njrat | ceb4d88a90ff332d4ea6da16abaf1e04b6296d8618c1f280696acb57cb7bbc68

Analysis

max time kernel
152s
max time network
154s
platform
windows10_x64
resource
win10v20210408
submitted
09/09/2021, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Size 170KB
Sample210909-jfabxaahgr
SHA256 ceb4d88a90ff332d4ea6da16abaf1e04b6296d8618c1f280696acb57cb7bbc68
MD5 75b89ea1408de6fdd7429944f8fdbb5e
SHA1 1250d433355aa6d7ce189ea5fe4a9d08df179f18
SHA512 8682bab985ae84c3482328b5e9cb8a60c902e432a9e1ebb58fafd70e31ed0d01303f3dc64c3b6b2b6a8cdce7c9876d18fff133f75844582650177f6be809bf45
MD5 SHA1 SHA512

Score

10^/10

njrat cucutaa suricata trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

CUCUTAA

noviembre1.duckdns.org:3030

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
lolo

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 568 set thread context of 2960	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	78
PID 1660 set thread context of 3908	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	85

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2972	schtasks.exe
2704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeDebugPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeDebugPrivilege	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeDebugPrivilege	3676	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: 33	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
Token: SeIncBasePriorityPrivilege	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 2960	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	78
PID 568 wrote to memory of 2960	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	78
PID 568 wrote to memory of 2960	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	78
PID 568 wrote to memory of 2960	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	78
PID 568 wrote to memory of 2960	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	78
PID 568 wrote to memory of 2960	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	78
PID 568 wrote to memory of 2960	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	78
PID 568 wrote to memory of 2960	568	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	78
PID 2960 wrote to memory of 1180	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	79
PID 2960 wrote to memory of 1180	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	79
PID 2960 wrote to memory of 1180	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	79
PID 2960 wrote to memory of 2972	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	81
PID 2960 wrote to memory of 2972	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	81
PID 2960 wrote to memory of 2972	2960	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	81
PID 1660 wrote to memory of 3908	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	85
PID 1660 wrote to memory of 3908	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	85
PID 1660 wrote to memory of 3908	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	85
PID 1660 wrote to memory of 3908	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	85
PID 1660 wrote to memory of 3908	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	85
PID 1660 wrote to memory of 3908	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	85
PID 1660 wrote to memory of 3908	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	85
PID 1660 wrote to memory of 3908	1660	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	85
PID 3908 wrote to memory of 3844	3908	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	86
PID 3908 wrote to memory of 3844	3908	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	86
PID 3908 wrote to memory of 3844	3908	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	86
PID 3908 wrote to memory of 2704	3908	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	88
PID 3908 wrote to memory of 2704	3908	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	88
PID 3908 wrote to memory of 2704	3908	CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe	88

C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
"C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568
- C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
  "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe" /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:2972

C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
  "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    PID:3844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe" /sc minute /mo 1
    3⤵
    - Creates scheduled task(s)
    PID:2704

C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
C:\Users\Admin\AppData\Local\Temp\CEB4D88A90FF332D4EA6DA16ABAF1E04B6296D8618C1F.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-114-0x0000000002610000-0x0000000002611000-memory.dmp

Download

memory/1660-121-0x0000000001220000-0x0000000001221000-memory.dmp

Download

memory/2960-120-0x00000000030F0000-0x00000000030F1000-memory.dmp

Download

memory/2960-115-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3676-127-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/3908-124-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download