Windows Analysis Report
itVg5XA6eK.exe

Overview

General Information

Sample Name: itVg5XA6eK.exe
Analysis ID: 753416
MD5: 8533ef6f79e259e9e5fe7c28f1fcd372
SHA1: 48c1f9b2a798a374b6e8c2e5fb655c19e5fa2ed3
SHA256: bbc8cabc1ba4f81d1ee316d3869ed8e61c91840cb533abee708a3099ab196470
Tags: exenjratRAT
Infos:

Detection

njRat
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Detected njRat
Malicious sample detected (through community Yara rule)
Yara detected Njrat
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Uses netsh to modify the Windows network and firewall settings
Drops PE files to the startup folder
Protects its processes via BreakOnTermination flag
.NET source code references suspicious native API functions
Contains functionality to log keystrokes (.Net Source)
Machine Learning detection for sample
.NET source code contains potential unpacker
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious names
Modifies the windows firewall
Uses dynamic DNS services
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Drops PE files to the application program directory (C:\ProgramData)
May sleep (evasive loops) to hinder dynamic analysis
Internet Provider seen in connection with other malware
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection

barindex
Source: itVg5XA6eK.exe ReversingLabs: Detection: 100%
Source: itVg5XA6eK.exe Virustotal: Detection: 76% Perma Link
Source: Yara match File source: itVg5XA6eK.exe, type: SAMPLE
Source: Yara match File source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.507753585.0000000002965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: itVg5XA6eK.exe PID: 6104, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rejdit_free_fire.exe PID: 1852, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED
Source: itVg5XA6eK.exe Avira: detected
Source: h43vipforyou.ddns.net Avira URL Cloud: Label: malware
Source: h43vipforyou.ddns.net Virustotal: Detection: 9% Perma Link
Source: h43vipforyou.ddns.net Virustotal: Detection: 9% Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\ProgramData\rejdit_free_fire.exe Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\ProgramData\rejdit_free_fire.exe ReversingLabs: Detection: 100%
Source: C:\ProgramData\rejdit_free_fire.exe Virustotal: Detection: 76% Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe Virustotal: Detection: 76% Perma Link
Source: itVg5XA6eK.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe Joe Sandbox ML: detected
Source: C:\ProgramData\rejdit_free_fire.exe Joe Sandbox ML: detected
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack Avira: Label: TR/Dropper.Gen7
Source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Njrat {"Host": "h43vipforyou.ddns.net", "Port": "1177", "Version": "0.7d", "Campaign ID": "HacKed", "Install Name": "rejdit_free_fire.exe", "Install Dir": "AllUsersProfile", "Network Seprator": "|'|'|"}
Source: itVg5XA6eK.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\itVg5XA6eK.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: itVg5XA6eK.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

barindex
Source: Traffic Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.3:49699 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.3:49699 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.3:49699 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.3:49699 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.3:49699 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.3:49700 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.3:49700 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.3:49700 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.3:49700 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.3:49700 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.3:49701 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.3:49701 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.3:49701 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.3:49701 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.3:49701 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.3:49702 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.3:49702 -> 41.109.68.239:1177
Source: Traffic Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.3:49702 -> 41.109.68.239:1177
Source: Malware configuration extractor URLs: h43vipforyou.ddns.net
Source: unknown DNS query: name: h43vipforyou.ddns.net
Source: Joe Sandbox View ASN Name: ALGTEL-ASDZ ALGTEL-ASDZ
Source: global traffic TCP traffic: 192.168.2.3:49699 -> 41.109.68.239:1177
Source: unknown DNS traffic detected: queries for: h43vipforyou.ddns.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

barindex
Source: itVg5XA6eK.exe, kl.cs .Net Code: VKCodeToUnicode
Source: rejdit_free_fire.exe.0.dr, kl.cs .Net Code: VKCodeToUnicode
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, kl.cs .Net Code: VKCodeToUnicode
Source: 869b16e2825dce24066aba38ee1a9add.exe.1.dr, kl.cs .Net Code: VKCodeToUnicode
Source: rejdit_free_fire.exe, 00000001.00000002.505779349.000000000070A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

barindex
Source: Yara match File source: itVg5XA6eK.exe, type: SAMPLE
Source: Yara match File source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.507753585.0000000002965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: itVg5XA6eK.exe PID: 6104, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rejdit_free_fire.exe PID: 1852, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED

Operating System Destruction

barindex
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: 01 00 00 00 Jump to behavior

System Summary

barindex
Source: itVg5XA6eK.exe, type: SAMPLE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: itVg5XA6eK.exe, type: SAMPLE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: itVg5XA6eK.exe, type: SAMPLE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: itVg5XA6eK.exe, type: SAMPLE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: itVg5XA6eK.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: itVg5XA6eK.exe, type: SAMPLE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: itVg5XA6eK.exe, type: SAMPLE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: itVg5XA6eK.exe, type: SAMPLE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: itVg5XA6eK.exe, type: SAMPLE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: itVg5XA6eK.exe ReversingLabs: Detection: 100%
Source: itVg5XA6eK.exe Virustotal: Detection: 76%
Source: C:\Users\user\Desktop\itVg5XA6eK.exe File read: C:\Users\user\Desktop\itVg5XA6eK.exe Jump to behavior
Source: itVg5XA6eK.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\itVg5XA6eK.exe C:\Users\user\Desktop\itVg5XA6eK.exe
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process created: C:\ProgramData\rejdit_free_fire.exe "C:\ProgramData\rejdit_free_fire.exe"
Source: C:\ProgramData\rejdit_free_fire.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\ProgramData\rejdit_free_fire.exe" "rejdit_free_fire.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\rejdit_free_fire.exe "C:\ProgramData\rejdit_free_fire.exe" ..
Source: unknown Process created: C:\ProgramData\rejdit_free_fire.exe "C:\ProgramData\rejdit_free_fire.exe" ..
Source: unknown Process created: C:\ProgramData\rejdit_free_fire.exe "C:\ProgramData\rejdit_free_fire.exe" ..
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process created: C:\ProgramData\rejdit_free_fire.exe "C:\ProgramData\rejdit_free_fire.exe" Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\ProgramData\rejdit_free_fire.exe" "rejdit_free_fire.exe" ENABLE Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\itVg5XA6eK.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.adwa.spyw.evad.winEXE@9/5@4/1
Source: C:\Users\user\Desktop\itVg5XA6eK.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: itVg5XA6eK.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Mutant created: \Sessions\1\BaseNamedObjects\869b16e2825dce24066aba38ee1a9add
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:732:120:WilError_01
Source: C:\ProgramData\rejdit_free_fire.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: itVg5XA6eK.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: itVg5XA6eK.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

barindex
Source: itVg5XA6eK.exe, OK.cs .Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: rejdit_free_fire.exe.0.dr, OK.cs .Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, OK.cs .Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 869b16e2825dce24066aba38ee1a9add.exe.1.dr, OK.cs .Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: C:\Users\user\Desktop\itVg5XA6eK.exe File created: C:\ProgramData\rejdit_free_fire.exe Jump to dropped file
Source: C:\Users\user\Desktop\itVg5XA6eK.exe File created: C:\ProgramData\rejdit_free_fire.exe Jump to dropped file
Source: C:\ProgramData\rejdit_free_fire.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe Jump to dropped file

Boot Survival

barindex
Source: C:\ProgramData\rejdit_free_fire.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe Jump to dropped file
Source: C:\ProgramData\rejdit_free_fire.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 869b16e2825dce24066aba38ee1a9add Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 869b16e2825dce24066aba38ee1a9add Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 869b16e2825dce24066aba38ee1a9add Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe TID: 6112 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe TID: 2148 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe TID: 1760 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe TID: 3508 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Window / User API: threadDelayed 5692 Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: rejdit_free_fire.exe, 00000001.00000002.506101970.000000000073B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\ProgramData\rejdit_free_fire.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Source: itVg5XA6eK.exe, OK.cs Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: itVg5XA6eK.exe, kl.cs Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: rejdit_free_fire.exe.0.dr, OK.cs Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: rejdit_free_fire.exe.0.dr, kl.cs Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, OK.cs Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, kl.cs Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: 869b16e2825dce24066aba38ee1a9add.exe.1.dr, OK.cs Reference to suspicious API methods: ('capGetDriverDescriptionA', 'capGetDriverDescriptionA@avicap32.dll')
Source: 869b16e2825dce24066aba38ee1a9add.exe.1.dr, kl.cs Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll'), ('GetAsyncKeyState', 'GetAsyncKeyState@user32')
Source: C:\Users\user\Desktop\itVg5XA6eK.exe Process created: C:\ProgramData\rejdit_free_fire.exe "C:\ProgramData\rejdit_free_fire.exe" Jump to behavior
Source: rejdit_free_fire.exe, 00000001.00000002.509172881.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, rejdit_free_fire.exe, 00000001.00000002.507753585.0000000002965000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: rejdit_free_fire.exe, 00000001.00000002.509172881.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, rejdit_free_fire.exe, 00000001.00000002.507753585.0000000002965000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager|9
Source: rejdit_free_fire.exe, 00000001.00000002.509172881.0000000002A96000.00000004.00000800.00020000.00000000.sdmp, rejdit_free_fire.exe, 00000001.00000002.507753585.0000000002965000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager<
Source: C:\ProgramData\rejdit_free_fire.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\rejdit_free_fire.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Source: C:\ProgramData\rejdit_free_fire.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\ProgramData\rejdit_free_fire.exe" "rejdit_free_fire.exe" ENABLE
Source: C:\ProgramData\rejdit_free_fire.exe Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\ProgramData\rejdit_free_fire.exe" "rejdit_free_fire.exe" ENABLE

Stealing of Sensitive Information

barindex
Source: Yara match File source: itVg5XA6eK.exe, type: SAMPLE
Source: Yara match File source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.507753585.0000000002965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: itVg5XA6eK.exe PID: 6104, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rejdit_free_fire.exe PID: 1852, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED

Remote Access Functionality

barindex
Source: itVg5XA6eK.exe, OK.cs .Net Code: njRat config detected
Source: rejdit_free_fire.exe.0.dr, OK.cs .Net Code: njRat config detected
Source: 0.0.itVg5XA6eK.exe.440000.0.unpack, OK.cs .Net Code: njRat config detected
Source: 869b16e2825dce24066aba38ee1a9add.exe.1.dr, OK.cs .Net Code: njRat config detected
Source: Yara match File source: itVg5XA6eK.exe, type: SAMPLE
Source: Yara match File source: 0.2.itVg5XA6eK.exe.3ab6df0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.itVg5XA6eK.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.itVg5XA6eK.exe.3ab6df0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.255333528.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.239853870.0000000000442000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.507753585.0000000002965000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: itVg5XA6eK.exe PID: 6104, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rejdit_free_fire.exe PID: 1852, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\rejdit_free_fire.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\869b16e2825dce24066aba38ee1a9add.exe, type: DROPPED