njrat | baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc

Analysis

max time kernel
152s
max time network
174s
platform
windows7_x64
resource
win7v20210408
submitted
30-09-2021 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe
Size

3.3MB
MD5

a72d3ef38b9b0d80d375ac97883f7470
SHA1

2bc6af59a6790ad806863240cf64569e02809cc3
SHA256

baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc
SHA512

ce39a34b63de8c2ed8e4f1755deb1cda701295ca8fb94ef51440971956b20568a29bc6520e12068c345c010c8657df0374a4b2ac23fed15ffe40c2a15ef70f40

Score

10^/10

njrat hook persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

Hook

conqhook.ddns.net:6522

Mutex

System

Attributes

reg_key
System
splitter
|-F-|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

ConqHook.GUI.exeSystem.exeSystem.exe

pid process

2016 ConqHook.GUI.exe
1036 System.exe
1704 System.exe

pid	process
2016	ConqHook.GUI.exe
1036	System.exe
1704	System.exe

Drops startup file 5 IoCs

Processes:

System.exeattrib.exeSystem.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe	System.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	System.exe

Loads dropped DLL 7 IoCs

Processes:

baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exeConqHook.GUI.exeSystem.exe

pid	process
1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe
1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe
2016	ConqHook.GUI.exe
2016	ConqHook.GUI.exe
2016	ConqHook.GUI.exe
2016	ConqHook.GUI.exe
1036	System.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

System.exeSystem.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\System2 = "C:\\Users\\Admin\\AppData\\Roaming\\System.exe"	System.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\System2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\System.URL"	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\System.URL"	System.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\System.URL"	System.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\System.URL"	System.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

System.exe

description	pid	process
Token: SeDebugPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe
Token: 33	1704	System.exe
Token: SeIncBasePriorityPrivilege	1704	System.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exeSystem.exeSystem.exe

description	pid	process	target process
PID 1924 wrote to memory of 2016	1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe	ConqHook.GUI.exe
PID 1924 wrote to memory of 2016	1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe	ConqHook.GUI.exe
PID 1924 wrote to memory of 2016	1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe	ConqHook.GUI.exe
PID 1924 wrote to memory of 2016	1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe	ConqHook.GUI.exe
PID 1924 wrote to memory of 1036	1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe	System.exe
PID 1924 wrote to memory of 1036	1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe	System.exe
PID 1924 wrote to memory of 1036	1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe	System.exe
PID 1924 wrote to memory of 1036	1924	baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe	System.exe
PID 1036 wrote to memory of 1704	1036	System.exe	System.exe
PID 1036 wrote to memory of 1704	1036	System.exe	System.exe
PID 1036 wrote to memory of 1704	1036	System.exe	System.exe
PID 1036 wrote to memory of 1704	1036	System.exe	System.exe
PID 1036 wrote to memory of 1664	1036	System.exe	attrib.exe
PID 1036 wrote to memory of 1664	1036	System.exe	attrib.exe
PID 1036 wrote to memory of 1664	1036	System.exe	attrib.exe
PID 1036 wrote to memory of 1664	1036	System.exe	attrib.exe
PID 1704 wrote to memory of 1932	1704	System.exe	attrib.exe
PID 1704 wrote to memory of 1932	1704	System.exe	attrib.exe
PID 1704 wrote to memory of 1932	1704	System.exe	attrib.exe
PID 1704 wrote to memory of 1932	1704	System.exe	attrib.exe
PID 1704 wrote to memory of 1936	1704	System.exe	attrib.exe
PID 1704 wrote to memory of 1936	1704	System.exe	attrib.exe
PID 1704 wrote to memory of 1936	1704	System.exe	attrib.exe
PID 1704 wrote to memory of 1936	1704	System.exe	attrib.exe

Views/modifies file attributes 1 TTPs 3 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exe

pid process

1664 attrib.exe
1932 attrib.exe
1936 attrib.exe

pid	process
1664	attrib.exe
1932	attrib.exe
1936	attrib.exe

C:\Users\Admin\AppData\Local\Temp\baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe
"C:\Users\Admin\AppData\Local\Temp\baf26fd01ae7499dc6fce1917bd2f61375fe80a570b4f26447c862d088e03ebc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Roaming\Hook\GUI\ConqHook.GUI.exe
"C:\Users\Admin\AppData\Roaming\Hook\GUI\ConqHook.GUI.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016

C:\Users\Admin\AppData\Roaming\Hook\GUI\System.exe
"C:\Users\Admin\AppData\Roaming\Hook\GUI\System.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1036

C:\Users\Admin\AppData\Roaming\System.exe
"C:\Users\Admin\AppData\Roaming\System.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe"
4⤵
- Drops startup file
- Views/modifies file attributes
PID:1932

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\System.exe"
4⤵
- Views/modifies file attributes
PID:1936

C:\Windows\SysWOW64\attrib.exe
attrib +h +r +s "C:\Users\Admin\AppData\Roaming\System.exe"
3⤵
- Views/modifies file attributes
PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Hook\GUI\ConqHook.GUI.exe
MD5
325a8a4176a51b4dbe3aa14c72f63fb9

SHA1
a6badd3bf3f2cbaac5d1576f4640ae68b70cac24

SHA256
afdb2d31131a92ef6d5001846f595233f37e0fb56947161f9f95d2bb18fb3fbc

SHA512
a3e148a6cce91d74000f5aa934352277fbe11c6f9bddb18ca6df4a054918f69caf1b429b4fb6e216ce515bb9da49a38fcd17208bea638b76ba1d550a98674bff

Download Submit
C:\Users\Admin\AppData\Roaming\Hook\GUI\ConqHook.GUI.exe
MD5
325a8a4176a51b4dbe3aa14c72f63fb9

SHA1
a6badd3bf3f2cbaac5d1576f4640ae68b70cac24

SHA256
afdb2d31131a92ef6d5001846f595233f37e0fb56947161f9f95d2bb18fb3fbc

SHA512
a3e148a6cce91d74000f5aa934352277fbe11c6f9bddb18ca6df4a054918f69caf1b429b4fb6e216ce515bb9da49a38fcd17208bea638b76ba1d550a98674bff

Download Submit
C:\Users\Admin\AppData\Roaming\Hook\GUI\ConqHookV2.Bot.dll
MD5
a896ed3cb5eeca8e6f37e9af7d944f5d

SHA1
ccd245973f8914391fbf95c132bdb1c956a98ea7

SHA256
11d9ff7a8f5f82a914a85c6859c38f3e0f27c1a1435fa2bd9bef3b1cf03cb411

SHA512
e494815ed4dd8ebf6d8389a61dc2190eb2d46d4e7c2d018c2fe8b09fa49ed8b3499c4affc98ec1da881c910da506ceaddc68d1bfb9d48c23bb3cdf8e4d38a668

Download Submit
C:\Users\Admin\AppData\Roaming\Hook\GUI\ConqHookV2.Shared.dll
MD5
9ab431731ee59ab0ec78f627b46099a7

SHA1
5cc18cdc26a2a1a864e855efb674bec48ad03b6b

SHA256
28ff2a818388f704cad0f4f224605f181e185de0beed342519b1bc6f0e1de159

SHA512
8950475571e60d18f5adc4f42ec234d908b580aefae91328d88d02a992eec8755c654c01fba9a69feab8ef9739b7e60c975aef2eb3986d2e2d27c570b50a5309

Download Submit
C:\Users\Admin\AppData\Roaming\Hook\GUI\System.exe
MD5
a89670f783f344004a3342f01770cc82

SHA1
5ad773f03aef3af1f8ceee2e9ab2ab37b86bae54

SHA256
83e11501a042ac6f6b00155a39e138f51717759c9a29bfdd482f9b1fe8075b61

SHA512
3f9803e85580c47016baf0d2aa871727fbbd3df812a972cfbb7dca6ed8a56e072efe7e048d3df8a0480e1fb122970981d8e29e757ff1c7938ee37e17731d407a

Download Submit
C:\Users\Admin\AppData\Roaming\Hook\GUI\System.exe
MD5
a89670f783f344004a3342f01770cc82

SHA1
5ad773f03aef3af1f8ceee2e9ab2ab37b86bae54

SHA256
83e11501a042ac6f6b00155a39e138f51717759c9a29bfdd482f9b1fe8075b61

SHA512
3f9803e85580c47016baf0d2aa871727fbbd3df812a972cfbb7dca6ed8a56e072efe7e048d3df8a0480e1fb122970981d8e29e757ff1c7938ee37e17731d407a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe
MD5
a89670f783f344004a3342f01770cc82

SHA1
5ad773f03aef3af1f8ceee2e9ab2ab37b86bae54

SHA256
83e11501a042ac6f6b00155a39e138f51717759c9a29bfdd482f9b1fe8075b61

SHA512
3f9803e85580c47016baf0d2aa871727fbbd3df812a972cfbb7dca6ed8a56e072efe7e048d3df8a0480e1fb122970981d8e29e757ff1c7938ee37e17731d407a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk
MD5
4924721af37c077fa2ededeaf3233af8

SHA1
bcb163d9a13b637122f6dcfda1c84c84ad605048

SHA256
7e83cabc2d4b9815b27576b3ade78602a080ed1cb69b8fc82d6f60f207a3c6ff

SHA512
e8e429420f882dfda555607d3497516dade9e6ee5d06be63c684a661df16af149ce4f4d77b6edf8f90284c3ad147c7a197424fac5fd6206cf2ab810745691ca2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\System.lnk
MD5
94cbae867fb4f02d0e136f731772ed49

SHA1
c8a910b668a378fd63adc8d990d550adf3222a49

SHA256
06659f4c7945af876bbfcdb040f7a7d3771b27a59b4910d8fece35ace0907c2e

SHA512
9d290e0d83f18fda2cf4f7e9693a3980d56552e8e51fd4ff8b516b7df964b0dc264fdc22cd8a821360b5e323b2d031697c1d905994dca7667f4be4d6a762b1a4

Download Submit
C:\Users\Admin\AppData\Roaming\System.exe
MD5
a89670f783f344004a3342f01770cc82

SHA1
5ad773f03aef3af1f8ceee2e9ab2ab37b86bae54

SHA256
83e11501a042ac6f6b00155a39e138f51717759c9a29bfdd482f9b1fe8075b61

SHA512
3f9803e85580c47016baf0d2aa871727fbbd3df812a972cfbb7dca6ed8a56e072efe7e048d3df8a0480e1fb122970981d8e29e757ff1c7938ee37e17731d407a

Download Submit
C:\Users\Admin\AppData\Roaming\System.exe
MD5
a89670f783f344004a3342f01770cc82

SHA1
5ad773f03aef3af1f8ceee2e9ab2ab37b86bae54

SHA256
83e11501a042ac6f6b00155a39e138f51717759c9a29bfdd482f9b1fe8075b61

SHA512
3f9803e85580c47016baf0d2aa871727fbbd3df812a972cfbb7dca6ed8a56e072efe7e048d3df8a0480e1fb122970981d8e29e757ff1c7938ee37e17731d407a

Download Submit
\Users\Admin\AppData\Roaming\Hook\GUI\ConqHook.GUI.exe
MD5
325a8a4176a51b4dbe3aa14c72f63fb9

SHA1
a6badd3bf3f2cbaac5d1576f4640ae68b70cac24

SHA256
afdb2d31131a92ef6d5001846f595233f37e0fb56947161f9f95d2bb18fb3fbc

SHA512
a3e148a6cce91d74000f5aa934352277fbe11c6f9bddb18ca6df4a054918f69caf1b429b4fb6e216ce515bb9da49a38fcd17208bea638b76ba1d550a98674bff

Download Submit
\Users\Admin\AppData\Roaming\Hook\GUI\ConqHookV2.Bot.dll
MD5
a896ed3cb5eeca8e6f37e9af7d944f5d

SHA1
ccd245973f8914391fbf95c132bdb1c956a98ea7

SHA256
11d9ff7a8f5f82a914a85c6859c38f3e0f27c1a1435fa2bd9bef3b1cf03cb411

SHA512
e494815ed4dd8ebf6d8389a61dc2190eb2d46d4e7c2d018c2fe8b09fa49ed8b3499c4affc98ec1da881c910da506ceaddc68d1bfb9d48c23bb3cdf8e4d38a668

Download Submit
\Users\Admin\AppData\Roaming\Hook\GUI\ConqHookV2.Bot.dll
MD5
a896ed3cb5eeca8e6f37e9af7d944f5d

SHA1
ccd245973f8914391fbf95c132bdb1c956a98ea7

SHA256
11d9ff7a8f5f82a914a85c6859c38f3e0f27c1a1435fa2bd9bef3b1cf03cb411

SHA512
e494815ed4dd8ebf6d8389a61dc2190eb2d46d4e7c2d018c2fe8b09fa49ed8b3499c4affc98ec1da881c910da506ceaddc68d1bfb9d48c23bb3cdf8e4d38a668

Download Submit
\Users\Admin\AppData\Roaming\Hook\GUI\ConqHookV2.Shared.dll
MD5
9ab431731ee59ab0ec78f627b46099a7

SHA1
5cc18cdc26a2a1a864e855efb674bec48ad03b6b

SHA256
28ff2a818388f704cad0f4f224605f181e185de0beed342519b1bc6f0e1de159

SHA512
8950475571e60d18f5adc4f42ec234d908b580aefae91328d88d02a992eec8755c654c01fba9a69feab8ef9739b7e60c975aef2eb3986d2e2d27c570b50a5309

Download Submit
\Users\Admin\AppData\Roaming\Hook\GUI\ConqHookV2.Shared.dll
MD5
9ab431731ee59ab0ec78f627b46099a7

SHA1
5cc18cdc26a2a1a864e855efb674bec48ad03b6b

SHA256
28ff2a818388f704cad0f4f224605f181e185de0beed342519b1bc6f0e1de159

SHA512
8950475571e60d18f5adc4f42ec234d908b580aefae91328d88d02a992eec8755c654c01fba9a69feab8ef9739b7e60c975aef2eb3986d2e2d27c570b50a5309

Download Submit
\Users\Admin\AppData\Roaming\Hook\GUI\System.exe
MD5
a89670f783f344004a3342f01770cc82

SHA1
5ad773f03aef3af1f8ceee2e9ab2ab37b86bae54

SHA256
83e11501a042ac6f6b00155a39e138f51717759c9a29bfdd482f9b1fe8075b61

SHA512
3f9803e85580c47016baf0d2aa871727fbbd3df812a972cfbb7dca6ed8a56e072efe7e048d3df8a0480e1fb122970981d8e29e757ff1c7938ee37e17731d407a

Download Submit
\Users\Admin\AppData\Roaming\System.exe
MD5
a89670f783f344004a3342f01770cc82

SHA1
5ad773f03aef3af1f8ceee2e9ab2ab37b86bae54

SHA256
83e11501a042ac6f6b00155a39e138f51717759c9a29bfdd482f9b1fe8075b61

SHA512
3f9803e85580c47016baf0d2aa871727fbbd3df812a972cfbb7dca6ed8a56e072efe7e048d3df8a0480e1fb122970981d8e29e757ff1c7938ee37e17731d407a

Download Submit
memory/1036-72-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/1036-66-0x0000000000000000-mapping.dmp

Download
memory/1664-90-0x0000000000000000-mapping.dmp

Download
memory/1704-93-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/1704-86-0x0000000000000000-mapping.dmp

Download
memory/1924-60-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1932-94-0x0000000000000000-mapping.dmp

Download
memory/1936-95-0x0000000000000000-mapping.dmp

Download
memory/2016-73-0x00000000044D0000-0x00000000044D1000-memory.dmp

Filesize
4KB

Download
memory/2016-62-0x0000000000000000-mapping.dmp

Download
memory/2016-83-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

Filesize
4KB

Download
memory/2016-70-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/2016-79-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2016-77-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download