njrat | 96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf

General

Target

B7272AB1D83A3CAE498E513E0CFF087F.exe
Size

56KB
MD5

b7272ab1d83a3cae498e513e0cff087f
SHA1

7729415361e73ac4730f2c53e33d65ad892efde7
SHA256

96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf
SHA512

0f00c0bcff463324a41e462f58d6673e1db634272f967b471d355aee62e0e02c959cbfed70bbc931d3bc03ee46f303f0b50a9d68570f582d566f4fa6c81eb417

Score

10^/10

njrat mybot evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

ratnk.duckdns.org:1605

Mutex

b0cb8ce9e5434c245c6380f65c492e81

Attributes

reg_key
b0cb8ce9e5434c245c6380f65c492e81
splitter
Y262SUCZ4UJJ

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 2 IoCs

Processes:

WindowsServices.exeWindowsServices.exe

pid process

2712 WindowsServices.exe
1484 WindowsServices.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
2712	WindowsServices.exe
1484	WindowsServices.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

B7272AB1D83A3CAE498E513E0CFF087F.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	B7272AB1D83A3CAE498E513E0CFF087F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\CkAxNALyWL = "C:\\Users\\Admin\\AppData\\Roaming\\ZmFSAqsNCM\\yNDFQpcPWY.exe"	B7272AB1D83A3CAE498E513E0CFF087F.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

B7272AB1D83A3CAE498E513E0CFF087F.exeWindowsServices.exe

description	pid	process	target process
PID 744 set thread context of 2352	744	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 2712 set thread context of 1484	2712	WindowsServices.exe	WindowsServices.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

WindowsServices.exe

description	pid	process
Token: SeDebugPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe
Token: 33	1484	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	1484	WindowsServices.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

B7272AB1D83A3CAE498E513E0CFF087F.exeB7272AB1D83A3CAE498E513E0CFF087F.exeWindowsServices.exeWindowsServices.exe

description	pid	process	target process
PID 744 wrote to memory of 2352	744	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 744 wrote to memory of 2352	744	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 744 wrote to memory of 2352	744	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 744 wrote to memory of 2352	744	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 744 wrote to memory of 2352	744	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 744 wrote to memory of 2352	744	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 744 wrote to memory of 2352	744	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 744 wrote to memory of 2352	744	B7272AB1D83A3CAE498E513E0CFF087F.exe	B7272AB1D83A3CAE498E513E0CFF087F.exe
PID 2352 wrote to memory of 2712	2352	B7272AB1D83A3CAE498E513E0CFF087F.exe	WindowsServices.exe
PID 2352 wrote to memory of 2712	2352	B7272AB1D83A3CAE498E513E0CFF087F.exe	WindowsServices.exe
PID 2352 wrote to memory of 2712	2352	B7272AB1D83A3CAE498E513E0CFF087F.exe	WindowsServices.exe
PID 2712 wrote to memory of 1484	2712	WindowsServices.exe	WindowsServices.exe
PID 2712 wrote to memory of 1484	2712	WindowsServices.exe	WindowsServices.exe
PID 2712 wrote to memory of 1484	2712	WindowsServices.exe	WindowsServices.exe
PID 2712 wrote to memory of 1484	2712	WindowsServices.exe	WindowsServices.exe
PID 2712 wrote to memory of 1484	2712	WindowsServices.exe	WindowsServices.exe
PID 2712 wrote to memory of 1484	2712	WindowsServices.exe	WindowsServices.exe
PID 2712 wrote to memory of 1484	2712	WindowsServices.exe	WindowsServices.exe
PID 2712 wrote to memory of 1484	2712	WindowsServices.exe	WindowsServices.exe
PID 1484 wrote to memory of 1340	1484	WindowsServices.exe	netsh.exe
PID 1484 wrote to memory of 1340	1484	WindowsServices.exe	netsh.exe
PID 1484 wrote to memory of 1340	1484	WindowsServices.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\B7272AB1D83A3CAE498E513E0CFF087F.exe
"C:\Users\Admin\AppData\Local\Temp\B7272AB1D83A3CAE498E513E0CFF087F.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:744

C:\Users\Admin\AppData\Local\Temp\B7272AB1D83A3CAE498E513E0CFF087F.exe
"C:\Users\Admin\AppData\Local\Temp\B7272AB1D83A3CAE498E513E0CFF087F.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
5⤵
PID:1340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B7272AB1D83A3CAE498E513E0CFF087F.exe.log
MD5
4cce90d514b02375cc96049f5979fa96

SHA1
336fdb6c53577dbcac509d31bd515757817bff35

SHA256
ab019bbc94253e3afc0fc09d3722a6eecab94857c734fbd75b3e558cc48427d0

SHA512
530e3566fe42db495103a110dd50d665fef013f2ebd09db1b149f51825fd4406d4e5b8272fceb99581b47609940a2994a14893ca3712ae3cf4509c39b060d3d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WindowsServices.exe.log
MD5
4cce90d514b02375cc96049f5979fa96

SHA1
336fdb6c53577dbcac509d31bd515757817bff35

SHA256
ab019bbc94253e3afc0fc09d3722a6eecab94857c734fbd75b3e558cc48427d0

SHA512
530e3566fe42db495103a110dd50d665fef013f2ebd09db1b149f51825fd4406d4e5b8272fceb99581b47609940a2994a14893ca3712ae3cf4509c39b060d3d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
MD5
b7272ab1d83a3cae498e513e0cff087f

SHA1
7729415361e73ac4730f2c53e33d65ad892efde7

SHA256
96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf

SHA512
0f00c0bcff463324a41e462f58d6673e1db634272f967b471d355aee62e0e02c959cbfed70bbc931d3bc03ee46f303f0b50a9d68570f582d566f4fa6c81eb417

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
MD5
b7272ab1d83a3cae498e513e0cff087f

SHA1
7729415361e73ac4730f2c53e33d65ad892efde7

SHA256
96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf

SHA512
0f00c0bcff463324a41e462f58d6673e1db634272f967b471d355aee62e0e02c959cbfed70bbc931d3bc03ee46f303f0b50a9d68570f582d566f4fa6c81eb417

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
MD5
b7272ab1d83a3cae498e513e0cff087f

SHA1
7729415361e73ac4730f2c53e33d65ad892efde7

SHA256
96e438e2623b95267817cfa70cb9ebe627c4a051662b5af7162bc671ae32b8cf

SHA512
0f00c0bcff463324a41e462f58d6673e1db634272f967b471d355aee62e0e02c959cbfed70bbc931d3bc03ee46f303f0b50a9d68570f582d566f4fa6c81eb417

Download Submit
memory/744-116-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/744-117-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/744-118-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/744-119-0x0000000005030000-0x0000000005033000-memory.dmp

Filesize
12KB

Download
memory/744-114-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/744-126-0x0000000005000000-0x0000000005092000-memory.dmp

Filesize
584KB

Download
memory/1340-146-0x0000000000000000-mapping.dmp

Download
memory/1484-150-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/1484-138-0x000000000040952E-mapping.dmp

Download
memory/1484-148-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/1484-149-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/1484-151-0x00000000060D0000-0x00000000060D1000-memory.dmp

Filesize
4KB

Download
memory/2352-120-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2352-121-0x000000000040952E-mapping.dmp

Download
memory/2712-145-0x0000000002CC0000-0x0000000002D52000-memory.dmp

Filesize
584KB

Download
memory/2712-127-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads