njrat | 00faaf68512770431f268aa1a1a26f8c589a3f53298db6311fd38f263fe0d474

General

Target

00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exe
Size

1.0MB
MD5

9d7d796646913b03fa10b8d0770ece41
SHA1

bb689e893dd764b3e55d0da1ddf91de2ef38b088
SHA256

00faaf68512770431f268aa1a1a26f8c589a3f53298db6311fd38f263fe0d474
SHA512

602f2ae98c32ad044deff1edfb9bd5b1d696269880962e6912d1c06b0c809e2ceea353ce854a666fcb917eb24c1d549caa048ad6482124fef10ddb95e70655d1

Score

10^/10

njrat hacked by mr.franko evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hacked By Mr.Franko

C2

frankohacker.strangled.net:5552

Mutex

69bd721f047aceee1a553df23f737f3e

Attributes

reg_key
69bd721f047aceee1a553df23f737f3e
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

LocalneTSlzsnEX.exeLocalsK_XSDCwEl.exeStuap.exe

pid process

364 LocalneTSlzsnEX.exe
1044 LocalsK_XSDCwEl.exe
2700 Stuap.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
364	LocalneTSlzsnEX.exe
1044	LocalsK_XSDCwEl.exe
2700	Stuap.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Stuap.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\69bd721f047aceee1a553df23f737f3e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stuap.exe\" .."	Stuap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\69bd721f047aceee1a553df23f737f3e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stuap.exe\" .."	Stuap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

Stuap.exe

description	pid	process
Token: SeDebugPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe
Token: 33	2700	Stuap.exe
Token: SeIncBasePriorityPrivilege	2700	Stuap.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exeLocalneTSlzsnEX.exeStuap.exe

description	pid	process	target process
PID 664 wrote to memory of 364	664	00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exe	LocalneTSlzsnEX.exe
PID 664 wrote to memory of 364	664	00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exe	LocalneTSlzsnEX.exe
PID 664 wrote to memory of 364	664	00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exe	LocalneTSlzsnEX.exe
PID 664 wrote to memory of 1044	664	00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exe	LocalsK_XSDCwEl.exe
PID 664 wrote to memory of 1044	664	00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exe	LocalsK_XSDCwEl.exe
PID 664 wrote to memory of 1044	664	00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exe	LocalsK_XSDCwEl.exe
PID 364 wrote to memory of 2700	364	LocalneTSlzsnEX.exe	Stuap.exe
PID 364 wrote to memory of 2700	364	LocalneTSlzsnEX.exe	Stuap.exe
PID 364 wrote to memory of 2700	364	LocalneTSlzsnEX.exe	Stuap.exe
PID 2700 wrote to memory of 716	2700	Stuap.exe	netsh.exe
PID 2700 wrote to memory of 716	2700	Stuap.exe	netsh.exe
PID 2700 wrote to memory of 716	2700	Stuap.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exe
"C:\Users\Admin\AppData\Local\Temp\00FAAF68512770431F268AA1A1A26F8C589A3F53298DB.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:664

C:\Users\Admin\AppData\LocalneTSlzsnEX.exe
"C:\Users\Admin\AppData\LocalneTSlzsnEX.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364

C:\Users\Admin\AppData\Local\Temp\Stuap.exe
"C:\Users\Admin\AppData\Local\Temp\Stuap.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Stuap.exe" "Stuap.exe" ENABLE
4⤵
PID:716

C:\Users\Admin\AppData\LocalsK_XSDCwEl.exe
"C:\Users\Admin\AppData\LocalsK_XSDCwEl.exe"
2⤵
- Executes dropped EXE
PID:1044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Stuap.exe
MD5
a02a4f465141e453066ad5055898fa32

SHA1
579915487ca92f89cdd5cde900d1667901c69aef

SHA256
b6f5deb6e5553bd4ab0265672122881646d1a244890db7ea9eca58bdced602ea

SHA512
7b6cd93151e11252241399e09b45eceba57ee9dbf5740bfb47f409111a3b0b447d1324f78f81a0a54ad9cc00145475b8ce344522557cd807c4fa911036e945d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stuap.exe
MD5
a02a4f465141e453066ad5055898fa32

SHA1
579915487ca92f89cdd5cde900d1667901c69aef

SHA256
b6f5deb6e5553bd4ab0265672122881646d1a244890db7ea9eca58bdced602ea

SHA512
7b6cd93151e11252241399e09b45eceba57ee9dbf5740bfb47f409111a3b0b447d1324f78f81a0a54ad9cc00145475b8ce344522557cd807c4fa911036e945d5

Download Submit
C:\Users\Admin\AppData\LocalneTSlzsnEX.exe
MD5
a02a4f465141e453066ad5055898fa32

SHA1
579915487ca92f89cdd5cde900d1667901c69aef

SHA256
b6f5deb6e5553bd4ab0265672122881646d1a244890db7ea9eca58bdced602ea

SHA512
7b6cd93151e11252241399e09b45eceba57ee9dbf5740bfb47f409111a3b0b447d1324f78f81a0a54ad9cc00145475b8ce344522557cd807c4fa911036e945d5

Download Submit
C:\Users\Admin\AppData\LocalneTSlzsnEX.exe
MD5
a02a4f465141e453066ad5055898fa32

SHA1
579915487ca92f89cdd5cde900d1667901c69aef

SHA256
b6f5deb6e5553bd4ab0265672122881646d1a244890db7ea9eca58bdced602ea

SHA512
7b6cd93151e11252241399e09b45eceba57ee9dbf5740bfb47f409111a3b0b447d1324f78f81a0a54ad9cc00145475b8ce344522557cd807c4fa911036e945d5

Download Submit
C:\Users\Admin\AppData\LocalsK_XSDCwEl.exe
MD5
47595f127c70f64217a848986198fbc1

SHA1
a87ed4a018b2363357bd64fb29aebe54939ca7e2

SHA256
5bce5a23145da087cfc10d824f19b24f4ef0293939882c34a437797a30da64bc

SHA512
f182bf779108f617e00ea99492d4fac0341a0f74de09a321e334b9d529707b5032834d44d9af4478c311def7f2a6a9b8becdf685d62777caa8677cb62fdb9909

Download Submit
C:\Users\Admin\AppData\LocalsK_XSDCwEl.exe
MD5
47595f127c70f64217a848986198fbc1

SHA1
a87ed4a018b2363357bd64fb29aebe54939ca7e2

SHA256
5bce5a23145da087cfc10d824f19b24f4ef0293939882c34a437797a30da64bc

SHA512
f182bf779108f617e00ea99492d4fac0341a0f74de09a321e334b9d529707b5032834d44d9af4478c311def7f2a6a9b8becdf685d62777caa8677cb62fdb9909

Download Submit
memory/364-121-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download
memory/364-115-0x0000000000000000-mapping.dmp

Download
memory/664-114-0x0000000002A80000-0x0000000002A82000-memory.dmp

Filesize
8KB

Download
memory/716-126-0x0000000000000000-mapping.dmp

Download
memory/1044-117-0x0000000000000000-mapping.dmp

Download
memory/2700-122-0x0000000000000000-mapping.dmp

Download
memory/2700-125-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads