njrat | b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155

General

Target

b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Size

407KB
MD5

857aff9992a47764185c61da2493c753
SHA1

6efa34cd3fdb299fcd940c0719d3a172bac83164
SHA256

b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155
SHA512

fbb2a5bfb068d4f56e338dc67f4d1a171af3156de2b3d956a0a1bd9526706f370cdff16cfb136049468b3a71db4c7ce99349265d3841db7775d5389b7aab798a

Score

10^/10

njrat nyan cat suricata trojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

pedrobedoya2021.duckdns.org:1980

Mutex

cf13c225ff474d45b

Attributes

reg_key
cf13c225ff474d45b
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

description	pid	process	target process
PID 3980 set thread context of 3560	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exepowershell.exe

pid	process
3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
2904	powershell.exe
2904	powershell.exe
2904	powershell.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exepowershell.exeb73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

description	pid	process
Token: SeDebugPrivilege	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: 33	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
Token: SeIncBasePriorityPrivilege	3560	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

description	pid	process	target process
PID 3980 wrote to memory of 2904	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	powershell.exe
PID 3980 wrote to memory of 2904	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	powershell.exe
PID 3980 wrote to memory of 2904	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	powershell.exe
PID 3980 wrote to memory of 3972	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3972	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3972	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3560	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3560	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3560	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3560	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3560	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3560	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3560	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
PID 3980 wrote to memory of 3560	3980	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe	b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe

C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
"C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
  "C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe"
  2⤵
  PID:3972
- C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe
  "C:\Users\Admin\AppData\Local\Temp\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155.exe.log

MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
memory/2904-153-0x0000000008FD0000-0x0000000009003000-memory.dmp

Filesize
204KB

Download
memory/2904-361-0x0000000009480000-0x0000000009481000-memory.dmp

Filesize
4KB

Download
memory/2904-137-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/2904-367-0x0000000009470000-0x0000000009471000-memory.dmp

Filesize
4KB

Download
memory/2904-138-0x0000000000DD2000-0x0000000000DD3000-memory.dmp

Filesize
4KB

Download
memory/2904-236-0x0000000000DD3000-0x0000000000DD4000-memory.dmp

Filesize
4KB

Download
memory/2904-139-0x0000000007160000-0x0000000007161000-memory.dmp

Filesize
4KB

Download
memory/2904-235-0x000000007E460000-0x000000007E461000-memory.dmp

Filesize
4KB

Download
memory/2904-125-0x0000000000000000-mapping.dmp

Download
memory/2904-166-0x00000000094F0000-0x00000000094F1000-memory.dmp

Filesize
4KB

Download
memory/2904-165-0x0000000009110000-0x0000000009111000-memory.dmp

Filesize
4KB

Download
memory/2904-160-0x0000000008FB0000-0x0000000008FB1000-memory.dmp

Filesize
4KB

Download
memory/2904-135-0x0000000004730000-0x0000000004731000-memory.dmp

Filesize
4KB

Download
memory/2904-136-0x0000000007200000-0x0000000007201000-memory.dmp

Filesize
4KB

Download
memory/2904-145-0x00000000081E0000-0x00000000081E1000-memory.dmp

Filesize
4KB

Download
memory/2904-144-0x0000000007F40000-0x0000000007F41000-memory.dmp

Filesize
4KB

Download
memory/2904-143-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/2904-140-0x0000000007830000-0x0000000007831000-memory.dmp

Filesize
4KB

Download
memory/2904-141-0x0000000007920000-0x0000000007921000-memory.dmp

Filesize
4KB

Download
memory/2904-142-0x0000000007B70000-0x0000000007B71000-memory.dmp

Filesize
4KB

Download
memory/3560-383-0x0000000004F30000-0x000000000542E000-memory.dmp

Filesize
5.0MB

Download
memory/3560-127-0x000000000040677E-mapping.dmp

Download
memory/3560-126-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3980-123-0x00000000086A0000-0x00000000086F4000-memory.dmp

Filesize
336KB

Download
memory/3980-118-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/3980-115-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/3980-117-0x0000000005490000-0x0000000005491000-memory.dmp

Filesize
4KB

Download
memory/3980-124-0x000000000AE50000-0x000000000AE6F000-memory.dmp

Filesize
124KB

Download
memory/3980-122-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/3980-121-0x0000000005450000-0x0000000005457000-memory.dmp

Filesize
28KB

Download
memory/3980-120-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/3980-119-0x0000000004F90000-0x000000000548E000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads