njrat | 1e39e682bcc7bc56e68b22787bfd53e2346f67bd1dad4cc374b65a8e54b1b0e1

General

Target

41D2BC2F99C931544191A407A64D93EB.exe
Size

123KB
MD5

41d2bc2f99c931544191a407a64d93eb
SHA1

7773c4947f7f8e1b7e4c5a79a519ef0ef73c71f7
SHA256

1e39e682bcc7bc56e68b22787bfd53e2346f67bd1dad4cc374b65a8e54b1b0e1
SHA512

bab88c67972968c3fb0ac68f76044be812a49815ca081f548b945af3e765ae4ee42abfdb51ae3a851d83e01724ebaaa34de5091bec9424038d55ab6dd425cd19

Score

10^/10

njrat victem new evasion persistence suricata trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Victem New

C2

test0day.zapto.org:1919

Mutex

97c8dd348a81752049fc479a7db09101

Attributes

reg_key
97c8dd348a81752049fc479a7db09101
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Executes dropped EXE 1 IoCs

Processes:

Notpsd.exe

pid process

1636 Notpsd.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
1636	Notpsd.exe

Drops startup file 2 IoCs

Processes:

Notpsd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97c8dd348a81752049fc479a7db09101.exe	Notpsd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97c8dd348a81752049fc479a7db09101.exe	Notpsd.exe

Loads dropped DLL 1 IoCs

Processes:

41D2BC2F99C931544191A407A64D93EB.exe

pid process

1084 41D2BC2F99C931544191A407A64D93EB.exe

pid	process
1084	41D2BC2F99C931544191A407A64D93EB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Notpsd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\97c8dd348a81752049fc479a7db09101 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Notpsd.exe\" .."	Notpsd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\97c8dd348a81752049fc479a7db09101 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Notpsd.exe\" .."	Notpsd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

Notpsd.exe

description	pid	process
Token: SeDebugPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe
Token: 33	1636	Notpsd.exe
Token: SeIncBasePriorityPrivilege	1636	Notpsd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

41D2BC2F99C931544191A407A64D93EB.exeNotpsd.exe

description	pid	process	target process
PID 1084 wrote to memory of 1636	1084	41D2BC2F99C931544191A407A64D93EB.exe	Notpsd.exe
PID 1084 wrote to memory of 1636	1084	41D2BC2F99C931544191A407A64D93EB.exe	Notpsd.exe
PID 1084 wrote to memory of 1636	1084	41D2BC2F99C931544191A407A64D93EB.exe	Notpsd.exe
PID 1084 wrote to memory of 1636	1084	41D2BC2F99C931544191A407A64D93EB.exe	Notpsd.exe
PID 1636 wrote to memory of 756	1636	Notpsd.exe	netsh.exe
PID 1636 wrote to memory of 756	1636	Notpsd.exe	netsh.exe
PID 1636 wrote to memory of 756	1636	Notpsd.exe	netsh.exe
PID 1636 wrote to memory of 756	1636	Notpsd.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\41D2BC2F99C931544191A407A64D93EB.exe
"C:\Users\Admin\AppData\Local\Temp\41D2BC2F99C931544191A407A64D93EB.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\Notpsd.exe
  "C:\Users\Admin\AppData\Local\Temp\Notpsd.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Notpsd.exe" "Notpsd.exe" ENABLE
    3⤵
    PID:756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Notpsd.exe

MD5
41d2bc2f99c931544191a407a64d93eb

SHA1
7773c4947f7f8e1b7e4c5a79a519ef0ef73c71f7

SHA256
1e39e682bcc7bc56e68b22787bfd53e2346f67bd1dad4cc374b65a8e54b1b0e1

SHA512
bab88c67972968c3fb0ac68f76044be812a49815ca081f548b945af3e765ae4ee42abfdb51ae3a851d83e01724ebaaa34de5091bec9424038d55ab6dd425cd19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Notpsd.exe

MD5
41d2bc2f99c931544191a407a64d93eb

SHA1
7773c4947f7f8e1b7e4c5a79a519ef0ef73c71f7

SHA256
1e39e682bcc7bc56e68b22787bfd53e2346f67bd1dad4cc374b65a8e54b1b0e1

SHA512
bab88c67972968c3fb0ac68f76044be812a49815ca081f548b945af3e765ae4ee42abfdb51ae3a851d83e01724ebaaa34de5091bec9424038d55ab6dd425cd19

Download Submit
\Users\Admin\AppData\Local\Temp\Notpsd.exe

MD5
41d2bc2f99c931544191a407a64d93eb

SHA1
7773c4947f7f8e1b7e4c5a79a519ef0ef73c71f7

SHA256
1e39e682bcc7bc56e68b22787bfd53e2346f67bd1dad4cc374b65a8e54b1b0e1

SHA512
bab88c67972968c3fb0ac68f76044be812a49815ca081f548b945af3e765ae4ee42abfdb51ae3a851d83e01724ebaaa34de5091bec9424038d55ab6dd425cd19

Download Submit
memory/756-68-0x0000000000000000-mapping.dmp

Download
memory/1084-60-0x00000000752F1000-0x00000000752F3000-memory.dmp

Filesize
8KB

Download
memory/1084-61-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/1636-63-0x0000000000000000-mapping.dmp

Download
memory/1636-67-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads