njrat | 50577b8d20e216e731721c76975564ab1a6feeb16b168d7ff09e6e38b3eec0b0

General

Target

50577B8D20E216E731721C76975564AB1A6FEEB16B168.exe
Size

258KB
MD5

303c6c4a9296d2eb2346f3c457465556
SHA1

0d0432b65763d233b7369019ba1ab7bc9ff4209f
SHA256

50577b8d20e216e731721c76975564ab1a6feeb16b168d7ff09e6e38b3eec0b0
SHA512

1fcb0939ebf6ac84c0f9d954437ebf63676d93465bb0f0a0763da253cc2025ec135720217476acfae8b3b8e7947a27bd1a4fda931be2cca01022912c05e98226

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 1 IoCs

Processes:

taskhost.exe

pid process

4060 taskhost.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
4060	taskhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

taskhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b9bda0f5717fadb32c63f3e819cc1178 = "\"C:\\ProgramData\\taskhost.exe\" .."	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\b9bda0f5717fadb32c63f3e819cc1178 = "\"C:\\ProgramData\\taskhost.exe\" .."	taskhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

taskhost.exe

description	pid	process
Token: SeDebugPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe
Token: 33	4060	taskhost.exe
Token: SeIncBasePriorityPrivilege	4060	taskhost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

50577B8D20E216E731721C76975564AB1A6FEEB16B168.exetaskhost.exe

description	pid	process	target process
PID 4044 wrote to memory of 4060	4044	50577B8D20E216E731721C76975564AB1A6FEEB16B168.exe	taskhost.exe
PID 4044 wrote to memory of 4060	4044	50577B8D20E216E731721C76975564AB1A6FEEB16B168.exe	taskhost.exe
PID 4060 wrote to memory of 3056	4060	taskhost.exe	netsh.exe
PID 4060 wrote to memory of 3056	4060	taskhost.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\50577B8D20E216E731721C76975564AB1A6FEEB16B168.exe
"C:\Users\Admin\AppData\Local\Temp\50577B8D20E216E731721C76975564AB1A6FEEB16B168.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\ProgramData\taskhost.exe
  "C:\ProgramData\taskhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SYSTEM32\netsh.exe
    netsh firewall add allowedprogram "C:\ProgramData\taskhost.exe" "taskhost.exe" ENABLE
    3⤵
    PID:3056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\taskhost.exe

MD5
303c6c4a9296d2eb2346f3c457465556

SHA1
0d0432b65763d233b7369019ba1ab7bc9ff4209f

SHA256
50577b8d20e216e731721c76975564ab1a6feeb16b168d7ff09e6e38b3eec0b0

SHA512
1fcb0939ebf6ac84c0f9d954437ebf63676d93465bb0f0a0763da253cc2025ec135720217476acfae8b3b8e7947a27bd1a4fda931be2cca01022912c05e98226

Download Submit
C:\ProgramData\taskhost.exe

MD5
303c6c4a9296d2eb2346f3c457465556

SHA1
0d0432b65763d233b7369019ba1ab7bc9ff4209f

SHA256
50577b8d20e216e731721c76975564ab1a6feeb16b168d7ff09e6e38b3eec0b0

SHA512
1fcb0939ebf6ac84c0f9d954437ebf63676d93465bb0f0a0763da253cc2025ec135720217476acfae8b3b8e7947a27bd1a4fda931be2cca01022912c05e98226

Download Submit
memory/3056-120-0x0000000000000000-mapping.dmp

Download
memory/4044-115-0x0000000002410000-0x0000000002412000-memory.dmp

Filesize
8KB

Download
memory/4060-116-0x0000000000000000-mapping.dmp

Download
memory/4060-119-0x00000000013F0000-0x00000000013F2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads