njrat | 917ef72731455e80e3d49b198924d5810e539984bb6c6dbd238d518ed284d8c5

General

Target

a4b89da90c002a6cb2753c9eaa2655de.exe
Size

31KB
MD5

a4b89da90c002a6cb2753c9eaa2655de
SHA1

11e80ffcc3bb1d9711aa46a6c0b9d21567a3e44a
SHA256

917ef72731455e80e3d49b198924d5810e539984bb6c6dbd238d518ed284d8c5
SHA512

421e0dd6660aeed60c6a5eea58bf5c4cfd6cebbdc4d9abca2d8a335bf3ba68afe7121eef45dec7a5bd46354a19cc815eb562337833e460c027c08e85887764dd

Score

10^/10

njrat mybot evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

4.tcp.ngrok.io:12601

Mutex

ff9559ce9f577731b47f4f094b63f540

Attributes

reg_key
ff9559ce9f577731b47f4f094b63f540
splitter
Y262SUCZ4UJJ

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

WindowsServices.exe

pid process

1612 WindowsServices.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Loads dropped DLL 1 IoCs

Processes:

a4b89da90c002a6cb2753c9eaa2655de.exe

pid process

1040 a4b89da90c002a6cb2753c9eaa2655de.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1612	WindowsServices.exe

pid	process
1040	a4b89da90c002a6cb2753c9eaa2655de.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

WindowsServices.exe

description	pid	process
Token: SeDebugPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe
Token: 33	1612	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1612	WindowsServices.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a4b89da90c002a6cb2753c9eaa2655de.exeWindowsServices.exe

description	pid	process	target process
PID 1040 wrote to memory of 1612	1040	a4b89da90c002a6cb2753c9eaa2655de.exe	WindowsServices.exe
PID 1040 wrote to memory of 1612	1040	a4b89da90c002a6cb2753c9eaa2655de.exe	WindowsServices.exe
PID 1040 wrote to memory of 1612	1040	a4b89da90c002a6cb2753c9eaa2655de.exe	WindowsServices.exe
PID 1040 wrote to memory of 1612	1040	a4b89da90c002a6cb2753c9eaa2655de.exe	WindowsServices.exe
PID 1612 wrote to memory of 432	1612	WindowsServices.exe	netsh.exe
PID 1612 wrote to memory of 432	1612	WindowsServices.exe	netsh.exe
PID 1612 wrote to memory of 432	1612	WindowsServices.exe	netsh.exe
PID 1612 wrote to memory of 432	1612	WindowsServices.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\a4b89da90c002a6cb2753c9eaa2655de.exe
"C:\Users\Admin\AppData\Local\Temp\a4b89da90c002a6cb2753c9eaa2655de.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1040

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
3⤵
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
MD5
a4b89da90c002a6cb2753c9eaa2655de

SHA1
11e80ffcc3bb1d9711aa46a6c0b9d21567a3e44a

SHA256
917ef72731455e80e3d49b198924d5810e539984bb6c6dbd238d518ed284d8c5

SHA512
421e0dd6660aeed60c6a5eea58bf5c4cfd6cebbdc4d9abca2d8a335bf3ba68afe7121eef45dec7a5bd46354a19cc815eb562337833e460c027c08e85887764dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
MD5
a4b89da90c002a6cb2753c9eaa2655de

SHA1
11e80ffcc3bb1d9711aa46a6c0b9d21567a3e44a

SHA256
917ef72731455e80e3d49b198924d5810e539984bb6c6dbd238d518ed284d8c5

SHA512
421e0dd6660aeed60c6a5eea58bf5c4cfd6cebbdc4d9abca2d8a335bf3ba68afe7121eef45dec7a5bd46354a19cc815eb562337833e460c027c08e85887764dd

Download Submit
\Users\Admin\AppData\Local\Temp\WindowsServices.exe
MD5
a4b89da90c002a6cb2753c9eaa2655de

SHA1
11e80ffcc3bb1d9711aa46a6c0b9d21567a3e44a

SHA256
917ef72731455e80e3d49b198924d5810e539984bb6c6dbd238d518ed284d8c5

SHA512
421e0dd6660aeed60c6a5eea58bf5c4cfd6cebbdc4d9abca2d8a335bf3ba68afe7121eef45dec7a5bd46354a19cc815eb562337833e460c027c08e85887764dd

Download Submit
memory/432-67-0x0000000000000000-mapping.dmp

Download
memory/1040-59-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download
memory/1040-60-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/1612-62-0x0000000000000000-mapping.dmp

Download
memory/1612-66-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing