Njrat

Show sources

Source: Yara match	File source: z2d6Yt5v.exe, type: SAMPLE
Source: Yara match	File source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.461812462.0000000002FB5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 6100, type: MEMORY
Source: Yara match	File source: Process Memory Space: z2d6Yt5v.exe PID: 6072, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4760, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4276, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4464, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED
Source: Yara match	File source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: z2d6Yt5v.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: z2d6Yt5v.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: z2d6Yt5v.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Code function: 2_2_02B31BBA NtQuerySystemInformation,
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Code function: 2_2_02B31B7F NtQuerySystemInformation,

Source: z2d6Yt5v.exe, 00000000.00000002.211502125.0000000004E50000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs z2d6Yt5v.exe
Source: z2d6Yt5v.exe, 00000000.00000002.211502125.0000000004E50000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs z2d6Yt5v.exe
Source: z2d6Yt5v.exe, 00000000.00000002.211523908.0000000004E80000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs z2d6Yt5v.exe

Source: z2d6Yt5v.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: z2d6Yt5v.exe, type: SAMPLE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: z2d6Yt5v.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@9/5@5/1

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Code function: 2_2_02B31606 AdjustTokenPrivileges,
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Code function: 2_2_02B315CF AdjustTokenPrivileges,

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\z2d6Yt5v.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1124:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Mutant created: \Sessions\1\BaseNamedObjects\af48625ee196d906557ab2d838a9cc2f

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

File created: C:\Users\user\AppData\Local\Temp\Core Service.exe

Jump to behavior

Source: z2d6Yt5v.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: z2d6Yt5v.exe	Virustotal: Detection: 84%
Source: z2d6Yt5v.exe	Metadefender: Detection: 89%

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

File read: C:\Users\user\Desktop\z2d6Yt5v.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\z2d6Yt5v.exe 'C:\Users\user\Desktop\z2d6Yt5v.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Core Service.exe 'C:\Users\user\AppData\Local\Temp\Core Service.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\Core Service.exe' 'Core Service.exe' ENABLE
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Core Service.exe 'C:\Users\user\AppData\Local\Temp\Core Service.exe' ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Core Service.exe 'C:\Users\user\AppData\Local\Temp\Core Service.exe' ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Core Service.exe 'C:\Users\user\AppData\Local\Temp\Core Service.exe' ..
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process created: C:\Users\user\AppData\Local\Temp\Core Service.exe 'C:\Users\user\AppData\Local\Temp\Core Service.exe'
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\Core Service.exe' 'Core Service.exe' ENABLE

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: z2d6Yt5v.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: z2d6Yt5v.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: z2d6Yt5v.exe, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: Core Service.exe.0.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: af48625ee196d906557ab2d838a9cc2f.exe.2.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.Core Service.exe.8b0000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.Core Service.exe.8b0000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.Core Service.exe.ec0000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.Core Service.exe.ec0000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.0.Core Service.exe.810000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 10.2.Core Service.exe.810000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 15.2.Core Service.exe.920000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 15.0.Core Service.exe.920000.0.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Code function: 0_2_005E5021 push cs; ret
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Code function: 2_2_008B5021 push cs; ret
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Code function: 7_2_00EC5021 push cs; ret
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Code function: 10_2_00815021 push cs; ret
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Code function: 15_2_00925021 push cs; ret

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe			Jump to dropped file
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	File created: C:\Users\user\AppData\Local\Temp\Core Service.exe			Jump to dropped file

Boot Survival:

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run af48625ee196d906557ab2d838a9cc2f

Jump to behavior

Drops PE files to the startup folder

Show sources

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run af48625ee196d906557ab2d838a9cc2f			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run af48625ee196d906557ab2d838a9cc2f			Jump to behavior

Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\z2d6Yt5v.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe

Window / User API: threadDelayed 6312

Source: C:\Users\user\Desktop\z2d6Yt5v.exe TID: 3984	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe TID: 5036	Thread sleep count: 6312 > 30
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe TID: 2308	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe TID: 2044	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe TID: 5372	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Core Service.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: Core Service.exe, 00000002.00000002.460157889.000000000103C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWdingCollectionE)
Source: Core Service.exe, 00000002.00000002.460157889.000000000103C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlliceFiltersSection, System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>
Source: Core Service.exe, 00000002.00000002.463422241.00000000056E0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: Core Service.exe, 00000002.00000002.463422241.00000000056E0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: Core Service.exe, 00000002.00000002.463422241.00000000056E0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: Core Service.exe, 00000002.00000002.463422241.00000000056E0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

.NET source code references suspicious native API functions

Show sources

Source: z2d6Yt5v.exe, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: z2d6Yt5v.exe, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: Core Service.exe.0.dr, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: Core Service.exe.0.dr, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: af48625ee196d906557ab2d838a9cc2f.exe.2.dr, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: af48625ee196d906557ab2d838a9cc2f.exe.2.dr, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 2.2.Core Service.exe.8b0000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 2.2.Core Service.exe.8b0000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 2.0.Core Service.exe.8b0000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 2.0.Core Service.exe.8b0000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 7.2.Core Service.exe.ec0000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 7.2.Core Service.exe.ec0000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 7.0.Core Service.exe.ec0000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 7.0.Core Service.exe.ec0000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 10.0.Core Service.exe.810000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 10.0.Core Service.exe.810000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 10.2.Core Service.exe.810000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 10.2.Core Service.exe.810000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 15.2.Core Service.exe.920000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 15.2.Core Service.exe.920000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 15.0.Core Service.exe.920000.0.unpack, OK.cs	Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 15.0.Core Service.exe.920000.0.unpack, kl.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')

Source: C:\Users\user\Desktop\z2d6Yt5v.exe

Process created: C:\Users\user\AppData\Local\Temp\Core Service.exe 'C:\Users\user\AppData\Local\Temp\Core Service.exe'

Source: Core Service.exe, 00000002.00000002.461812462.0000000002FB5000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: Core Service.exe, 00000002.00000002.460556158.00000000015F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Core Service.exe, 00000002.00000002.460556158.00000000015F0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Core Service.exe, 00000002.00000002.461812462.0000000002FB5000.00000004.00000001.sdmp	Binary or memory string: Program Manager\|9kr
Source: Core Service.exe, 00000002.00000002.460556158.00000000015F0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: Core Service.exe, 00000002.00000002.461812462.0000000002FB5000.00000004.00000001.sdmp	Binary or memory string: Program Manager<

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\Core Service.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies the windows firewall

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\Core Service.exe' 'Core Service.exe' ENABLE

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\Core Service.exe' 'Core Service.exe' ENABLE

Stealing of Sensitive Information:

Yara detected Njrat

Show sources

Source: Yara match	File source: z2d6Yt5v.exe, type: SAMPLE
Source: Yara match	File source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.461812462.0000000002FB5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 6100, type: MEMORY
Source: Yara match	File source: Process Memory Space: z2d6Yt5v.exe PID: 6072, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4760, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4276, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4464, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED
Source: Yara match	File source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected njRat

Show sources

Source: z2d6Yt5v.exe, OK.cs	.Net Code: njRat config detected
Source: Core Service.exe.0.dr, OK.cs	.Net Code: njRat config detected
Source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, OK.cs	.Net Code: njRat config detected
Source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, OK.cs	.Net Code: njRat config detected
Source: af48625ee196d906557ab2d838a9cc2f.exe.2.dr, OK.cs	.Net Code: njRat config detected
Source: 2.2.Core Service.exe.8b0000.0.unpack, OK.cs	.Net Code: njRat config detected
Source: 2.0.Core Service.exe.8b0000.0.unpack, OK.cs	.Net Code: njRat config detected
Source: 7.2.Core Service.exe.ec0000.0.unpack, OK.cs	.Net Code: njRat config detected
Source: 7.0.Core Service.exe.ec0000.0.unpack, OK.cs	.Net Code: njRat config detected
Source: 10.0.Core Service.exe.810000.0.unpack, OK.cs	.Net Code: njRat config detected
Source: 10.2.Core Service.exe.810000.0.unpack, OK.cs	.Net Code: njRat config detected
Source: 15.2.Core Service.exe.920000.0.unpack, OK.cs	.Net Code: njRat config detected
Source: 15.0.Core Service.exe.920000.0.unpack, OK.cs	.Net Code: njRat config detected

Yara detected Njrat

Show sources

Source: Yara match	File source: z2d6Yt5v.exe, type: SAMPLE
Source: Yara match	File source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.461812462.0000000002FB5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 6100, type: MEMORY
Source: Yara match	File source: Process Memory Space: z2d6Yt5v.exe PID: 6072, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4760, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4276, type: MEMORY
Source: Yara match	File source: Process Memory Space: Core Service.exe PID: 4464, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Core Service.exe, type: DROPPED
Source: Yara match	File source: 2.0.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.Core Service.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Core Service.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Core Service.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Core Service.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.z2d6Yt5v.exe.5e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.Core Service.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Core Service.exe.810000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Startup Items1	Startup Items1	Masquerading1	Input Capture1	Security Software Discovery111	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Non-Standard Port1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder221	Access Token Manipulation1	Virtualization/Sandbox Evasion3	LSASS Memory	Virtualization/Sandbox Evasion3	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Remote Access Software1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection12	Disable or Modify Tools21	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder221	Access Token Manipulation1	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection12	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information1	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing11	DCSync	System Information Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
z2d6Yt5v.exe	84%	Virustotal		Browse
z2d6Yt5v.exe	89%	Metadefender		Browse
z2d6Yt5v.exe	100%	Avira	TR/Dropper.Gen7
z2d6Yt5v.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Local\Temp\Core Service.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Core Service.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Core Service.exe	84%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\Core Service.exe	89%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\Core Service.exe	90%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	84%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	89%	Metadefender		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe	90%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi

Unpacked PE Files

Source	Detection	Scanner	Label	Download
15.2.Core Service.exe.920000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File
15.0.Core Service.exe.920000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File
7.2.Core Service.exe.ec0000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File
0.0.z2d6Yt5v.exe.5e0000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File
2.2.Core Service.exe.8b0000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File
2.0.Core Service.exe.8b0000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File
10.0.Core Service.exe.810000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File
7.0.Core Service.exe.ec0000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File
0.2.z2d6Yt5v.exe.5e0000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File
10.2.Core Service.exe.810000.0.unpack	100%	Avira	TR/Dropper.Gen7	Download File

Domains

Source	Detection	Scanner	Label	Link
noiphack93.hopto.org	1%	Virustotal		Browse

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
noiphack93.hopto.org	81.249.236.18	true	false	1%, Virustotal, Browse	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
81.249.236.18	unknown	France		3215	FranceTelecom-OrangeFR	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	321423
Start date:	22.11.2020
Start time:	00:39:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 7s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	z2d6Yt5v.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@9/5@5/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 2.1% (good quality ratio 1.9%) Quality average: 71% Quality standard deviation: 21.5%
HCA Information:	Successful, ratio: 98% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 104.43.139.144, 51.104.144.132, 92.122.144.200, 20.54.26.129, 8.253.204.249, 8.253.95.121, 8.248.131.254, 8.248.115.254, 8.253.204.120, 51.104.139.180, 92.122.213.194, 92.122.213.247 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, fs.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:40:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run af48625ee196d906557ab2d838a9cc2f "C:\Users\user\AppData\Local\Temp\Core Service.exe" ..
00:40:25	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run af48625ee196d906557ab2d838a9cc2f "C:\Users\user\AppData\Local\Temp\Core Service.exe" ..
00:40:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run af48625ee196d906557ab2d838a9cc2f "C:\Users\user\AppData\Local\Temp\Core Service.exe" ..
00:40:41	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
81.249.236.18	ErdS9XEU.exe	Get hash	malicious	Browse
81.249.236.18	rTay7rkg.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
FranceTelecom-OrangeFR	ErdS9XEU.exe	Get hash	malicious	Browse	81.249.236.18
	rTay7rkg.exe	Get hash	malicious	Browse	81.249.236.18
	http://cdn.webbrowserbase.com/Bins/ASPGenericWebNavigatorInstaller_2.3.0.14_x64.exe	Get hash	malicious	Browse	2.3.0.14
	qwhWqUYlnN.exe	Get hash	malicious	Browse	80.11.163.139
	https://boolatona.live/5214774454/	Get hash	malicious	Browse	80.12.40.169
	http://update2.control4.com/release/2.10.2.549842-res/glassedge-ota_2.10.2.549842-res.zip	Get hash	malicious	Browse	2.10.2.54
	http://download.imgburn.com/SetupImgBurn_2.5.8.0.exe	Get hash	malicious	Browse	2.5.8.0
	http://download.winzip.com/tools/winzip/releases/7fddd149-5a63-4dab-8e3f-ed9eae46d289_2.11.3.8/or/0/smartalertssetup.exe	Get hash	malicious	Browse	2.11.3.8
	newdat.ps1	Get hash	malicious	Browse	90.121.249.114
	FederalAgency.x86	Get hash	malicious	Browse	145.242.17.155
	https://download.wbxhub.com:443/cgi/adk/chrdl.cgi?wb_id=35781x-0F&iid=Webexplorer	Get hash	malicious	Browse	2.1.0.5

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Core Service.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\Core Service.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk7v:MLF20NaL3z2p29hJ5g522r0
MD5:	80EFBEC081D7836D240503C4C9465FEC
SHA1:	6AF398E08A359457083727BAF296445030A55AC3
SHA-256:	C73F730EB5E05D15FAD6BE10AB51FE4D8A80B5E88B89D8BC80CC1DF09ACE1523
SHA-512:	DEC3B1D9403894418AFD4433629CA6476C7BD359963328D17B93283B52EEC18B3725D2F02F0E9A142E705398DDDCE244D53829570E9DE1A87060A7DABFDCE5B3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\z2d6Yt5v.exe.log Download File
Process:	C:\Users\user\Desktop\z2d6Yt5v.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk7v:MLF20NaL3z2p29hJ5g522r0
MD5:	80EFBEC081D7836D240503C4C9465FEC
SHA1:	6AF398E08A359457083727BAF296445030A55AC3
SHA-256:	C73F730EB5E05D15FAD6BE10AB51FE4D8A80B5E88B89D8BC80CC1DF09ACE1523
SHA-512:	DEC3B1D9403894418AFD4433629CA6476C7BD359963328D17B93283B52EEC18B3725D2F02F0E9A142E705398DDDCE244D53829570E9DE1A87060A7DABFDCE5B3
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Core Service.exe Download File
Process:	C:\Users\user\Desktop\z2d6Yt5v.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.529551954242191
Encrypted:	false
SSDEEP:	384:FYmdk8XvCJrQLdRGSiEYF7Y65gPyx6BDXNRmRvR6JZlbw8hqIusZzZ/7oF2:6wWkti/aeRpcnu2N
MD5:	9BB6D4F72A348AD47CC97185604F4DD9
SHA1:	7384957E8A29F517654FCBD905861574E772D3ED
SHA-256:	0A170CA414D288BC25EBB5CE92CCD51FF0F62B1479D669172194BF0067601DF1
SHA-512:	3A1E4C94AFD24C89A256DECA640467C833547FE431C2041F3AFC6FAFDD3551F7D4F14EDFA5BE6099901D4BB38526FDFE197702DD334C74D98951887187CF2C48
Malicious:	true
Yara Hits:	Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, Author: Florian Roth Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 84%, Browse Antivirus: Metadefender, Detection: 89%, Browse Antivirus: ReversingLabs, Detection: 90%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_.................V...........t... ........@.. ....................................@.................................Lt..O.......@............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...@............X..............@..@.reloc...............\..............@..B.................t......H.......,K.. )....../....................................................0..........r...p.....r...p...........r%..p.....rG..p.....rQ..p.....r...p.....r...p.....r...p.....r...p(.........r...p(.........r...p(.........r...p(.........(....o....s.........s.....................r...p...........s......... ..............rE..p..............0..;.......~....o....o....rG..p~....(.....o.....o......%(.....(...............,,.......0..D.......~....o....o....rG..p~....(....o......(....o.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\Core Service.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.529551954242191
Encrypted:	false
SSDEEP:	384:FYmdk8XvCJrQLdRGSiEYF7Y65gPyx6BDXNRmRvR6JZlbw8hqIusZzZ/7oF2:6wWkti/aeRpcnu2N
MD5:	9BB6D4F72A348AD47CC97185604F4DD9
SHA1:	7384957E8A29F517654FCBD905861574E772D3ED
SHA-256:	0A170CA414D288BC25EBB5CE92CCD51FF0F62B1479D669172194BF0067601DF1
SHA-512:	3A1E4C94AFD24C89A256DECA640467C833547FE431C2041F3AFC6FAFDD3551F7D4F14EDFA5BE6099901D4BB38526FDFE197702DD334C74D98951887187CF2C48
Malicious:	true
Yara Hits:	Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, Author: Florian Roth Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af48625ee196d906557ab2d838a9cc2f.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 84%, Browse Antivirus: Metadefender, Detection: 89%, Browse Antivirus: ReversingLabs, Detection: 90%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_.................V...........t... ........@.. ....................................@.................................Lt..O.......@............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...@............X..............@..@.reloc...............\..............@..B.................t......H.......,K.. )....../....................................................0..........r...p.....r...p...........r%..p.....rG..p.....rQ..p.....r...p.....r...p.....r...p.....r...p(.........r...p(.........r...p(.........r...p(.........(....o....s.........s.....................r...p...........s......... ..............rE..p..............0..;.......~....o....o....rG..p~....(.....o.....o......%(.....(...............,,.......0..D.......~....o....o....rG..p~....(....o......(....o.....

