njrat | aca870441f1fc5e5b54d151bdc762af81ef4ab21cf63845a29b205d57c99c533

General

Target

avellaneda.bin.exe
Size

420KB
MD5

0bb825d7755c400a76fd8512f6baab38
SHA1

278d3e2ca71d1b8f1e3b521e8885ae13e25d84da
SHA256

2543435084f6e995500f8e9f12312db2da5241029f78418a5308524e295443d9
SHA512

60bd692b834dd5280c93894adcfacde0d11cd0b7ae893a6b5a64cba704a13a0845f65bd322384d19e9eebf6a673a0565308f88769cc99eec4292c0ff2b980e34

Score

10^/10

njrat nyan cat trojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

reald27.duckdns.org:3525

Mutex

f45dd4eb26

Attributes

reg_key
f45dd4eb26
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Suspicious use of SetThreadContext 1 IoCs

Processes:

avellaneda.bin.exe

description pid process target process

PID 904 set thread context of 3836 904 avellaneda.bin.exe avellaneda.bin.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3136 powershell.exe
3136 powershell.exe
3136 powershell.exe

description	pid	process	target process
PID 904 set thread context of 3836	904	avellaneda.bin.exe	avellaneda.bin.exe

pid	process
3136	powershell.exe
3136	powershell.exe
3136	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

Processes:

powershell.exeavellaneda.bin.exe

description	pid	process
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe
Token: 33	3836	avellaneda.bin.exe
Token: SeIncBasePriorityPrivilege	3836	avellaneda.bin.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

avellaneda.bin.exe

description	pid	process	target process
PID 904 wrote to memory of 3136	904	avellaneda.bin.exe	powershell.exe
PID 904 wrote to memory of 3136	904	avellaneda.bin.exe	powershell.exe
PID 904 wrote to memory of 3136	904	avellaneda.bin.exe	powershell.exe
PID 904 wrote to memory of 3836	904	avellaneda.bin.exe	avellaneda.bin.exe
PID 904 wrote to memory of 3836	904	avellaneda.bin.exe	avellaneda.bin.exe
PID 904 wrote to memory of 3836	904	avellaneda.bin.exe	avellaneda.bin.exe
PID 904 wrote to memory of 3836	904	avellaneda.bin.exe	avellaneda.bin.exe
PID 904 wrote to memory of 3836	904	avellaneda.bin.exe	avellaneda.bin.exe
PID 904 wrote to memory of 3836	904	avellaneda.bin.exe	avellaneda.bin.exe
PID 904 wrote to memory of 3836	904	avellaneda.bin.exe	avellaneda.bin.exe
PID 904 wrote to memory of 3836	904	avellaneda.bin.exe	avellaneda.bin.exe

C:\Users\Admin\AppData\Local\Temp\avellaneda.bin.exe
"C:\Users\Admin\AppData\Local\Temp\avellaneda.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\avellaneda.bin.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Users\Admin\AppData\Local\Temp\avellaneda.bin.exe
"C:\Users\Admin\AppData\Local\Temp\avellaneda.bin.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-114-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/904-116-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/904-117-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/904-118-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/904-119-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/904-120-0x0000000005320000-0x0000000005327000-memory.dmp

Filesize
28KB

Download
memory/904-121-0x0000000008300000-0x0000000008301000-memory.dmp

Filesize
4KB

Download
memory/904-122-0x00000000084A0000-0x00000000084F7000-memory.dmp

Filesize
348KB

Download
memory/904-123-0x000000000AC00000-0x000000000AC22000-memory.dmp

Filesize
136KB

Download
memory/3136-137-0x0000000006A10000-0x0000000006A11000-memory.dmp

Filesize
4KB

Download
memory/3136-141-0x00000000073D0000-0x00000000073D1000-memory.dmp

Filesize
4KB

Download
memory/3136-368-0x0000000006840000-0x0000000006841000-memory.dmp

Filesize
4KB

Download
memory/3136-133-0x0000000004190000-0x0000000004191000-memory.dmp

Filesize
4KB

Download
memory/3136-134-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/3136-136-0x0000000006702000-0x0000000006703000-memory.dmp

Filesize
4KB

Download
memory/3136-135-0x0000000006700000-0x0000000006701000-memory.dmp

Filesize
4KB

Download
memory/3136-124-0x0000000000000000-mapping.dmp

Download
memory/3136-138-0x0000000006B80000-0x0000000006B81000-memory.dmp

Filesize
4KB

Download
memory/3136-139-0x00000000074C0000-0x00000000074C1000-memory.dmp

Filesize
4KB

Download
memory/3136-140-0x0000000007630000-0x0000000007631000-memory.dmp

Filesize
4KB

Download
memory/3136-362-0x0000000006850000-0x0000000006851000-memory.dmp

Filesize
4KB

Download
memory/3136-142-0x0000000007B00000-0x0000000007B01000-memory.dmp

Filesize
4KB

Download
memory/3136-143-0x0000000007D10000-0x0000000007D11000-memory.dmp

Filesize
4KB

Download
memory/3136-151-0x0000000008C80000-0x0000000008CB3000-memory.dmp

Filesize
204KB

Download
memory/3136-158-0x0000000008C60000-0x0000000008C61000-memory.dmp

Filesize
4KB

Download
memory/3136-163-0x0000000008DB0000-0x0000000008DB1000-memory.dmp

Filesize
4KB

Download
memory/3136-165-0x0000000006703000-0x0000000006704000-memory.dmp

Filesize
4KB

Download
memory/3136-164-0x000000007E2D0000-0x000000007E2D1000-memory.dmp

Filesize
4KB

Download
memory/3136-166-0x0000000008F70000-0x0000000008F71000-memory.dmp

Filesize
4KB

Download
memory/3836-236-0x0000000005280000-0x000000000577E000-memory.dmp

Filesize
5.0MB

Download
memory/3836-125-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3836-126-0x000000000040676E-mapping.dmp

Download

Analysis

Sharing