popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

svchost.exe

backdoor njRAT
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 10, 2021, 8:50 a.m. April 10, 2021, 8:54 a.m.
Size 23.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 fb002bdf8ca98dc1b9c6c27e9f4a9eed
SHA256 595b0995ee464451d30bce4f097b4c47ec615a21bac069a14034cc6d1c5acf6c
CRC32 C808C184
ssdeep 384:ITWSEFDn65Egj6RGiYCINTY6xgXakh2oZDJmRvR6JZlbw8hqIusZzZ+4:gm7OM9YX0MRpcnuA
Yara
  • keylogger - Run a keylogger
  • Win_Backdoor_njRAT_Zero - Win Backdoor njRAT
  • PE_Header_Zero - PE File Signature Zero
  • IsPE32 - (no description)
  • IsNET_EXE - (no description)
  • IsWindowsGUI - (no description)

Name Response Post-Analysis Lookup
niogem117.soon.it
A 193.218.118.85
193.218.118.85
IP Address Status Action
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
193.218.118.85 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleA

 buffer: IMPORTANT: Command executed successfully. However, "netsh firewall" is deprecated; use "netsh advfirewall firewall" instead. For more information on using "netsh advfirewall firewall" commands instead of "netsh firewall", see KB article 947709 at http://go.microsoft.com/fwlink/?linkid=121488 .
console_handle: 0x00000007
1 1 0

WriteConsoleA

 buffer: Ok.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00630000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fc91000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3204
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6fc92000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00442000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00452000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00453000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00487000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00770000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00454000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00455000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00456000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0047a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00472000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 3204
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\svchost.exe
cmdline C:\Users\test22\AppData\Roaming\svchost.exe
cmdline "C:\Users\test22\AppData\Roaming\svchost.exe"
file C:\Users\test22\AppData\Roaming\svchost.exe
file C:\Users\test22\AppData\Roaming\svchost.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1472
thread_handle: 0x00000358
process_identifier: 7400
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Roaming\svchost.exe
track: 1
command_line: "C:\Users\test22\AppData\Roaming\svchost.exe"
filepath_r: C:\Users\test22\AppData\Roaming\svchost.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000360
1 1 0

ShellExecuteExW

 show_type: 1
filepath_r: C:\Users\test22\AppData\Roaming\svchost.exe
parameters:
filepath: C:\Users\test22\AppData\Roaming\svchost.exe
1 1 0
host 172.217.25.14
dead_host 193.218.118.85:11061
Bkav W32.FamVT.binANHb.Worm
Elastic malicious (high confidence)
DrWeb BackDoor.Bladabindi.13678
MicroWorld-eScan Generic.MSIL.Bladabindi.3CAC55E6
FireEye Generic.mg.fb002bdf8ca98dc1
CAT-QuickHeal Backdoor.Bladabindi.AL3
McAfee Trojan-FIGN
Cylance Unsafe
Zillya Trojan.Disfa.Win32.10621
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 700000121 )
BitDefender Generic.MSIL.Bladabindi.3CAC55E6
K7GW Trojan ( 700000121 )
Cybereason malicious.f8ca98
BitDefenderTheta Gen:NN.ZemsilF.34670.bmW@aK2nMpp
Cyren W32/MSIL_Bladabindi.AU.gen!Eldorado
Symantec Backdoor.Ratenjay
ESET-NOD32 a variant of MSIL/Bladabindi.AS
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.B-468
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Backdoor:MSIL/Bladabindi.7203dee5
NANO-Antivirus Trojan.Win32.Disfa.dtznyx
ViRobot Backdoor.Win32.Bladabindi.Gen.A
Ad-Aware Generic.MSIL.Bladabindi.3CAC55E6
Comodo Backdoor.MSIL.Bladabindi.A@566ygc
Baidu MSIL.Backdoor.Bladabindi.a
VIPRE Backdoor.MSIL.Bladabindi.a (v)
TrendMicro BKDR_BLADABI.SMC
Emsisoft Trojan.Bladabindi (A)
Ikarus Trojan.MSIL.Bladabindi
Jiangmin TrojanDropper.Autoit.dce
Avira TR/Dropper.Gen7
MAX malware (ai score=88)
ZoneAlarm HEUR:Trojan.Win32.Generic
GData MSIL.Backdoor.Bladabindi.AV
Cynet Malicious (score: 100)
AhnLab-V3 Backdoor/Win32.Bladabindi.R91438
Acronis suspicious
VBA32 Trojan.MSIL.Disfa
ALYac Generic.MSIL.Bladabindi.3CAC55E6
Malwarebytes Backdoor.NJRat
Panda Trj/GdSda.A
TrendMicro-HouseCall BKDR_BLADABI.SMC
Tencent Win32.Trojan.Generic.Ecjo
Yandex Trojan.AvsMofer.dd6520
SentinelOne Static AI - Malicious PE
eGambit Unsafe.AI_Score_100%
Fortinet MSIL/Agent.LI!tr