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.529551954242191
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	z2d6Yt5v.exe
File size:	24064
MD5:	9bb6d4f72a348ad47cc97185604f4dd9
SHA1:	7384957e8a29f517654fcbd905861574e772d3ed
SHA256:	0a170ca414d288bc25ebb5ce92ccd51ff0f62b1479d669172194bf0067601df1
SHA512:	3a1e4c94afd24c89a256deca640467c833547fe431c2041f3afc6fafdd3551f7d4f14edfa5be6099901d4bb38526fdfe197702dd334c74d98951887187cf2c48
SSDEEP:	384:FYmdk8XvCJrQLdRGSiEYF7Y65gPyx6BDXNRmRvR6JZlbw8hqIusZzZ/7oF2:6wWkti/aeRpcnu2N
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_.................V...........t... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x40749e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5FB99AA1 [Sat Nov 21 22:54:25 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x744c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x240	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x54a4	0x5600	False	0.490098110465	data	5.57654676439	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x240	0x400	False	0.310546875	data	4.9660813397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x200	False	0.044921875	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x8058	0x1e7	XML 1.0 document, ASCII text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2020 00:40:17.890508890 CET	49722	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:40:20.973413944 CET	49722	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:40:26.973902941 CET	49722	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:40:41.291666985 CET	49730	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:40:44.303378105 CET	49730	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:40:50.319463968 CET	49730	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:41:04.526819944 CET	49740	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:41:07.541851044 CET	49740	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:41:13.558038950 CET	49740	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:41:27.847527981 CET	49741	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:41:30.856450081 CET	49741	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:41:36.856708050 CET	49741	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:41:51.167507887 CET	49744	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:41:54.170566082 CET	49744	5553	192.168.2.3	81.249.236.18
Nov 22, 2020 00:42:00.186686039 CET	49744	5553	192.168.2.3	81.249.236.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2020 00:39:54.824812889 CET	60100	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:39:54.852051020 CET	53	60100	8.8.8.8	192.168.2.3
Nov 22, 2020 00:39:55.577775955 CET	53195	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:39:55.605178118 CET	53	53195	8.8.8.8	192.168.2.3
Nov 22, 2020 00:39:56.278990984 CET	50141	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:39:56.306338072 CET	53	50141	8.8.8.8	192.168.2.3
Nov 22, 2020 00:39:57.062254906 CET	53023	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:39:57.098078966 CET	53	53023	8.8.8.8	192.168.2.3
Nov 22, 2020 00:39:58.065080881 CET	49563	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:39:58.100954056 CET	53	49563	8.8.8.8	192.168.2.3
Nov 22, 2020 00:39:58.990433931 CET	51352	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:39:59.017735958 CET	53	51352	8.8.8.8	192.168.2.3
Nov 22, 2020 00:39:59.719111919 CET	59349	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:39:59.755022049 CET	53	59349	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:01.396975040 CET	57084	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:01.432693958 CET	53	57084	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:02.044631958 CET	58823	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:02.071861982 CET	53	58823	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:17.847650051 CET	57568	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:17.885140896 CET	53	57568	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:20.254879951 CET	50540	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:20.282639980 CET	53	50540	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:32.367813110 CET	54366	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:32.424653053 CET	53	54366	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:35.789303064 CET	53034	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:35.842669964 CET	53	53034	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:41.250149965 CET	57762	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:41.287931919 CET	53	57762	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:43.834106922 CET	55435	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:43.861291885 CET	53	55435	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:54.670659065 CET	50713	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:54.697799921 CET	53	50713	8.8.8.8	192.168.2.3
Nov 22, 2020 00:40:58.006330013 CET	56132	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:40:58.043577909 CET	53	56132	8.8.8.8	192.168.2.3
Nov 22, 2020 00:41:04.489526987 CET	58987	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:41:04.525306940 CET	53	58987	8.8.8.8	192.168.2.3
Nov 22, 2020 00:41:27.808214903 CET	56579	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:41:27.845371962 CET	53	56579	8.8.8.8	192.168.2.3
Nov 22, 2020 00:41:28.968875885 CET	60633	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:41:28.996134043 CET	53	60633	8.8.8.8	192.168.2.3
Nov 22, 2020 00:41:30.149065971 CET	61292	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:41:30.199475050 CET	53	61292	8.8.8.8	192.168.2.3
Nov 22, 2020 00:41:51.128329992 CET	63619	53	192.168.2.3	8.8.8.8
Nov 22, 2020 00:41:51.164169073 CET	53	63619	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 22, 2020 00:40:17.847650051 CET	192.168.2.3	8.8.8.8	0x9347	Standard query (0)	noiphack93.hopto.org	A (IP address)	IN (0x0001)
Nov 22, 2020 00:40:41.250149965 CET	192.168.2.3	8.8.8.8	0xc086	Standard query (0)	noiphack93.hopto.org	A (IP address)	IN (0x0001)
Nov 22, 2020 00:41:04.489526987 CET	192.168.2.3	8.8.8.8	0x2762	Standard query (0)	noiphack93.hopto.org	A (IP address)	IN (0x0001)
Nov 22, 2020 00:41:27.808214903 CET	192.168.2.3	8.8.8.8	0x10f1	Standard query (0)	noiphack93.hopto.org	A (IP address)	IN (0x0001)
Nov 22, 2020 00:41:51.128329992 CET	192.168.2.3	8.8.8.8	0x23dd	Standard query (0)	noiphack93.hopto.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Nov 22, 2020 00:40:17.885140896 CET	8.8.8.8	192.168.2.3	0x9347	No error (0)	noiphack93.hopto.org	81.249.236.18	A (IP address)	IN (0x0001)
Nov 22, 2020 00:40:41.287931919 CET	8.8.8.8	192.168.2.3	0xc086	No error (0)	noiphack93.hopto.org	81.249.236.18	A (IP address)	IN (0x0001)
Nov 22, 2020 00:41:04.525306940 CET	8.8.8.8	192.168.2.3	0x2762	No error (0)	noiphack93.hopto.org	81.249.236.18	A (IP address)	IN (0x0001)
Nov 22, 2020 00:41:27.845371962 CET	8.8.8.8	192.168.2.3	0x10f1	No error (0)	noiphack93.hopto.org	81.249.236.18	A (IP address)	IN (0x0001)
Nov 22, 2020 00:41:51.164169073 CET	8.8.8.8	192.168.2.3	0x23dd	No error (0)	noiphack93.hopto.org	81.249.236.18	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: z2d6Yt5v.exe PID: 6072 Parent PID: 5620

General

Start time:	00:39:59
Start date:	22/11/2020
Path:	C:\Users\user\Desktop\z2d6Yt5v.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\z2d6Yt5v.exe'
Imagebase:	0x5e0000
File size:	24064 bytes
MD5 hash:	9BB6D4F72A348AD47CC97185604F4DD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.210341722.00000000005E2000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.211371973.0000000002C85000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.194561361.00000000005E2000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: Core Service.exe PID: 4464 Parent PID: 6072

General

Start time:	00:40:06
Start date:	22/11/2020
Path:	C:\Users\user\AppData\Local\Temp\Core Service.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\Core Service.exe'
Imagebase:	0x8b0000
File size:	24064 bytes
MD5 hash:	9BB6D4F72A348AD47CC97185604F4DD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000002.00000002.459233753.00000000008B2000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000002.00000000.210200221.00000000008B2000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000002.00000002.461812462.0000000002FB5000.00000004.00000001.sdmp, Author: Joe Security Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, Author: Florian Roth Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\Core Service.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, Virustotal, Browse Detection: 89%, Metadefender, Browse Detection: 90%, ReversingLabs
Reputation:	low

Analysis Process: netsh.exe PID: 5416 Parent PID: 4464

General

Start time:	00:40:14
Start date:	22/11/2020
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram 'C:\Users\user\AppData\Local\Temp\Core Service.exe' 'Core Service.exe' ENABLE
Imagebase:	0xd90000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 1124 Parent PID: 5416

General

Start time:	00:40:14
Start date:	22/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: Core Service.exe PID: 4276 Parent PID: 3388

General

Start time:	00:40:25
Start date:	22/11/2020
Path:	C:\Users\user\AppData\Local\Temp\Core Service.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\Core Service.exe' ..
Imagebase:	0xec0000
File size:	24064 bytes
MD5 hash:	9BB6D4F72A348AD47CC97185604F4DD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000007.00000002.260704512.0000000000EC2000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000007.00000000.249387017.0000000000EC2000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: Core Service.exe PID: 4760 Parent PID: 3388

General

Start time:	00:40:33
Start date:	22/11/2020
Path:	C:\Users\user\AppData\Local\Temp\Core Service.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\Core Service.exe' ..
Imagebase:	0x810000
File size:	24064 bytes
MD5 hash:	9BB6D4F72A348AD47CC97185604F4DD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 0000000A.00000000.267967586.0000000000812000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 0000000A.00000002.279339449.0000000000812000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: Core Service.exe PID: 6100 Parent PID: 3388

General

Start time:	00:40:41
Start date:	22/11/2020
Path:	C:\Users\user\AppData\Local\Temp\Core Service.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\Core Service.exe' ..
Imagebase:	0x920000
File size:	24064 bytes
MD5 hash:	9BB6D4F72A348AD47CC97185604F4DD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 0000000F.00000002.296934602.0000000000922000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, Author: Joe Security Rule: njrat1, Description: Identify njRat, Source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 0000000F.00000000.285488818.0000000000922000.00000002.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report z2d6Yt5v.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations