njrat | ceb4d88a90ff332d4ea6da16abaf1e04b6296d8618c1f280696acb57cb7bbc68

General

Target

CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Size

170KB
MD5

75b89ea1408de6fdd7429944f8fdbb5e
SHA1

1250d433355aa6d7ce189ea5fe4a9d08df179f18
SHA256

ceb4d88a90ff332d4ea6da16abaf1e04b6296d8618c1f280696acb57cb7bbc68
SHA512

8682bab985ae84c3482328b5e9cb8a60c902e432a9e1ebb58fafd70e31ed0d01303f3dc64c3b6b2b6a8cdce7c9876d18fff133f75844582650177f6be809bf45

Score

10^/10

njrat cucutaa suricata trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

CUCUTAA

C2

noviembre1.duckdns.org:3030

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
lolo

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata

Suspicious use of SetThreadContext 2 IoCs

Processes:

CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exeCEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

description	pid	process	target process
PID 1664 set thread context of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 set thread context of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1072 schtasks.exe
628 schtasks.exe

pid	process
1072	schtasks.exe
628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exeCEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

pid	process
1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exeCEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exeCEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exeCEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

description	pid	process
Token: SeDebugPrivilege	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeDebugPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeDebugPrivilege	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeDebugPrivilege	1716	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exeCEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exetaskeng.exeCEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exeCEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

description	pid	process	target process
PID 1664 wrote to memory of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1664 wrote to memory of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1664 wrote to memory of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1664 wrote to memory of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1664 wrote to memory of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1664 wrote to memory of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1664 wrote to memory of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1664 wrote to memory of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1664 wrote to memory of 592	1664	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 592 wrote to memory of 1448	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 592 wrote to memory of 1448	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 592 wrote to memory of 1448	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 592 wrote to memory of 1448	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 592 wrote to memory of 1072	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 592 wrote to memory of 1072	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 592 wrote to memory of 1072	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 592 wrote to memory of 1072	592	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 1204 wrote to memory of 1948	1204	taskeng.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1204 wrote to memory of 1948	1204	taskeng.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1204 wrote to memory of 1948	1204	taskeng.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1204 wrote to memory of 1948	1204	taskeng.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 wrote to memory of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 wrote to memory of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 wrote to memory of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 wrote to memory of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 wrote to memory of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 wrote to memory of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 wrote to memory of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 wrote to memory of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1948 wrote to memory of 684	1948	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 684 wrote to memory of 1632	684	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 684 wrote to memory of 1632	684	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 684 wrote to memory of 1632	684	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 684 wrote to memory of 1632	684	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 684 wrote to memory of 628	684	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 684 wrote to memory of 628	684	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 684 wrote to memory of 628	684	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 684 wrote to memory of 628	684	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	schtasks.exe
PID 1204 wrote to memory of 1716	1204	taskeng.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1204 wrote to memory of 1716	1204	taskeng.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1204 wrote to memory of 1716	1204	taskeng.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
PID 1204 wrote to memory of 1716	1204	taskeng.exe	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
"C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664

C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
"C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
3⤵
PID:1448

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe" /sc minute /mo 1
3⤵
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\taskeng.exe
taskeng.exe {AF6C86CB-CC0F-4573-85FC-6B0F8B94AD4F} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
"C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
4⤵
PID:1632

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe" /sc minute /mo 1
4⤵
- Creates scheduled task(s)
PID:628

C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-56-0x0000000000414E6E-mapping.dmp

Download
memory/592-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/592-58-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/628-69-0x0000000000000000-mapping.dmp

Download
memory/684-66-0x0000000000414E6E-mapping.dmp

Download
memory/684-70-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1072-60-0x0000000000000000-mapping.dmp

Download
memory/1448-59-0x0000000000000000-mapping.dmp

Download
memory/1632-68-0x0000000000000000-mapping.dmp

Download
memory/1664-52-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1664-54-0x0000000000D31000-0x0000000000D32000-memory.dmp

Filesize
4KB

Download
memory/1664-53-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/1716-71-0x0000000000000000-mapping.dmp

Download
memory/1716-73-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1716-74-0x0000000000231000-0x0000000000232000-memory.dmp

Filesize
4KB

Download
memory/1948-63-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/1948-64-0x0000000000CC1000-0x0000000000CC2000-memory.dmp

Filesize
4KB

Download
memory/1948-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads