njrat | a46de7b1eb5d6bd50182eebb1822b4535f3018136cd98af27ae6c462583a2267

Analysis

max time kernel
151s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
15-02-2021 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

malekbb.no-ip.biz:662

Mutex

5903db4c13d1ac1ce32218dcef1070c0

Attributes

reg_key
5903db4c13d1ac1ce32218dcef1070c0
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 2 IoCs

Processes:

77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5903db4c13d1ac1ce32218dcef1070c0.exe	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5903db4c13d1ac1ce32218dcef1070c0.exe	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5903db4c13d1ac1ce32218dcef1070c0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe\" .."	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\5903db4c13d1ac1ce32218dcef1070c0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe\" .."	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

pid	process
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

description pid process

Token: SeDebugPrivilege 644 77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

description	pid	process
Token: SeDebugPrivilege	644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe

description	pid	process	target process
PID 644 wrote to memory of 3676	644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe	netsh.exe
PID 644 wrote to memory of 3676	644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe	netsh.exe
PID 644 wrote to memory of 3676	644	77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe
"C:\Users\Admin\AppData\Local\Temp\77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe" "77d426d73e3aeef4eb5f1ccf5e3815f52af9c4d6b86d43cc5533548a0ab764f7.exe" ENABLE
2⤵
PID:3676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-2-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/644-3-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/644-5-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/644-6-0x0000000000B10000-0x0000000000B18000-memory.dmp

Filesize
32KB

Download
memory/644-7-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/644-9-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/644-10-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/644-11-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/644-12-0x0000000004DD3000-0x0000000004DD5000-memory.dmp

Filesize
8KB

Download
memory/3676-8-0x0000000000000000-mapping.dmp

Download