njrat | df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576

General

Target

df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe
Size

13KB
MD5

354b2d0793453d6be6e92cb740f170e4
SHA1

9061310c8d87029de3088a95f22c28614d1c916f
SHA256

df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576
SHA512

dd74a5ff1a704104313b71ee83710896eff4e3d38ced07c68593025eae1ed13da6b44cbc635b9dbee384dd22ae7d18d16f89371b79466b33645fe3cadf27ed35

Score

10^/10

njrat nyan cat persistence suricata trojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

107.167.244.67:18971

Mutex

4a178b198a1a4260aad

Attributes

reg_key
4a178b198a1a4260aad
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Downloads MZ/PE file

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\uFzgJpBbCZdobdR = "C:\\Users\\Admin\\AppData\\Roaming\\LpEwT\\eLAKB.exe"	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe

description	pid	process	target process
PID 568 set thread context of 1084	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe
Token: SeDebugPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe
Token: 33	1084	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1084	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe

description	pid	process	target process
PID 568 wrote to memory of 1084	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe	RegAsm.exe
PID 568 wrote to memory of 1084	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe	RegAsm.exe
PID 568 wrote to memory of 1084	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe	RegAsm.exe
PID 568 wrote to memory of 1084	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe	RegAsm.exe
PID 568 wrote to memory of 1084	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe	RegAsm.exe
PID 568 wrote to memory of 1084	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe	RegAsm.exe
PID 568 wrote to memory of 1084	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe	RegAsm.exe
PID 568 wrote to memory of 1084	568	df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe
"C:\Users\Admin\AppData\Local\Temp\df841db0f1f8f968ec6fc8c0d8bbd618bbacdcd7bf8146ad0267371884071576.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-114-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/568-116-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/568-117-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/568-118-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/568-119-0x0000000005C00000-0x0000000005C65000-memory.dmp

Filesize
404KB

Download
memory/568-122-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/1084-120-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1084-121-0x000000000040676E-mapping.dmp

Download
memory/1084-127-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/1084-128-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/1084-129-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/1084-130-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads