njrat | 8797ab41f89827f3231b25b4240fd7aae72ee46415e1f28a3b81148debc00408

General

Target

8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe
Size

373KB
MD5

9eb869a782ce77b409f6126372c9d231
SHA1

b2aece502fa66059dcc61e33bd2e4822e01182df
SHA256

8797ab41f89827f3231b25b4240fd7aae72ee46415e1f28a3b81148debc00408
SHA512

fb2ef14ca11855fdc4ae37233cf52c99b619f9739bfafd1ce2ccfdcdd1df6a679c779312a01fde2115b86c4f08f8f9e832bdab119c570bf28a6cfc65f5c001d6

Score

10^/10

njrat lime link pdf trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Lime

C2

soportesltda30.duckdns.org:4433

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
jairpicc

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

windows.exewindows.exewindows.exe

pid process

684 windows.exe
1396 windows.exe
1632 windows.exe
Drops startup file 1 IoCs

Processes:

WScript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.EXE WScript.exe
Loads dropped DLL 1 IoCs

Processes:

WScript.exe

pid process

960 WScript.exe

pid	process
684	windows.exe
1396	windows.exe
1632	windows.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.EXE	WScript.exe

pid	process
960	WScript.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\leer.pdf	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1644 schtasks.exe
1740 schtasks.exe
1852 schtasks.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1704 AcroRd32.exe

pid	process
1644	schtasks.exe
1740	schtasks.exe
1852	schtasks.exe

pid	process
1704	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

windows.exe

description	pid	process
Token: SeDebugPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe
Token: 33	684	windows.exe
Token: SeIncBasePriorityPrivilege	684	windows.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

1704 AcroRd32.exe
1704 AcroRd32.exe
1704 AcroRd32.exe
1704 AcroRd32.exe

pid	process
1704	AcroRd32.exe
1704	AcroRd32.exe
1704	AcroRd32.exe
1704	AcroRd32.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exeWScript.exewindows.exetaskeng.exewindows.exewindows.exe

description	pid	process	target process
PID 1048 wrote to memory of 1704	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	AcroRd32.exe
PID 1048 wrote to memory of 1704	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	AcroRd32.exe
PID 1048 wrote to memory of 1704	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	AcroRd32.exe
PID 1048 wrote to memory of 1704	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	AcroRd32.exe
PID 1048 wrote to memory of 1704	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	AcroRd32.exe
PID 1048 wrote to memory of 1704	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	AcroRd32.exe
PID 1048 wrote to memory of 1704	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	AcroRd32.exe
PID 1048 wrote to memory of 960	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	WScript.exe
PID 1048 wrote to memory of 960	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	WScript.exe
PID 1048 wrote to memory of 960	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	WScript.exe
PID 1048 wrote to memory of 960	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	WScript.exe
PID 1048 wrote to memory of 960	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	WScript.exe
PID 1048 wrote to memory of 960	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	WScript.exe
PID 1048 wrote to memory of 960	1048	8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe	WScript.exe
PID 960 wrote to memory of 684	960	WScript.exe	windows.exe
PID 960 wrote to memory of 684	960	WScript.exe	windows.exe
PID 960 wrote to memory of 684	960	WScript.exe	windows.exe
PID 960 wrote to memory of 684	960	WScript.exe	windows.exe
PID 960 wrote to memory of 684	960	WScript.exe	windows.exe
PID 960 wrote to memory of 684	960	WScript.exe	windows.exe
PID 960 wrote to memory of 684	960	WScript.exe	windows.exe
PID 684 wrote to memory of 556	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 556	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 556	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 556	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 556	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 556	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 556	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 1644	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 1644	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 1644	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 1644	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 1644	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 1644	684	windows.exe	schtasks.exe
PID 684 wrote to memory of 1644	684	windows.exe	schtasks.exe
PID 844 wrote to memory of 1396	844	taskeng.exe	windows.exe
PID 844 wrote to memory of 1396	844	taskeng.exe	windows.exe
PID 844 wrote to memory of 1396	844	taskeng.exe	windows.exe
PID 844 wrote to memory of 1396	844	taskeng.exe	windows.exe
PID 1396 wrote to memory of 1892	1396	windows.exe	schtasks.exe
PID 1396 wrote to memory of 1892	1396	windows.exe	schtasks.exe
PID 1396 wrote to memory of 1892	1396	windows.exe	schtasks.exe
PID 1396 wrote to memory of 1892	1396	windows.exe	schtasks.exe
PID 1396 wrote to memory of 1740	1396	windows.exe	schtasks.exe
PID 1396 wrote to memory of 1740	1396	windows.exe	schtasks.exe
PID 1396 wrote to memory of 1740	1396	windows.exe	schtasks.exe
PID 1396 wrote to memory of 1740	1396	windows.exe	schtasks.exe
PID 844 wrote to memory of 1632	844	taskeng.exe	windows.exe
PID 844 wrote to memory of 1632	844	taskeng.exe	windows.exe
PID 844 wrote to memory of 1632	844	taskeng.exe	windows.exe
PID 844 wrote to memory of 1632	844	taskeng.exe	windows.exe
PID 1632 wrote to memory of 1984	1632	windows.exe	schtasks.exe
PID 1632 wrote to memory of 1984	1632	windows.exe	schtasks.exe
PID 1632 wrote to memory of 1984	1632	windows.exe	schtasks.exe
PID 1632 wrote to memory of 1984	1632	windows.exe	schtasks.exe
PID 1632 wrote to memory of 1852	1632	windows.exe	schtasks.exe
PID 1632 wrote to memory of 1852	1632	windows.exe	schtasks.exe
PID 1632 wrote to memory of 1852	1632	windows.exe	schtasks.exe
PID 1632 wrote to memory of 1852	1632	windows.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe
"C:\Users\Admin\AppData\Local\Temp\8797AB41F89827F3231B25B4240FD7AAE72EE46415E1F.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\leer.pdf"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1704

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\win.vbs"
2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
4⤵
PID:556

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\windows.exe" /sc minute /mo 1
4⤵
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\taskeng.exe
taskeng.exe {09190D50-CE8F-4DA1-BCF3-CED445E8F4E2} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:844

C:\Users\Admin\AppData\Local\Temp\windows.exe
C:\Users\Admin\AppData\Local\Temp\windows.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
3⤵
PID:1892

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\windows.exe" /sc minute /mo 1
3⤵
- Creates scheduled task(s)
PID:1740

C:\Users\Admin\AppData\Local\Temp\windows.exe
C:\Users\Admin\AppData\Local\Temp\windows.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\schtasks.exe
schtasks /Delete /tn NYAN /F
3⤵
PID:1984

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\windows.exe" /sc minute /mo 1
3⤵
- Creates scheduled task(s)
PID:1852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\leer.pdf
MD5
1db6b198366804e52fa1fbc3599934bf

SHA1
171b5758a6483ce5ccddfc3d5dc5e9d40c7aa7b1

SHA256
60205229cab8dce06632c2b9d61b0628186e74ff6fc7db66112d149a576ec8dc

SHA512
35631ecaf2124ee272f78e6382dc4b8f939ff8fe4b11f874176e44d20526b524b3540d5bf7fd2e21c81e92a69f7f31257e5f1ea1cf9f7e79ba01fd2a7f77efed

Download Submit
C:\Users\Admin\AppData\Local\Temp\win.vbs
MD5
466373d5f9d9e8daa9052c303071080f

SHA1
410d62f9075cae08e6b31c5e666f67892982a6ba

SHA256
f4056dbe3779c8e0700567ed46b782ddc7bfda547e7e63b43d2748ef60e12c12

SHA512
de1eca6b8f17980d44ed5c4de455a78865bc117cf51b02e9e1f026096d417e6593272aa64f45fb8f2657b646608b84df25842b2a5b9b45cda4b2e55bc3e0a303

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
C:\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
\Users\Admin\AppData\Local\Temp\windows.exe
MD5
e755d66ec3fb3877c81b6c6818ef083e

SHA1
e79fdfd8ac6794ebf4daeb044dc98ea47ddb3c4f

SHA256
56203d61bb74a63227367a5d68f3a4869c109be343fccd0bf992f30d0d3192ad

SHA512
f1323391fb5bb2ad278a21905508de06e1ce5dd92895de30f010b9858e74069ec8ce97b7ef4e20cf5e17f6e7a37dd54da5791f2c3e0b5a48cd30318144c4714e

Download Submit
memory/556-65-0x0000000000000000-mapping.dmp

Download
memory/684-61-0x0000000000000000-mapping.dmp

Download
memory/684-69-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/960-56-0x0000000000000000-mapping.dmp

Download
memory/1048-53-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download
memory/1396-70-0x0000000000000000-mapping.dmp

Download
memory/1396-73-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/1632-80-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

Filesize
4KB

Download
memory/1632-76-0x0000000000000000-mapping.dmp

Download
memory/1644-67-0x0000000000000000-mapping.dmp

Download
memory/1704-54-0x0000000000000000-mapping.dmp

Download
memory/1740-75-0x0000000000000000-mapping.dmp

Download
memory/1852-81-0x0000000000000000-mapping.dmp

Download
memory/1892-74-0x0000000000000000-mapping.dmp

Download
memory/1984-79-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads