njrat | 04e1a14639f9fd0903f21edd99b1cadc9267b0ac2f402863d6eb3acc4d48acf7

General

Target

04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Size

91KB
MD5

8e0342b0a50e046c2b22f6d9548024eb
SHA1

0378936325dd0a19ac2547ad462017db60d9d315
SHA256

04e1a14639f9fd0903f21edd99b1cadc9267b0ac2f402863d6eb3acc4d48acf7
SHA512

cc9a2a0bcfbfd686b7be8487cc95eec046b30a46878cea40a457082478b5b6f00965b54d81cf4a3b7659fd087a27e0f0ad1c6f47cbbab7ff82f5b5bc3fb95876

Score

10^/10

njrat hacked evasion suricata trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

kanichnadia.duckdns.org:1979

Mutex

c9b81cdf127358c4e9ff59acf837f3c6

Attributes

reg_key
c9b81cdf127358c4e9ff59acf837f3c6
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe

description	pid	process
Token: SeDebugPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: 33	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
Token: SeIncBasePriorityPrivilege	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe

description	pid	process	target process
PID 4000 wrote to memory of 3164	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe	netsh.exe
PID 4000 wrote to memory of 3164	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe	netsh.exe
PID 4000 wrote to memory of 3164	4000	04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe
"C:\Users\Admin\AppData\Local\Temp\04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe" "04E1A14639F9FD0903F21EDD99B1CADC9267B0AC2F402.exe" ENABLE
  2⤵
  PID:3164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3164-122-0x0000000000000000-mapping.dmp

Download
memory/4000-115-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4000-117-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/4000-118-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/4000-119-0x0000000005450000-0x000000000597C000-memory.dmp

Filesize
5.2MB

Download
memory/4000-120-0x0000000005430000-0x0000000005436000-memory.dmp

Filesize
24KB

Download
memory/4000-121-0x00000000063B0000-0x00000000063B1000-memory.dmp

Filesize
4KB

Download
memory/4000-123-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/4000-124-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/4000-125-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing