njrat | 96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf

General

Target

B7272AB1D83A3CAE498E513E0CFF087F.exe
Size

56KB
MD5

b7272ab1d83a3cae498e513e0cff087f
SHA1

7729415361e73ac4730f2c53e33d65ad892efde7
SHA256

96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf
SHA512

0f00c0bcff463324a41e462f58d6673e1db634272f967b471d355aee62e0e02c959cbfed70bbc931d3bc03ee46f303f0b50a9d68570f582d566f4fa6c81eb417

Score

10^/10

njrat mybot evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

ratnk.duckdns.org:1605

Mutex

b0cb8ce9e5434c245c6380f65c492e81

Attributes

reg_key
b0cb8ce9e5434c245c6380f65c492e81
splitter
Y262SUCZ4UJJ

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

WindowsServices.exeWindowsServices.exe

pid process

3816 WindowsServices.exe
3392 WindowsServices.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
3816	WindowsServices.exe
3392	WindowsServices.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

B7272AB1D83A3CAE498E513E0CFF087F.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\CkAxNALyWL = "C:\\Users\\Admin\\AppData\\Roaming\\ZmFSAqsNCM\\yNDFQpcPWY.exe"	B7272AB1D83A3CAE498E513E0CFF087F.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	B7272AB1D83A3CAE498E513E0CFF087F.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

B7272AB1D83A3CAE498E513E0CFF087F.exeWindowsServices.exe

description	pid	process	target process
PID 3016 set thread context of 2736	3016	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 3816 set thread context of 3392	3816	WindowsServices.exe	WindowsServices.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

WindowsServices.exe

description	pid	process
Token: SeDebugPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe
Token: 33	3392	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	3392	WindowsServices.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

B7272AB1D83A3CAE498E513E0CFF087F.exeB7272AB1D83A3CAE498E513E0CFF087F.exeWindowsServices.exeWindowsServices.exe

description	pid	process	target process
PID 3016 wrote to memory of 2736	3016	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 3016 wrote to memory of 2736	3016	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 3016 wrote to memory of 2736	3016	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 3016 wrote to memory of 2736	3016	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 3016 wrote to memory of 2736	3016	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 3016 wrote to memory of 2736	3016	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 3016 wrote to memory of 2736	3016	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 3016 wrote to memory of 2736	3016	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 2736 wrote to memory of 3816	2736	B7272AB1D83A3CAE498E513E0CFF087F.exe	WindowsServices.exe
PID 2736 wrote to memory of 3816	2736	B7272AB1D83A3CAE498E513E0CFF087F.exe	WindowsServices.exe
PID 2736 wrote to memory of 3816	2736	B7272AB1D83A3CAE498E513E0CFF087F.exe	WindowsServices.exe
PID 3816 wrote to memory of 3392	3816	WindowsServices.exe	WindowsServices.exe
PID 3816 wrote to memory of 3392	3816	WindowsServices.exe	WindowsServices.exe
PID 3816 wrote to memory of 3392	3816	WindowsServices.exe	WindowsServices.exe
PID 3816 wrote to memory of 3392	3816	WindowsServices.exe	WindowsServices.exe
PID 3816 wrote to memory of 3392	3816	WindowsServices.exe	WindowsServices.exe
PID 3816 wrote to memory of 3392	3816	WindowsServices.exe	WindowsServices.exe
PID 3816 wrote to memory of 3392	3816	WindowsServices.exe	WindowsServices.exe
PID 3816 wrote to memory of 3392	3816	WindowsServices.exe	WindowsServices.exe
PID 3392 wrote to memory of 2088	3392	WindowsServices.exe	netsh.exe
PID 3392 wrote to memory of 2088	3392	WindowsServices.exe	netsh.exe
PID 3392 wrote to memory of 2088	3392	WindowsServices.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\B7272AB1D83A3CAE498E513E0CFF087F.exe
"C:\Users\Admin\AppData\Local\Temp\B7272AB1D83A3CAE498E513E0CFF087F.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3016

C:\Users\Admin\AppData\Local\Temp\B7272AB1D83A3CAE498E513E0CFF087F.exe
"C:\Users\Admin\AppData\Local\Temp\B7272AB1D83A3CAE498E513E0CFF087F.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2736

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3816

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
5⤵
PID:2088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B7272AB1D83A3CAE498E513E0CFF087F.exe.log
MD5
4cce90d514b02375cc96049f5979fa96

SHA1
336fdb6c53577dbcac509d31bd515757817bff35

SHA256
ab019bbc94253e3afc0fc09d3722a6eecab94857c734fbd75b3e558cc48427d0

SHA512
530e3566fe42db495103a110dd50d665fef013f2ebd09db1b149f51825fd4406d4e5b8272fceb99581b47609940a2994a14893ca3712ae3cf4509c39b060d3d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WindowsServices.exe.log
MD5
4cce90d514b02375cc96049f5979fa96

SHA1
336fdb6c53577dbcac509d31bd515757817bff35

SHA256
ab019bbc94253e3afc0fc09d3722a6eecab94857c734fbd75b3e558cc48427d0

SHA512
530e3566fe42db495103a110dd50d665fef013f2ebd09db1b149f51825fd4406d4e5b8272fceb99581b47609940a2994a14893ca3712ae3cf4509c39b060d3d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
MD5
b7272ab1d83a3cae498e513e0cff087f

SHA1
7729415361e73ac4730f2c53e33d65ad892efde7

SHA256
96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf

SHA512
0f00c0bcff463324a41e462f58d6673e1db634272f967b471d355aee62e0e02c959cbfed70bbc931d3bc03ee46f303f0b50a9d68570f582d566f4fa6c81eb417

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
MD5
b7272ab1d83a3cae498e513e0cff087f

SHA1
7729415361e73ac4730f2c53e33d65ad892efde7

SHA256
96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf

SHA512
0f00c0bcff463324a41e462f58d6673e1db634272f967b471d355aee62e0e02c959cbfed70bbc931d3bc03ee46f303f0b50a9d68570f582d566f4fa6c81eb417

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
MD5
b7272ab1d83a3cae498e513e0cff087f

SHA1
7729415361e73ac4730f2c53e33d65ad892efde7

SHA256
96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf

SHA512
0f00c0bcff463324a41e462f58d6673e1db634272f967b471d355aee62e0e02c959cbfed70bbc931d3bc03ee46f303f0b50a9d68570f582d566f4fa6c81eb417

Download Submit
memory/2088-146-0x0000000000000000-mapping.dmp

Download
memory/2736-120-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2736-121-0x000000000040952E-mapping.dmp

Download
memory/3016-118-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/3016-114-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/3016-119-0x0000000004C30000-0x0000000004C33000-memory.dmp

Filesize
12KB

Download
memory/3016-127-0x0000000004B80000-0x000000000507E000-memory.dmp

Filesize
5.0MB

Download
memory/3016-117-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/3016-116-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/3392-138-0x000000000040952E-mapping.dmp

Download
memory/3392-148-0x0000000005810000-0x0000000005D0E000-memory.dmp

Filesize
5.0MB

Download
memory/3392-149-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/3392-150-0x0000000005A20000-0x0000000005A21000-memory.dmp

Filesize
4KB

Download
memory/3392-151-0x0000000006750000-0x0000000006751000-memory.dmp

Filesize
4KB

Download
memory/3816-128-0x0000000000000000-mapping.dmp

Download
memory/3816-145-0x00000000051D0000-0x00000000056CE000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads