njrat | b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277

General

Target

b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe
Size

26KB
MD5

043335fcd3a8b4b6d85861b9e5c27b74
SHA1

567bb55395160fd165bdd6ba17176399cb54bc58
SHA256

b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277
SHA512

426521fc7888079b97e91a3a4d4b1bcc29f5bc0a914ded979970f3b22c625866c26123ff9f0c6baca85abb5fbd5e9b0d053277402d111b343fc11b87fba93529

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

192.168.7.108:1177

Mutex

017c060db3a2fd47416ea61ee39f9282

Attributes

reg_key
017c060db3a2fd47416ea61ee39f9282
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

server.exe

pid process

2860 server.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
2860	server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

server.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\017c060db3a2fd47416ea61ee39f9282 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\017c060db3a2fd47416ea61ee39f9282 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

server.exe

description	pid	process
Token: SeDebugPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe
Token: 33	2860	server.exe
Token: SeIncBasePriorityPrivilege	2860	server.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exeserver.exe

description	pid	process	target process
PID 508 wrote to memory of 2860	508	b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe	server.exe
PID 508 wrote to memory of 2860	508	b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe	server.exe
PID 2860 wrote to memory of 196	2860	server.exe	netsh.exe
PID 2860 wrote to memory of 196	2860	server.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe
"C:\Users\Admin\AppData\Local\Temp\b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:508

C:\Users\Admin\AppData\Local\Temp\server.exe
"C:\Users\Admin\AppData\Local\Temp\server.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SYSTEM32\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
3⤵
PID:196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\server.exe
MD5
043335fcd3a8b4b6d85861b9e5c27b74

SHA1
567bb55395160fd165bdd6ba17176399cb54bc58

SHA256
b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277

SHA512
426521fc7888079b97e91a3a4d4b1bcc29f5bc0a914ded979970f3b22c625866c26123ff9f0c6baca85abb5fbd5e9b0d053277402d111b343fc11b87fba93529

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe
MD5
043335fcd3a8b4b6d85861b9e5c27b74

SHA1
567bb55395160fd165bdd6ba17176399cb54bc58

SHA256
b62b55b6ffff01b6540348967c9f7b1361ffb5e860c2559ad00ef77036685277

SHA512
426521fc7888079b97e91a3a4d4b1bcc29f5bc0a914ded979970f3b22c625866c26123ff9f0c6baca85abb5fbd5e9b0d053277402d111b343fc11b87fba93529

Download Submit
memory/196-15-0x0000000000000000-mapping.dmp

Download
memory/508-2-0x00007FF809F60000-0x00007FF80A94C000-memory.dmp

Filesize
9.9MB

Download
memory/508-3-0x0000025003B00000-0x0000025003B01000-memory.dmp

Filesize
4KB

Download
memory/508-5-0x0000025003F90000-0x0000025003F96000-memory.dmp

Filesize
24KB

Download
memory/508-6-0x00000250055F0000-0x00000250055F2000-memory.dmp

Filesize
8KB

Download
memory/2860-7-0x0000000000000000-mapping.dmp

Download
memory/2860-10-0x00007FF809F60000-0x00007FF80A94C000-memory.dmp

Filesize
9.9MB

Download
memory/2860-14-0x0000026EDE240000-0x0000026EDE242000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads