Windows Analysis Report sFau6gAKEk.exe

ID:	491718
Product:	CloudBasic
Start time:	20:35:32
Start date:	27.09.2021
Sample:	sFau6gAKEk.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	3441a429a71ac1ad6e910efdd06cacd3
SHA1:	d4f2ab9a718b2da7c4b1d1863dbc6a83b3e29264
SHA256:	d3763d5c2317a279fc6ffce59700fb96f10570178d81c01a912db7b17811798c
Filetype:	Win64 Executable GUI Net Framework (217006/5) 49.88%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Found malware configuration

Source: 0.2.sFau6gAKEk.exe.1850000.1.raw.unpack

Malware Configuration Extractor: Njrat {"Host": "strigoo.duckdns.org", "Port": "9889", "Mutex Name": "aed1603e66c64f9fafe", "Network Seprator": "@!#&^%$", "Campaign ID": "NYAN CAT", "Version": "0.7NC"}

Multi AV Scanner detection for submitted file

Source: sFau6gAKEk.exe	Virustotal: Detection: 50%			Perma Link
Source: sFau6gAKEk.exe	ReversingLabs: Detection: 33%

Yara detected Njrat

Source: Yara match

File source: Process Memory Space: sFau6gAKEk.exe PID: 5200, type: MEMORYSTR

Compliance:

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: sFau6gAKEk.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: C:\Users\user\source\repos\pump1000\pump1000\obj\Debug\pump1000.pdb source: sFau6gAKEk.exe, 00000000.00000002.515359849.000000001CA19000.00000004.00020000.sdmp

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49748 -> 181.141.1.250:9889

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: strigoo.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: strigoo.duckdns.org

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.5:49748 -> 181.141.1.250:9889

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: EPMTelecomunicacionesSAESPCO EPMTelecomunicacionesSAESPCO

URLs found in memory or binary data

Source: sFau6gAKEk.exe, 00000000.00000002.513438487.0000000003D92000.00000004.00000001.sdmp	String found in binary or memory: https://19a35f0c-6367-45ec-aec7-f047bc9f0ebe.com
Source: sFau6gAKEk.exe, 00000000.00000002.513438487.0000000003D92000.00000004.00000001.sdmp	String found in binary or memory: https://19a35f0c-6367-45ec-aec7-f047bc9f0ebe.com(

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: strigoo.duckdns.org

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to retrieve information about pressed keystrokes

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

Code function: 0_2_00007FFA167B9E4A GetAsyncKeyState,

0_2_00007FFA167B9E4A

E-Banking Fraud:

Yara detected Njrat

Source: Yara match

File source: Process Memory Space: sFau6gAKEk.exe PID: 5200, type: MEMORYSTR

System Summary:

PE file does not import any functions

Source: sFau6gAKEk.exe

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: sFau6gAKEk.exe, 00000000.00000002.511842194.000000000176A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs sFau6gAKEk.exe
Source: sFau6gAKEk.exe, 00000000.00000002.515359849.000000001CA19000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenamepump1000.exe2 vs sFau6gAKEk.exe
Source: sFau6gAKEk.exe, 00000000.00000002.515359849.000000001CA19000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenametiny_runpe.dll6 vs sFau6gAKEk.exe
Source: sFau6gAKEk.exe, 00000000.00000002.515359849.000000001CA19000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameSxLYSyDf.exe4 vs sFau6gAKEk.exe
Source: sFau6gAKEk.exe, 00000000.00000002.513438487.0000000003D92000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameClient9889.exe4 vs sFau6gAKEk.exe
Source: sFau6gAKEk.exe, 00000000.00000002.511405225.0000000000F06000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenametlaqBuoRv.exe, vs sFau6gAKEk.exe
Source: sFau6gAKEk.exe	Binary or memory string: OriginalFilenametlaqBuoRv.exe, vs sFau6gAKEk.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167BAB6A		0_2_00007FFA167BAB6A
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167BA43E		0_2_00007FFA167BA43E
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167BE816		0_2_00007FFA167BE816
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167BF5C2		0_2_00007FFA167BF5C2
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167B1447		0_2_00007FFA167B1447
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167B149F		0_2_00007FFA167B149F
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167B2A8A		0_2_00007FFA167B2A8A
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167B29FD		0_2_00007FFA167B29FD

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: sFau6gAKEk.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Sample is known by Antivirus

Source: sFau6gAKEk.exe	Virustotal: Detection: 50%
Source: sFau6gAKEk.exe	ReversingLabs: Detection: 33%

PE file has an executable .text section and no other executable section

Source: sFau6gAKEk.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Creates mutexes

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

Mutant created: \Sessions\1\BaseNamedObjects\aed1603e66c64f9fafe

Classification label

Source: classification engine

Classification label: mal80.troj.winEXE@1/0@1/1

Reads the hosts file

Source: C:\Users\user\Desktop\sFau6gAKEk.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

PE file has a high image base, often used for DLLs

Source: sFau6gAKEk.exe

Static PE information: Image base 0x140000000 > 0x60000000

PE file contains a COM descriptor data directory

Source: sFau6gAKEk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: sFau6gAKEk.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: C:\Users\user\source\repos\pump1000\pump1000\obj\Debug\pump1000.pdb source: sFau6gAKEk.exe, 00000000.00000002.515359849.000000001CA19000.00000004.00020000.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167B3271 push ds; retf		0_2_00007FFA167B3272
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Code function: 0_2_00007FFA167B31DB push edi; retf		0_2_00007FFA167B31DE

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.61141443582

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

Window / User API: threadDelayed 6931

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\sFau6gAKEk.exe TID: 3976	Thread sleep count: 78 > 30			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe TID: 3976	Thread sleep time: -78000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe TID: 5116	Thread sleep count: 6931 > 30			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe TID: 6132	Thread sleep count: 31 > 30			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe TID: 6132	Thread sleep time: -31000s >= -30000s			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: sFau6gAKEk.exe, 00000000.00000002.515527260.000000001DB71000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllP

Anti Debugging:

Enables debug privileges

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

Process token adjusted: Debug

Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: sFau6gAKEk.exe, 00000000.00000002.513513095.0000000003DA7000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: sFau6gAKEk.exe, 00000000.00000002.513024357.0000000002570000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: sFau6gAKEk.exe, 00000000.00000002.513024357.0000000002570000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: sFau6gAKEk.exe, 00000000.00000002.513024357.0000000002570000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: sFau6gAKEk.exe, 00000000.00000002.513024357.0000000002570000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: sFau6gAKEk.exe, 00000000.00000002.513024357.0000000002570000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Queries volume information: C:\Users\user\Desktop\sFau6gAKEk.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\sFau6gAKEk.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\sFau6gAKEk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Njrat

Source: Yara match

File source: Process Memory Space: sFau6gAKEk.exe PID: 5200, type: MEMORYSTR

Remote Access Functionality:

Yara detected Njrat

Source: Yara match

File source: Process Memory Space: sFau6gAKEk.exe PID: 5200, type: MEMORYSTR