Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

SecuriteInfo.com.MSIL.Kryptik.AECS.24576.msi

Status: finished
Submission Time: 2022-01-29 00:10:15 +01:00
Malicious
Trojan
Exploiter
Evader
Njrat

Comments

Tags

  • msi
  • njrat

Details

  • Analysis ID:
    562521
  • API (Web) ID:
    930043
  • Analysis Started:
    2022-01-29 00:10:18 +01:00
  • Analysis Finished:
    2022-01-29 00:22:14 +01:00
  • MD5:
    1d59589778c525aadcb645270cee737c
  • SHA1:
    ad4584c1b7734854939c59674cbbf22a99618285
  • SHA256:
    1f95063441e9d231e0e2b15365a8722c5136c2a6fe2716f3653c260093026354
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

Open Full Report
malicious
Score: 11/69

IPs

IP Country Detection
66.154.111.162
 Canada

Domains

Name IP Detection
njlove.duckdns.org
 66.154.111.162

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\MW-71322570-7008-46b5-bb73-77098af1b752\files\02f017f8dcfd4885887fe1ceb996bbc7$dpx$.tmp\cfa11b188d32074992aa4060114f8638.tmp
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\MW-71322570-7008-46b5-bb73-77098af1b752\files\server.exe (copy)
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Windows\Temp\~DF6CC46065D10C7A25.TMP
 data
 #
Click to see the 28 hidden entries
C:\Windows\System32\MsDtc\Trace\dtctrace.log
 data
 #
C:\Windows\Temp\~DF03391F73031C0A34.TMP
 data
 #
C:\Windows\Temp\~DF22D398DA2AC0F842.TMP
 data
 #
C:\Windows\Temp\~DF25DC81189B88B007.TMP
 data
 #
C:\Windows\Temp\~DF4B4630A3D90165FC.TMP
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Temp\~DF51AB674798AB773E.TMP
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Temp\~DF580A4C0E4BCBE8F6.TMP
 data
 #
C:\Windows\Temp\~DF5D4C48B55B4BFC19.TMP
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Logs\DPX\setupact.log
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Windows\Temp\~DFB5C2126B1B76E891.TMP
 data
 #
C:\Windows\Temp\~DFC6CBD75861280262.TMP
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Temp\~DFCF309A9E155014E3.TMP
 data
 #
C:\Windows\Temp\~DFFCD8D26BF9AB481A.TMP
 Composite Document File V2 Document, Cannot read section info
 #
\Device\ConDrv
 ASCII text, with CRLF, LF line terminators
 #
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
 UTF-8 Unicode (with BOM) text, with CRLF line terminators
 #
C:\Config.Msi\6537bf.rbs
 data
 #
C:\Windows\Installer\inprogressinstallinfo.ipi
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Installer\SourceHash{8291D67C-2E0B-4E71-B034-09AFE03383E8}
 Composite Document File V2 Document, Cannot read section info
 #
C:\Windows\Installer\MSIBF62.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Installer\MSIAA7F.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Installer\MSIAA7E.tmp
 data
 #
C:\Windows\Installer\MSI3B77.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Windows\Installer\6537c0.msi
 Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Microsoft Visual Studio - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 16.6.255.35071, Subject: Microsoft Visual Stud (…)
 #
C:\Windows\Installer\6537be.msi
 Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Microsoft Visual Studio - UNREGISTERED - Wrapped using MSI Wrapper from www.exemsi.com 16.6.255.35071, Subject: Microsoft Visual Stud (…)
 #
C:\Users\user\AppData\Local\Temp\MW-71322570-7008-46b5-bb73-77098af1b752\msiwrapper.ini
 data
 #
C:\Users\user\AppData\Local\Temp\MW-71322570-7008-46b5-bb73-77098af1b752\files.cab
 Microsoft Cabinet archive data, 669935 bytes, 1 file
 #
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\server.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
 ASCII text, with CRLF line terminators
 #