njrat | 896063f7d965ebf60d36b28c47135e010e212bc9955e7dfdfba4f085744ba47a

General

Target

Client.exe
Size

157KB
MD5

56bc3f630c9f0b284185cf952c2dc736
SHA1

eb6c702c2a2c48221a0eed0baacfe931c34e1757
SHA256

896063f7d965ebf60d36b28c47135e010e212bc9955e7dfdfba4f085744ba47a
SHA512

b37dc8750f01a3e55e392d7d5591147b010c6b0971874aad074ee0144da4fcda5ff58590a432c9777fd9fb5f78a2ca279fcbf5806598603e9ab0e0a5db601caf

Score

10^/10

njrat evasion spyware stealer suricata trojan upx

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/640-117-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/640-120-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

Client.exe

description pid process target process

PID 3492 set thread context of 640 3492 Client.exe vbc.exe

description	pid	process	target process
PID 3492 set thread context of 640	3492	Client.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

Client.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: SeDebugPrivilege	640	vbc.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe
Token: 33	3492	Client.exe
Token: SeIncBasePriorityPrivilege	3492	Client.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Client.exe

description	pid	process	target process
PID 3492 wrote to memory of 3924	3492	Client.exe	netsh.exe
PID 3492 wrote to memory of 3924	3492	Client.exe	netsh.exe
PID 3492 wrote to memory of 3924	3492	Client.exe	netsh.exe
PID 3492 wrote to memory of 640	3492	Client.exe	vbc.exe
PID 3492 wrote to memory of 640	3492	Client.exe	vbc.exe
PID 3492 wrote to memory of 640	3492	Client.exe	vbc.exe
PID 3492 wrote to memory of 640	3492	Client.exe	vbc.exe
PID 3492 wrote to memory of 640	3492	Client.exe	vbc.exe
PID 3492 wrote to memory of 640	3492	Client.exe	vbc.exe
PID 3492 wrote to memory of 640	3492	Client.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Client.exe" "Client.exe" ENABLE
2⤵
PID:3924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\1232597"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1232597
MD5
b0cc2e6f2d8036c9b5fef218736fa9c9

SHA1
64fd3017625979c95ba09d7cbea201010a82f73f

SHA256
997aceeb78143e057d4ea0ed699db3cc1c723f699b4532663b7b85c83baa5c50

SHA512
a1fe80b2971c4d1141a594f27eaea61500bf701cd1b8fbdb5ac2204a63c8ef862344f8c30f65ce769f0acf2b0718ed33a02744dd1a152c4a62a5318333d29b9b

Download Submit
memory/640-117-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/640-118-0x00000000004700E0-mapping.dmp

Download
memory/640-120-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3492-114-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/3492-116-0x0000000002361000-0x0000000002362000-memory.dmp

Filesize
4KB

Download
memory/3492-121-0x0000000002364000-0x0000000002366000-memory.dmp

Filesize
8KB

Download
memory/3924-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads